2

This public keyring pubring.kbx (as I merely guess from the name) must be safe to share publicly or is it not? Does it contain any sensitive information with respect to private keys?

I want to back up this file and I'm curious what is the best practice for it given answers to the above questions. Like would it be fine to just commit it to version control (along with gpg.conf, for instance) as is or rather gpg --armor --export to be used in this case?

1
  • Did you get an answer to that question? This post pops up in search results, and the answer would be appreciated. Thanks. I would say it is not safe to share as "The keyring contains your public key and imported public keys.". So it contains keys you've imported. Regarding encryption, it doesn't cause an issue, but it's a problem with privacy, as you may not want to show the list of people you have the public keys of. Source: linuxbabe.com/security/gpg-guide-public-key-management
    – Adrien H
    Commented May 1, 2023 at 17:47

1 Answer 1

1

I found someone asking the same question on the gnupg mailing list archive.

This a database file storing the certificates as well as meta information. For debugging purposes the tool kbxutil may be used to show the internal structure of this file. You should backup this file.

Source : http://gnupg.10057.n7.nabble.com/What-is-pubring-kbx-td50294.html

4
  • I saw this as well. Was (is) not informative enough for me TBH. Commented Oct 11, 2018 at 0:01
  • Did you try using the kbxutil to see what the contents of the file is?
    – Daisetsu
    Commented Oct 11, 2018 at 0:26
  • I did and I don't understand everything in the output. Furthermore, that's just an intermediate tool printing possibly some information and maybe not all of it. This only adds another point of hesitation. I'm rather looking for either an experienced authority opinion (backed up by past/current experience) and/or documentation reference and/or core developer response. Commented Oct 11, 2018 at 0:50
  • In that case you may want to try the gnupg mailing list. You aren't going to find a better collection of experts on the program than them.
    – Daisetsu
    Commented Oct 11, 2018 at 2:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .