Idiomdrottning’s homepage


I know that for Proton Mail users, you can just gpg --locate-keys their address and you’ll get their keys.

I wanted to set up something similar for my own email and it was a headache and a half. This is more of a li’l diary entry and causerie than reliable and complete documentation.

mkdir -p /tmp/lets-do-this/.well-known/openpgpkey
cd /tmp/lets-do-this
sudo apt install gpg-wks-client # Or whatever non-Debian people do

Then, you’re supposed to do this:

gpg --list-options show-only-fpr-mbox -k|/usr/lib/gnupg/gpg-wks-client -C .well-known/openpgpkey -v --install-key

but I have plenty of unused keys in my ring so I checked the first part of that, saw that the first was the one I wanted (matching fingerprints). First one means head -1, ninth would be sed -n 9p, and last would be tail -1.

So since in my case I’m grabbing the first:

gpg --list-options show-only-fpr-mbox -k|head -1|/usr/lib/gnupg/gpg-wks-client -C .well-known/openpgpkey -v --install-key

Now, that’s not any good because it uses the “advanced” method. According to the RFC, that method is for multi-domain setups, but I have nginx so we can already dispatch on a domain level right in the web server, and for now I just wanted my Idiomdrottning domain. I want the direct method so I don’t have to futz around with registering a new hostname. At least for now.

This means manually having to:

cd .well-known/openpgpkey/
mv* .

Create an index.html file in the hu directory to disable dirlisting (not that there’s anything else in there).


cd /tmp/lets-do-this
chmod -r 755 .well-known

and rsync it up to the server.

I didn’t get it working at first, because I had made two fatal mistakes.

One was pretty specific to my wonky setup: I already had the .well-known path reverse-proxied for some other stuff I’ve got going on. I had to edit nginx stuff to make that a li’l more fine grained. That was on me, I had a non-default setup.

The other was that the hu directory wasn’t executable by the www-data user. Readable is not enough when it comes to directories.

I could troubleshoot both of these issues with

wget -qO- ""|less

(Where that frhc9h9dc9cq8ffnxt… stuff is my own name, sandra.snan, encoded (SHA-1 hash in Z-Base-32). To find your own, look in that hu directory you generated.)

Anyway, now

gpg --locate-keys

finally works.

I’m not doing the whole proofs.json thing from Replacing Keybase, I’m only using a static WKD as per the GnuPG wiki.