I suggest a feature to sign a public key : gpg2 --sign-key name

[harobed]

Hi,

I suggest a feature to sign a public key :

gpg2 --sign-key name

http://www.gnupg.org/documentation/manuals/gnupg/OpenPGP-Key-Management.html#OpenPGP-Key-Management

Best regards,
Stephane

[isislovecruft]

I might consider adding this, though I can't think of any threat model where allowing automated, likely passwordless, certification of other keys increases security in some substantial manner. Actually, the only "useful" thing (from some peoples' views) that I could foresee being done with this feature would be to use it to spam/poison the Web of Trust with a bunch of fake keys which cross-certify each other.

How were you thinking of using it?

[muelli]

May I just ask for clarity: Is it possible, right now, to sign a key with python-gnupg?

[meskio]

@isislovecruft we'll need that in @leapcode to roll new keys, when you generate a new key you want to sign it with the previous one. I'm having a look to the code to propose an implementation of key signature for python-gnupg.

@muelli as far as I digg in the code it's not implemented anywhere.

[isislovecruft]

@meskio I'll take patches for this. It's going to be pretty hard to do. By default, --sign-key drops you into an interactive prompt asking Really sign all user IDs? (y/N) and afterwards, regardless of your answer, drops you off in the gpg> interactive prompt (where you have to type save and quit and so forth). By default (because it's meant to be automateable) python-gnupg uses --no-tty to disable all interactivity, and trying to use --sign-key with --no-tty will produce an error message saying gpg: Sorry, no terminal at all requested - can't get input. Further, gpg won't listen to you if you try to use anything like --no-tty --passphrase-fd 0 --sign-key or any of the other passphrase input options. Not to deter anyone, because I'll take all the help I can get, but this is not going to be a fun set of patches, I'm afraid. :/

[meskio]

After some tests I see you are right, this is not going to be easy. Right now I have other priorities and I put that on the back log. I'll come back at some point to try to implemented again.

Thanks for the info.

[muelli]

On gnupg-users, Werner mentions that with GnuPG 2.1 it should be easier to implement.

http://www.gossamer-threads.com/lists/gnupg/users/68547
https://gnupg.org/faq/whats-new-in-2.1.html#quickgen