[QUESTION] How to configure GPG key?

[bastientanesie]

I'm trying to configure GPG key while using the nucleus command for a production environment.
I've stumbled upon #30, but cannot find a working solution.

I followed this GitHub guide to generate a GPG key pair and export them into seperate files.
I tried to copy the content of each files individually in the config.gpgSigningKey, then tried to copy both file contents inside the config key but all I got is this error message (while starting the serve with $ nucleus path/to/my/config.js):

nucleus: Checking GPG key +87ms
nucleus: Bad gpg key, invalid
GPG key is invalid or missing, you must provide "config.gpgSigningKey"

@MarshallOfSound can you tell me what value should we pass to config.gpgSigningKey?

[MarshallOfSound]

@bastientanesie Your GPG value should look something like this

-----BEGIN PGP PUBLIC KEY BLOCK-----
SOME DATA STUFF
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP PRIVATE KEY BLOCK-----
BUNCH OF DATA
-----END PGP PRIVATE KEY BLOCK-----

[bastientanesie]

Thanks @MarshallOfSound, I got it to work! 👍

Here's what I did:

$ gpg --full-generate-key
Follow the instructions. Create your keys without any protection (empty passphrase).

$ gpg --list-secret-keys --keyid-format LONG
Looks like "rsa4096/C8E2A0E20C2AEB3B 2018-05-23 [...]", where "C8E2A0E20C2AEB3B" is your key ID.

$ gpg --armor --export YOUR_KEY_ID outputs your PUBLIC key.

$ gpg --armor --export-private-key YOUR_KEY_ID outputs your PRIVATE key.

In your config.js file, it should look like this:

 /**
   * GPG key to use when signing APT and YUM releases
   *
   * Requires to be unlocked (no password) and have both the private and
   * public key.
   */
  gpgSigningKey: `
-----BEGIN PGP PUBLIC KEY BLOCK-----

YOUR PUBLIC KEY CONTENTS

-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP PRIVATE KEY BLOCK-----

YOUR PRIVATE KEY CONTENTS

-----END PGP PRIVATE KEY BLOCK-----
`
};

Make sure you keep those blank lines before and after the key contents.

BTW, this GPG cheatsheet might be usefull 😉.

[MarshallOfSound]

@bastientanesie Would you be down to write up your journey as a step-by-step guide and PR it into the docs folder of this repository so others can benefit from your learnings? 😄

[bastientanesie]

@MarshallOfSound sure thing, I just need to find some spare time now! 😅

[dmr]

Thank you for the gpg manual!

gpg --armor --export-secret-key KEYID

--> Can this go into the Readme?

[dimthe]

i run into the same problem and trying to enter the gpg keys in the config.js .
all the gpg commands above work fine except the last one where you view your private key , this does not work . Any ideas ... ?

i get this

gpg --armor --export-private-key 77F3C65298639C4F
gpg: invalid option "--export-private-key"

[dimthe]

@MarshallOfSound can this issue be reopened ?

[astritzeqiri]

@dimthe try
gpg --armor --export-secret-key 77F3C65298639C4F

[bastientanesie]

@dimthe it depends on the version of the gnupg package currently installed. @astritzeqiri's solution should work 👍.

[wuyue92tree]

gpg --list-secret-keys --keyid-format LONG

I followed your step.
but aways got this "GPG key is invalid or missing, you must provide "config.gpgSigningKey""

what my gpgSigningKey like:
`-----BEGIN PGP PUBLIC KEY BLOCK-----

data
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP PRIVATE KEY BLOCK-----

data
-----END PGP PRIVATE KEY BLOCK-----`

I'm not sure what wrong with it.

[wuyue92tree]

gpg --list-secret-keys --keyid-format LONG

I followed your step.
but aways got this "GPG key is invalid or missing, you must provide "config.gpgSigningKey""

what my gpgSigningKey like:
`-----BEGIN PGP PUBLIC KEY BLOCK-----

data
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP PRIVATE KEY BLOCK-----

data
-----END PGP PRIVATE KEY BLOCK-----`

I'm not sure what wrong with it.

It's worked!
I setup a password for private key. that's why always worng.

this is important!
` /**

• GPG key to use when signing APT and YUM releases
• Requires to be unlocked (no password) and have both the private and
• public key.
  */`

[SimonMARTIN87]

I fell into a quite frustrating trap...
The process for key verification relies on a small regex here, which expects gpg to output everything in plain english.

So be sure to set your LANG envvar to "en", otherwise the regex wont match, and the key verification will fail.

[jlamb1]

I had LANG set to en_US.UTF-8 and was failing, setting to 'en' helped. I also had to generate the gpg key as RSA following the above examples, not sure if that is necessary