Hi,

Now that keyservers are not so useful any more, it's probably a good
plan to directly publish public keys in the various places where we
list key IDs / fingerprints etc.:

 * DAM in /intro/organization
 * CD signing keys in /CD/verify
 * Security team in /security/faq (currently links to a keyserver)
 * (maybe others?)

Maybe we could/should link to direct lookups on keyring.d.o if that's
possible, or use WKD somehow (hand-wave)?

The HKPS URL could be used for this:

https://keyring.debian.org/pks/lookup?op=get&search=0x10460DAD76165AD81FBC0CE9988021A964E6EA7D
https://tools.ietf.org/html/draft-shaw-openpgp-hkp-00#section-3.4

AFAICT the WKD stuff doesn't have lookups based on key fingerprint.

Probably also listing commands to download the keys would be good:

gpg --verbose --recv-keys --keyserver hkps://keyring.debian.org '1046
0DAD 7616 5AD8 1FBC  0CE9 9880 21A9 64E6 EA7D'

Thanks for the information Paul.

I was looking for the Aron Xu key.
After reading https://keyring.debian.org/ :
" Fetch a key
     Once you know the key's ID, just ask the server for it:

     $ gpg --keyserver hkps://keyring.debian.org:443 --recv-keys 0x2404C9546E145360

     Debian keys may also be retrieved by using the form at db.debian.org or:

         finger user@db.debian.org
"

So I did:

$ finger aron.@db.debian.org
[db.debian.org]
Trying 2a02:16a8:dc41:100::13a...
uid=aron,ou=users,dc=debian,dc=org
First name: Aron
Last name: Xu
Email: Aron Xu <aron@debian.org>
IRC nickname: happyaron
Fingerprint: 3A9E 7D14 9697 510A 3E37 CD95 C38E 8160 A178 41FE
Key block: finger aron/key@db.debian.org

Then I did:

$ finger aron/key@db.debian.org
[db.debian.org]
Trying 2a02:16a8:dc41:100::13a...
uid=aron,ou=users,dc=debian,dc=org
Key block:
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBEyqGUQBEACnzqGcVJiFPMmoMCtLGXD8sNDzMdNujLPhWTueqJMTcHhvW5Ym
oLvnHnPsRC7tTfQaxL9V5L9PeYJLM3QWzCVqEC1uMKwizmqaSRjQUIHOSPj45pV8
[...]
AsLzjLT4A8tyPGn24FFOrP8w1oY7kqr8A1upPnoVs1QVT1p/fHsBI7OaMMM9LEHc
N+KSkXARMQ

  Output truncated at 100000 bytes...


The key is too long and can't be fetched using finger :-(

I was able to get the key using the web site: https://keyring.debian.org/pks/lookup?op=get&search=0xF8643574713C9BAE
The output is 240 kB so much more than the limit (on the server side?) of 100 kB used by finger.

I don't know if Debian should update the documentation on https://keyring.debian.org/ or remove the limit on finger, or both?

Bye

Le 16/09/2026 à 15:53, Ludovic Rousseau a écrit :
[...]> Then I did:

Oops.
I discover that is a problem with finger(1) I use on macOS.
I tried again on Debian stable and I can get the full key using finger.

Sorry for the noise.