Re: Keys using SHA-1 in the kernel keyring

On Fri, Feb 07, 2025 at 06:09:40PM +0100, Uwe Kleine-König wrote:
> Fixing is as easy as:
> 
>        sq key export --cert DE0E66E32F1FDD0902666B96E63EDCA9329DD07E |
>                 sq cert lint --fix --cert-file=- |
>                 sq cert import

For the record, it's not easy if your keys aren't all in ~/.gnupg. For
example, I have just subkeys in ~/.gnupg, and my C key is on detachable
storage that I mount only when I really need it. Unfortunately, `sq` ignores
$GNUPGHOME, and passing `--keyring /mnt/keys/gnupg` doesn't appear to do the
right thing.

I've poked at it for a bit, but as I'm unable to make it work, I'm backing off
for now. I'll start conversation on the gnupg list about ways to do the same
fixes as `sq` does to rebind UIDs and subkeys with a stronger hash, but I'm
not sure doing it with a combination of sq and gnupg is going to do the right
thing.

-K