0

How can I export only those non-expired public keys from my gpg keyring?

If I export all of the public keys in my keyring, the ascii armored output file is several megabytes large, and it contains a lot of unusable keys that expired years (or decades) ago.

I want to export only a subset of the public keys in my keyring -- just those that haven't yet expired.

How can I export only these non-expired keys from gpg?

1 Answer 1

0

The following command will export only non-expired keys from your gpg keyring

gpg -a --export --export-filter keep-uid="expired=no" > pubkeys.asc 

For more info, see the --export-filter section of the man gpg page.

--import-filter {name=expr}
--export-filter {name=expr}

These options define an import/export filter which are applied to the imported/exported keyblock right before it will be stored/written. name defines the type of filter to use, expr the expression to evaluate. The option can be used several times which then appends more expression to the same name. The available filter types are:

  • keep-uid
    This filter will keep a user id packet and its dependent packets in the keyblock if the expression evaluates to true.
  • drop-subkey
    This filter drops the selected subkeys. Currently only implemented for --export-filter.
  • drop-sig
    This filter drops the selected key signatures on user ids. Self-signatures are not considered. Currently only implemented for --import-filter.
    select This filter is only implemented by --list-filter. All property names may be used.

For the syntax of the expression see the chapter "FILTER EXPRESSIONS". The property names for the expressions depend on the actual filter type and are indicated in the following table. Note that all property names may also be used by --list-filter. Property names may be prefix with a scope delimited by a slash. Valid scopes are "pub" for public and secret primary keys, "sub" for public and secret subkeys, "uid" for for user-ID packets, and "sig" for signature packets. Invalid scopes are currently ignored. The available properties are:

  • uid
    A string with the user id. (keep-uid)
  • mbox
    The addr-spec part of a user id with mailbox or the empty string. (keep-uid)
  • algostr
    A string with the key algorithm description. For example "rsa3072" or "ed25519".
  • key_algo
    A number with the public key algorithm of a key or subkey packet. (drop-subkey)
  • key_size
    A number with the effective key size of a key or subkey packet. (drop-subkey)
  • key_created
    key_created_d
    The first is the timestamp a public key or subkey packet was created. The second is the same but given as an ISO string, e.g. "2016-08-17". (drop-subkey)
  • key_expires
    key_expires_d
    The expiration time of a public key or subkey or 0 if it does not expire. The second is the same but given as an ISO date string or an empty string e.g. "2038-01-19".
  • fpr
    The hexified fingerprint of the current subkey or primary key. (drop-subkey)
  • primary
    Boolean indicating whether the user id is the primary one. (keep-uid)
  • expired
    Boolean indicating whether a user id (keep-uid), a key (drop-subkey), or a signature (drop-sig) expired.
  • revoked
    Boolean indicating whether a user id (keep-uid) or a key (drop-subkey) has been revoked.
  • disabled
    Boolean indicating whether a primary key is disabled.
  • secret
    Boolean indicating whether a key or subkey is a secret one. (drop-subkey)
  • usage
    A string indicating the usage flags for the subkey, from the sequence ecsa?. For example, a subkey capable of just signing and authentication would be an exact match for sa. (drop-subkey)
  • sig_created
    sig_created_d
    The first is the timestamp a signature packet was created. The second is the same but given as an ISO date string, e.g. "2016-08-17". (drop-sig)
  • sig_expires
    sig_expires_d
    The expiration time of a signature packet or 0 if it does not expire. The second is the same but given as an ISO date string or an empty string e.g. "2038-01-19".
  • sig_algo
    A number with the public key algorithm of a signature packet. (drop-sig)
  • sig_digest_algo
    A number with the digest algorithm of a signature packet. (drop-sig)
  • origin
    A string with the key origin or a question mark. For example the string ``wkd'' is used if a key originated from a Web Key Directory lookup.
  • lastupd
    The timestamp the key was last updated from a keyserver or the Web Key Directory.
  • url
    A string with the the URL associated wit the last key lookup.

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.