This public keyring pubring.kbx (as I merely guess from the name) must be safe to share publicly or is it not? Does it contain any sensitive information with respect to private keys?

I want to back up this file and I'm curious what is the best practice for it given answers to the above questions. Like would it be fine to just commit it to version control (along with gpg.conf, for instance) as is or rather gpg --armor --export to be used in this case?


I found someone asking the same question on the gnupg mailing list archive.

This a database file storing the certificates as well as meta information. For debugging purposes the tool kbxutil may be used to show the internal structure of this file. You should backup this file.

Source : http://gnupg.10057.n7.nabble.com/What-is-pubring-kbx-td50294.html

| improve this answer | |
  • I saw this as well. Was (is) not informative enough for me TBH. – Alexander Shukaev Oct 11 '18 at 0:01
  • Did you try using the kbxutil to see what the contents of the file is? – Daisetsu Oct 11 '18 at 0:26
  • I did and I don't understand everything in the output. Furthermore, that's just an intermediate tool printing possibly some information and maybe not all of it. This only adds another point of hesitation. I'm rather looking for either an experienced authority opinion (backed up by past/current experience) and/or documentation reference and/or core developer response. – Alexander Shukaev Oct 11 '18 at 0:50
  • In that case you may want to try the gnupg mailing list. You aren't going to find a better collection of experts on the program than them. – Daisetsu Oct 11 '18 at 2:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.