68

I did a clean install of Arch Linux and imported my backed up gpg private key. As a sanity check I ran:

gpg --list-keys

Everything showed up as normal except for the uid which now reads:

uid [ unknown ] User < [email protected] >

When I first created this key before the clean install it read:

uid [ ultimate ] User < [email protected] >

Why would it change from [ ultimate ] to [ unknown ]after importing it onto a clean install?

Improve this question

1 Answer 1

Reset to default
87

GNUPG has a trust database stored at ~/.gnupg/trustdb.gpg

You can backup this trust database using the --export-ownertrust option:

gpg --export-ownertrust > file.txt

If you exported your secret keys and import them later into a new environment, the trust database is no longer present.

However, this is easily remedied:

gpg --edit-key [email protected]

gpg> trust

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 5

And don't forget to save the changes:

gpg> save

Read about trust levels and values. E.g. unknown Nothing is known about the owner's judgement in key signing. Keys on your public keyring that you do not own initially have this trust level.

Improve this answer
4
  • I keep getting ` gpg: can't do this in batch mode `
    – Tim Siwula
    Commented May 31, 2018 at 3:42
  • 7
    Minor note: it seems that save is not necessary, giving 'Key not changed so no update needed.'
    – David Oliver
    Commented May 12, 2020 at 13:38
  • 1
    I'm finding save is still very necessary. Without it I've been wondering why the ruddy hell my scripts to encrypt backups kept rejecting an encryption subkey. Time very wasted on my part!
    – Adambean
    Commented Oct 21, 2022 at 16:43
  • 1
    If it doesn't seem to work with gpg --edit-key [email protected] (still says [unknown] when viewing gpg --list-secret-keys), try doing gpg --edit-key followed by the hex key, Ex. 0123456789ABCDEF0123456789ABCDEF01234567. You also might have to restart gpg for changes to show: Please note that the shown key validity is not necessarily correct unless you restart the program.
    – Matt Popovich
    Commented Nov 21, 2022 at 3:04

You must log in to answer this question.