Maniphest T8344

gpg: Fix edit-key bkuptocard
Testing, HighPublic
Actions

Assigned To
• werner
Authored By
• werner
Jul 10 2026, 9:46 AM
Tags
Subscribers
• alexk
• ebo
pl13
• werner

Description

The "bkuptocard" sub-command of gpg --edit-key does not anymore work as it used to work back then when we had a secring.gpg and a pubring.gpg. The problem is that no public subkey packet is created and one has to resort to generate subkey from card. This needs to be fixed.

And while at it: the gpg --card-edit generate command needs an option to only create the signing key, which is the first step in replacing a bricked card with a new card. After that bktocard can be used to restore the encryption subkey.

Revisions and Commits

rG GnuPG
rGa95da9e25362 gpg: Add option primary to the --card-edit generate command.
rGf103eaee63f7 gpg: Fix long standing regression of "bkuptocard"

Related Objects
Search...

Event Timeline

• werner triaged this task as High priority.Jul 10 2026, 9:46 AM
• werner created this task.
• werner created this object with edit policy "Contributor (Project)".
pl13 added a subscriber: pl13.Jul 10 2026, 12:12 PM
• werner moved this task from Backlog to WIP on the gnupg26 board.Jul 13 2026, 5:37 PM
• werner added a commit: rGf103eaee63f7: gpg: Fix long standing regression of "bkuptocard".Jul 15 2026, 10:03 AM
• werner added a comment.Jul 15 2026, 10:31 AM

Please see the rGf103eaee63f702278824967365de16b9757ecc83 for detailed comment on the (solved) problem.

• werner added a commit: rGa95da9e25362: gpg: Add option primary to the --card-edit generate command..Jul 15 2026, 10:51 AM
• werner changed the task status from Open to Testing.Jul 15 2026, 10:55 AM

Restoring an encryption subkey is now easy if you have an sk_KEYID.gpg backup:

  1. Get a fresh card or factory-reset a card.
  2. gpg --card-edit, then "admin", then "generate primary"
  3. gpg --edit-key NEWKEYID, use "bkuptocard sk_KEYID.gpg"
  4. Optionally use gpg --edit-key to add a new authentication (ssh) key to the card.
• ikloecker mentioned this in T8339: Draft: Kleopatra: Add option to generate a new key on card using a sk_keyID.gpg backup file to restore the encrypt key.Jul 15 2026, 11:21 AM
• werner mentioned this in T8320: Release GnuPG 2.5.22.Mon, Aug 31, 2:28 PM