Verifying your key/identity on Keybase.io with Qubes and Split GPG

You are using Qubes with Split-GPG, but you want to verify your GPG key at Keybase.io, via the command-line with bash and curl (you're not storing the key on Keybase's servers).

The verification command is a curl request but includes calls to the gpg command-line client. You have two problems:

1) Your GPG VM is not connected to the network (for good reason)
2) Another VM that is connected to the network, can't use the gpg command.

Fortunately, everything Just Works if you replace the gpg command with Qubes' qubes-gpg-client-wrapper command. Make sure you are exporting the QUBES_GPG_DOMAIN variable too if you aren't already.

And, obviously, this action depends on you allowing the VM that can do 'curl' requests, to also (briefly) access your GPG VM.

The command given by Keybase looks like this:

curl \
   --data-urlencode sig="`\
   echo '{"
body":{"key":{"eldest_kid":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","fingerprint":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","full_hash":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","host":"keybase.io","key_id":"eeaXXXXXXXXXXXX","kid":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","uid":"XXXXXXXXXXXXXXXXXXXXXXXXXXXX","username":"mig5"},"type":"eldest","version":1},"ctime":1460417432,"expire_in":157680000,"prev":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","seqno":21,"tag":"signature"}' | \
   gpg -u 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' -a --sign`"
\
   --data-urlencode type="eldest" \
   --data-urlencode session="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
   --data-urlencode csrf_token="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
   --data-urlencode plain_out="1" \
   --data-urlencode signing_kid="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
   --data-urlencode public_key="-----BEGIN PGP PUBLIC KEY BLOCK-----
 Version: GnuPG v1
 
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 -----END PGP PUBLIC KEY BLOCK-----"
\
   --data-urlencode is_primary="true" \
   --data-urlencode sig_required="true" \
   <a href="https://keybase.io/_/api/1.0/key/add.json

">https://keybase.io/_/api/1.0/key/add.json
[/geshifilter-code]

All you have to is change this line:

    gpg -u 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' -a --sign`" \

to this:

    QUBES_GPG_DOMAIN=gpg-vm qubes-gpg-client-wrapper -u 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' -a --sign`" \

Works!

Tags: