NAME

       migrate-pubring-from-classic-gpg - Migrate a public keyring from "classic" to "modern" GnuPG

SYNOPSIS

       migrate-pubring-from-classic-gpg [ GPGHOMEDIR | --default ]

DESCRIPTION

       migrate-pubring-from-classic-gpg  migrates the public keyring in GnuPG home directory GPGHOMEDIR from the
       "classic" keyring format (pubring.gpg) to the "modern" keybox format using  GnuPG  versions  2.1  or  2.2
       (pubring.kbx).

       Specifying  --default selects the standard GnuPG home directory (looking at $GNUPGHOME first, and falling
       back to ~/.gnupg if unset.

OPTIONS

       -h, --help, --usage Output a short usage information.

DIAGNOSTICS

       The program sends quite a bit of text (perhaps too much) to stderr.

       During a migration, the tool backs up several pieces  of  data  in  a  timestamped  subdirectory  of  the
       GPGHOMEDIR.

LIMITATIONS

       The  keybox  format  rejects  a  number of OpenPGP certificates that the "classic" keyring format used to
       accept.   These  filters  are  defensive,  since  the  certificates  rejected  are   unsafe   --   either
       cryptographically  unsound,  or  dangerously non-performant.  This means that some migrations may produce
       warning messages about the migration being incomplete.  This is generally a good thing!

       Known limitations:

       Flooded certificates
           Some OpenPGP certificates have been flooded with bogus certifications as part of an attack on the SKS
           keyserver       network      (see      https://tools.ietf.org/html/draft-dkg-openpgp-abuse-resistant-
           keystore-03#section-2.1).

           The keybox format rejects import of any OpenPGP certificate larger than 5MiB.  As of GnuPG 2.2.17, if
           gpg  encounters  such  a  flooded  certificate  will retry the import while stripping all third-party
           certifications (see "self-sigs-only" in gpg(1)).

           The typical error message when migrating a keyring with a flooded certificate will be something like:

               error writing keyring 'pubring.kbx': Provided object is too large

       OpenPGPv3 public keys (a.k.a. PGP-2 keys)
           Modern OpenPGP implementations use so-called "OpenPGP v4" public keys.  Older versions of the  public
           key  format  have  serious known problems.  See https://tools.ietf.org/html/rfc4880#section-5.5.2 for
           more details about and reasons for v3 key deprecation.

           The keybox format skips v3 keys entirely during migration, and GnuPG will produce a message like:

               skipped PGP-2 keys: 1

ENVIRONMENT VARIABLES

       GNUPGHOME Selects the GnuPG home directory when set and --default is given.

       GPG The name of the gpg executable (defaults to gpg ).

SEE ALSO

       gpg(1)

AUTHOR

       Copyright (C) 2016 Daniel Kahn Gillmor for the Debian project. Please report bugs via the Debian BTS.

                                                   April 2016                MIGRATE-PUBRING-FROM-CLASSIC-GPG(1)