Maniphest T8076

Kleopatra: Unable to completely delete key with secret subkeys and offline-primary key
Open, HighPublic
Actions

Assigned To
• werner
Authored By
• ikloecker
Feb 2 2026, 11:27 AM
Tags
Subscribers
• alexk
• ikloecker
pl13
• werner

Description

EDIT 2026-10-12: some word change to clarify that not only team keys are affected.

This bug was first reported at https://bugs.kde.org/show_bug.cgi?id=515372

Original title: Unable to completely delete incomplete team key

SUMMARY

After deleting an incomplete team key in Kleopatra (or an other key with offline primary) and then importing the public key of that (team) key, it will be found that the secret subkey of the (team) key is still present.

STEPS TO REPRODUCE this with a team key

  1. Create an OpenPGP key (hereinafter referred to as Key A) with the "Set up this key for shared usage in teams" option enabled.
  2. Save secret team key for Key A; whether the "Allow team members to sign with the team key" option is enabled or not has no effect.
  3. Export the public key of Key A.
  4. Delete Key A
  5. Import the secret team key A that was exported earlier (the one with the incomplete certificate).
  6. Delete secret team key A that was just imported.
  7. Import the public key of Key A.

OBSERVED RESULT

The imported key A contains its public key and a secret subkey.

EXPECTED RESULT

The imported key A contains only the public key, not the secret subkey.

SOFTWARE/OS VERSIONS

Kleopatra: Gpg4win-5.0.1
Kleopatra: 76f98d94d858d18edd22b8d26aad565b1f71671f
GnuPG: 2.5.17
Libgcrypt: 1.11.2
KDE Frameworks: 6.20.0
Qt: Using 6.10.1 and built against 6.10.1
Windows 10 Version 21H2
Build ABI: x86_64-little_endian-llp64
Kernel: winnt 10.0.19044

ADDITIONAL INFORMATION

This might be a problem with the GPG core; it's reported that using GPG commands directly makes it impossible to delete incomplete team keys.

Details

Version
Gpg4win-5.0.1

Related Objects

Event Timeline

• ikloecker created this task.Feb 2 2026, 11:27 AM
• ikloecker added a comment.Feb 2 2026, 11:39 AM

This is actually a (known) bug in gpg, i.e. gpg --delete-secret-and-public-key PRIMARY_KEY_FPR only deletes the public key for keys without primary secret key.

A possible workaround seems to be to call gpg --delete-secret-and-public-key 'SUBKEY_FPR!' for each secret subkey followed by a gpg --delete-key PRIMARY_KEY_FPR to get rid of the key including all its secret subkeys.

• ikloecker renamed this task from Kleopatra: Unable to completely delete incomplete team key to Kleopatra: Unable to completely delete key with secret subkeys and "offline" primary key.Feb 2 2026, 11:49 AM
• ikloecker updated the task description. (Show Details)
• ebo added a project: gpd5x.Feb 2 2026, 11:53 AM
• werner triaged this task as Normal priority.Feb 2 2026, 12:08 PM
• werner added a project: gnupg26.
• ebo mentioned this in T8098: Kleopatra: Omit question about own key when importing a secret team key.Mar 3 2026, 4:39 PM
• werner added a subscriber: • werner.Mar 10 2026, 5:21 PM

If you specify a primary key the primary key shall be deleted. If there is only an offline or token based primary it can't be deleted. This is what the user requested. We can't change this because otherwise subkeys might be unintentionally deleted.

• werner renamed this task from Kleopatra: Unable to completely delete key with secret subkeys and "offline" primary key to Kleopatra: Unable to completely delete key with secret subkeys and offline-primary key.Mar 10 2026, 5:24 PM

What is an "incomplete team key" - a standard offline secret key (i.e. one with only secret subkeys)?

• ikloecker added a comment.Mar 10 2026, 5:55 PM
In T8076#215372, @werner wrote:

If you specify a primary key the primary key shall be deleted. If there is only an offline or token based primary it can't be deleted. This is what the user requested. We can't change this because otherwise subkeys might be unintentionally deleted.

gpg --delete-secret-and-public-key PRIMARY_KEY_FPR deletes the public key and just leaves the secret key data of the subkeys in the private-keys-v1.d/, i.e. for the user it looks like everything has been purged, in particular, the secret key data.

I would agree with "If you specify a primary key the primary key shall be deleted." if I had called gpg --delete-secret-keys PRIMARY_KEY_FPR! (note the trailing !). As far as I can tell the usual rule is PRIMARY_KEY_FPR means the whole key while KEY_FPR! means exactly the specified (sub)key.

• ebo mentioned this in Unknown Object (Phriction Wiki Document).Mar 11 2026, 10:05 AM
• alexk added a subscriber: • alexk.Mar 11 2026, 10:29 AM
pl13 added a subscriber: pl13.Mar 11 2026, 5:16 PM
• werner claimed this task.Mar 27 2026, 11:06 AM
• werner raised the priority of this task from Normal to High.
• ebo updated the task description. (Show Details)Mon, Oct 12, 1:53 PM
• ebo updated the task description. (Show Details)