{"id":16508839,"url":"https://github.com/goerz/gpg-serve-key","last_synced_at":"2025-03-21T08:31:18.380Z","repository":{"id":66953567,"uuid":"105802568","full_name":"goerz/gpg-serve-key","owner":"goerz","description":"Serve a public/private GPG key over https","archived":false,"fork":false,"pushed_at":"2023-11-11T17:04:22.000Z","size":10,"stargazers_count":36,"open_issues_count":1,"forks_count":1,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-01T04:24:03.070Z","etag":null,"topics":["gpg"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/goerz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2017-10-04T18:20:49.000Z","updated_at":"2024-08-06T07:37:42.000Z","dependencies_parsed_at":"2023-05-15T19:15:14.745Z","dependency_job_id":null,"html_url":"https://github.com/goerz/gpg-serve-key","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/goerz%2Fgpg-serve-key","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/goerz%2Fgpg-serve-key/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/goerz%2Fgpg-serve-key/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/goerz%2Fgpg-serve-key/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/goerz","download_url":"https://codeload.github.com/goerz/gpg-serve-key/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244122704,"owners_count":20401473,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gpg"],"created_at":"2024-10-11T15:48:05.237Z","updated_at":"2025-03-21T08:31:17.945Z","avatar_url":"https://github.com/goerz.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# gpg-serve-key\n\nThis script allows to transfer a public/private GPG key from a server to\nanother device where communication is only possible over `https`. Note that\nin general this should not be a first choice. For example, if you have `ssh`\naccess, a better way to transfer a key would be\n\n    ssh user@remote gpg2 --export-secret-key KEYID | gpg2 --import\n\nHowever, transfer over `https` is usually a better choice than e.g. emailing an\nexported secret-key file to yourself. The one particular use case motivating\nthis script was the import of a secret key into the [Pass iOS app][1].\n\nWhile transfer over `https` in principle makes it accessible to anyone, the\nscript takes strong measures to protect the key:\n\n*   They key is directly read through a pipe from the `gpg` executable. The\n    secret key is never written to disk\n\n*   The server encrypts the communication with SSL (that is, using the `https`\n    protocol) by default. While this creates the additional overhead of\n    requiring valid SSL certificates for the public hostname under which the\n    server will be reached, it is essential to guarantee that the key cannot be\n    sniffed in transit. For use within a trusted network, the encryption can be\n    disabled, although you are strongly discouraged from doing so.\n\n*   The key is exposed at a url that contains a random token and using a random\n    port number (by default), e.g. for the KEYID 57A6CAA6\n\n        https://michaelgoerz.net:47409/v1f4Y7XixMQ/57A6CAA6-secret.key\n\n*   Brute-forcing the token is prevented through rate limiting, that is, by an\n    exponentially increasing delay after an invalid request\n\n*   The server responds with HTTP headers that disable caching by the client.\n\n*   The server writes log messages about every served request. This allows to\n    monitor for unexpected access and to detect if the key has been compromised\n    (as a last resort)\n\nThrough the `--serve-file` option, files in addition to the GPG key may be\nserved (e.g. a private SSH key)\n\n\n## Requirements ##\n\n*  Python \u003e= 3.5\n*  [click package][2]\n*  A server that is accessible through a public hostname, with GPG installed\n   and the private key for the KEYID that is to be exported in its keychain.\n   Check available private keys with `gpg2 -K`.\n*  SSL certificates for the public hostname. It is recommended to use\n   [Let's Encrypt][3]. You may use an existing certificate for a webserver\n   running on the host. Since `gpg-serve-key` will run on a non-standard port,\n   it will not be necessary to temporarily suspend the web server.\n\n\n## Usage ##\n\nRun the script directly as e.g.\n\n    ./gpg-serve-key \\\n        --cert-file=/etc/letsencrypt/live/michaelgoerz.net/cert.pem \\\n        --key-file=/etc/letsencrypt/live/michaelgoerz.net/privkey.pem \\\n        --host=michaelgoerz.net 57A6CAA6\n\nSee `./gpg-serve-key --help` for more details. You may use either the short\n8-digit key KEYID, or the full length KEYID as shown by `gpg -K`.\n\nThe command will start a temporary webserver at a random port and serve both\nthe public and the private key at URLs such as\n\n    https://michaelgoerz.net:47409/v1f4Y7XixMQ/57A6CAA6-public.key\n    https://michaelgoerz.net:47409/v1f4Y7XixMQ/57A6CAA6-secret.key\n\nIf using a Cloudflare proxy for the domain, it must be temporarily disabled.\nMake sure any firewall running on the server is set up allow access to the\nport. On Ubuntu, to allow access to, e.g., port `47409`, run\n\n    sudo ufw allow 47409\n\nAfter importing the keys from the above URLs, stop the server by hitting\n`ctrl+c`.\n\nIf applicable, remove the firewall rule (`sudo ufw delete allow 47409`), and\nre-enable the Cloudflare proxy.\n\n[1]: https://mssun.github.io/passforios/\n[2]: http://click.pocoo.org/5/\n[3]: https://letsencrypt.org\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoerz%2Fgpg-serve-key","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgoerz%2Fgpg-serve-key","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoerz%2Fgpg-serve-key/lists"}