8

In the interest of safeguarding my master key I store it offline. I have a gpg subkey with indicator SEA that I keep available on my system. When I download software I verify it using the provided asc file and the developer's public key by importing his/her key into gpg and running

gpg --verify filename.asc filename

In the interest of eliminating the 'not certified with a trusted signature' warning I expected to be able to sign the developer's key with my subkey. However, I get the error

gpg: signing failed: No secret key

I tried to override the signing key with

gpg --local-user subkeyid! --lsign-key developer_keyid

but I still receive the same error. Is it possible to sign a developer's key with my subkey using gpg? If so, is it a good idea and why or why not?

Thanks in advance!

Improve this question
2
  • Why do you want to use a subkey specifically for this? Using --lsign to create a non-exportable signature should be good enough for almost any use case; if you can tell us why you feel yours is an exception, then we might be able to suggest an alternative approach that does work.
    – user
    Commented Mar 6, 2017 at 10:55
  • I'm not sure if we're on the same page. I do only want to create a non-exportable signature so that I can locally verify software that was signed by that developer. As far as I can tell I cannot currently use any variation of --lsign without having my master key present (or perhaps adding another primary key). I believe user2233709 answered my question. I think what he is saying in his response is that because my subkey is lacking the 'C' capability that is needed to 'Certify' the other developer's identity (sign his public key).
    – Brian O'Connell
    Commented Mar 8, 2017 at 1:57

1 Answer 1

Reset to default
5

“Signing” a user’s key (in fact, that’s signing his identity) requires the “Certify” capability. As far as I know, GnuPG does not allow you to create a subkey with the “Certify” capability (I don’t know whether the OpenPGP standard allows this). So, unfortunately, no, you cannot “sign” a user’s key with your subkey.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .