Search code examples
mavenmaven-2maven-3pgpopenpgp

How to deal with a lost OpenPGP signature key?


My laptop crashed and I cannot uncover the files including my OpenPGP signature key, and I can no longer deploy to the central Maven repository.

The question is can I generate an new key pair and distribute the public key to key server like hkp://pool.sks-keyservers.net? How to revoke my previous public key?


Solution

  • How to revoke my previous public key?

    Never lose access to your private key. If you have not generated a revocation certificate in advance, you cannot even revoke your key. You haven't even got a chance to remove the key from the key server network.

    With other words: you can't do anything about the key you lost, unless in some time in future it is possible to brute-force the key (or crack it using other methods).

    The question is can I generate an new key pair and distribute the public key to key server like hkp://pool.sks-keyservers.net?

    For a new key, you'll have to start publishing it again of course (using the SKS pool is a good choice and will make sure the key spreads throughout the key server network quickly). With a new key, you'll lose all certifications, of course. You might have to register the key somewhere in the Maven repository again.

    At the same time, pre-generate a revocation certificate and put it in some safe place to be sure if some disaster happens again. And make sure to have some reasonable, automated and verified backup before you start doing anything on your computer.