0

I am trying to use the imported GPG keys in my workflow but it seems I could never export the private keys out of this.

I am using GitHub actions https://github.com/marketplace/actions/import-gpg to import private key and passphrase loaded them via secrets and per below output I could see the keys were imported good. I need to use this for signing my helm chart.

Run crazy-max/ghaction-import-gpg@v5
  with:
    gpg_private_key: ***
    passphrase: ***
    git_user_signingkey: true
    git_commit_gpgsign: true
    git_config_global: false
    git_tag_gpgsign: false
    git_push_gpgsign: if-asked

    workdir: .
GnuPG info
  Version    : 2.2.27 (libgcrypt 1.9.4)
  Libdir     : /usr/lib/x86_64-linux-gnu/gnupg
  Libexecdir : /usr/lib/gunning
  Datadir    : /usr/share/gnupg
  Homedir    : /home/runner/.gnupg
GPG private key info
  Fingerprint  : xxxxxxxxxxxxxxxxxxxx
  KeyID        : xxxxxxxxxxxxxxxxxxxx
  Name         : bot
  Email        : bot@example.com
  CreationTime : Thu Jan 12 2023 05:56:57 GMT+0000 (Coordinated Universal Time)
Fingerprint to use
  xxxxxxxxxxxxxxxxxxxx
Importing GPG private key
  gpg: directory '/home/runner/.gnupg' created
  gpg: keybox '/home/runner/.gnupg/pubring.kbx' created
  gpg: /home/runner/.gnupg/trustdb.gpg: trustdb created
  gpg: key xxxxxxxxxxxxxxxxxxxx: public key "bot <bot@example.com>" imported
  gpg: key xxxxxxxxxxxxxxxxxxxx: secret key imported
  gpg: Total number processed: 1
  gpg:               imported: 1
  gpg:       secret keys read: 1
  gpg:   secret keys imported: 1
Configuring GnuPG agent
Getting keygrips
  Presetting passphrase for xxxxxxxxxxxxxxxxxxxx
Setting outputs
  fingerprint=xxxxxxxxxxxxxxxxxxxx
  keyid= xxxxxxxxxxxxxxxxxxxx
  name=bot
  email=bot@example.com
Setting GPG signing keyID for this Git repository

I could verify the new format file is there on filesystem , In next step I am trying to export these keys via commands

-rw-r--r--  1 runner docker   70 Jan 18 00:50 gpg-agent.conf
drwx------  2 runner docker 4096 Jan 18 00:50 private-keys-v1.d
-rw-r--r--  1 runner docker 1347 Jan 18 00:50 pubring.kbx
-rw-------  1 runner docker   32 Jan 18 00:50 pubring.kbx~
-rw-------  1 runner docker 1200 Jan 18 00:50 trustdb.gpg
/home/runner/.gnupg/pubring.kbx
-------------------------------
sec   rsa4096 2023-01-12 [SC] [expires: 2025-01-11]
      xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
uid           [ unknown] bot <bot@example.com>

Now I am trying to export these keys and I could generate pubring.gpg but the moment I try to export secret key It gives error.

$ gpg --export >~/.gnupg/pubring.gpg        -------------> Works
$ gpg --export-secret-keys >~/.gnupg/secring.gpg.  --------> Doesn't work
gpg: key xxxxxxxxxxxxxx: error receiving key from agent: No such file or directory - skipped
gpg: WARNING: nothing exported
Error: Process completed with exit code 2.

I couldn't understand why secret key can't be imported out of pubring.kbx file. Appreciate help.

vgdub
  • 347
  • 5
  • 15

0 Answers0