I like to put the contents of /etc inside git, so I can see what auto-updates change, and when something breaks, so I can go back and find out what I changed since it last worked.

At the moment I'm being told:

modified:   trusted.gpg
modified:   trusted.gpg~

git diff is no use as these are binary files. Of course I could check them in, but these files are central to package security, so doing that would make mockery of my attempts at being secure! So, how do I find out what has changed?

As root I've tried:

cd /etc/apt
gpg -k trusted.gpg

(also tried --list-keys, --list-public-keys). It says gpg: error reading key: public key not found.

I'm sure it must just be a matter of discovering the correct parameters to give to gpg?


$ apt-key list

From the docs on secure apt:

apt-key is a program that is used to manage a keyring of gpg keys for secure apt. The keyring is kept in the file /etc/apt/trusted.gpg (not to be confused with the related but not very interesting /etc/apt/trustdb.gpg). apt-key can be used to show the keys in the keyring, and to add or remove a key.

  • 3
    Wonderful, thank-you. Then to see the differences I did diff <(apt-key --keyring /etc/apt/trusted.gpg list) <(apt-key --keyring /etc/apt/trusted.gpg~ list) (NB. full paths are essential for the --keyring parameter) P.S. actually I used meld not diff, of course ;-) meld clearly showed me that Opera has added a second key on July 3rd 2013. – Darren Cook Jul 11 '13 at 1:34

I came across this question while I too was trying to figure out how to get information on a public key file using GnuPG. In addition to the commands Darren tried, I also tried --fingerprint but got the same gpg: error reading key: public key not found error message.

After discovering the answer, I thought I’d complement Andrew's answer with a more general way of printing information about any public key file:

$ gpg --with-fingerprint /etc/apt/trusted.gpg

pub  1024D/437D05B5 2004-09-12 Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>
      Key fingerprint = 6302 39CC 130E 1A7F D81A  27B1 4097 6EAF 437D 05B5
sub  2048g/79164387 2004-09-12
pub  4096R/C0B21F32 2012-05-11 Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>
      Key fingerprint = 790B C727 7767 219C 42C8  6F93 3B4F E6AC C0B2 1F32
pub  4096R/EFE21092 2012-05-11 Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>
      Key fingerprint = 8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092
pub  1024D/FBB75451 2004-12-30 Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>
      Key fingerprint = C598 6B4F 1257 FFA8 6632  CBA7 4618 1433 FBB7 5451

As can be seen, the above lists the same information as the output of apt-key list – though the formatting of apt-key is much more readable.

The gpg man page only states that the --with-fingerprint option should be the “Same as the command --fingerprint” but (with GnuPG 1.4.20), it also lists fingerprints when a filename is supplied instead of a key ID. As the above example shows, this option can also be used to print the fingerprints of a public ring containing multiple keys.


If you are using gpg -k --keyring <file> make sure that you specify the file path otherwise gpg will assume <file> is located in ~/.gnupg/ even if it exists in the current directory!

The following won't work as expected:

cd /etc/apt
gpg -k --no-default-keyring --keyring trusted.gpg


cd /etc/apt
gpg -k --no-default-keyring --keyring ./trusted.gpg

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.