GPG: How to clean/refresh the cache involved with the "pubring.kbx" file?

General Linux Question
1

Hello Friends

About GPG and for the kbxutil command in the following page:

Has the following part

To see statistics on the keybox in question, run it using

‘kbxutil --stats ~/.gnupg/pubring.kbx’

and you get an output like:

Total number of blobs:       99
               header:        1
                empty:        0
              openpgp:        0
                 x509:       98
          non flagged:       81
       secret flagged:        0
    ephemeral flagged:       17

With its respective explanation as follows (an extract):

In this example you see that the keybox does not have any OpenPGP keys but contains 98 X.509 certificates and a total of 17 keys or certificates are flagged as ephemeral, meaning that they are only temporary stored (cached) in the keybox and won’t get listed using the usual commands provided by gpgsm or gpg …

Read pls carefully the italic part

When a public key and its secret keys are deleted through the following command:

  • gpg --delete-secret-and-public-key myemail@gmail.com

I had the situation about the public key:

  1. It does not appear anymore when the gpg --list-public-keys command is executed

It is Ok and expected

  1. It would appear in the pubring.kbx file yet

It is not expected.

Once deleted a public key is expected that immediately it does not appear in the pubring.kbx file

Observation

I confirmed (2 to 3 times) that the deleted public key that appears in the pubring.kbx file yet: after of some time does not appear anymore in the file. Therefore I am assuming it is due the mentioned cache.

Question

  • How to clean/refresh the cache involved with the pubring.kbx file?

Some command to execute?

Extra Questions

  • What is the reason of this cache?
  • Why keep for a time a deleted public key in the pubring.kbx file yet?
  • Is possible get and set a specific time for the cache?

Thank You

1 Like
2

I found GPG so obtuse and esoteric and unforgiving - I gave up and started using “age” instead… Highly recommended…

I used “age” as my scripted password manager (I used “kpcli” for workstuff - it works okay with Keepass 1 databases [it’s borked on Keepass 2 db’s though]).

3 Likes
3

Thanks for the reply Dan

Interesting your approach. It is going to be considered to my “todo” list.

Thank You

1 Like