gpg2 appears to be unable to generate a revocation certificate for a secret key
when the secret key is specified by fingerprint.
Instead, it produces an infinite stream of output to its log. The output begins
like this:
gpg: '0x762421547769C18A83EA34F4D563B7FE19E7DB0C' matches multiple secret keys:
gpg: sec rsa2048/19E7DB0C 2015-12-12 alice <alice@example.org>
gpg: sec rsa2048/19E7DB0C 2015-12-12 alice <alice@example.org>
and the final line repeats forever until the process is killed.
This appears to be due to a loop in gen_revoke in g10/revoke.c, perhaps due to
keydb_search continuing to return the same result when searching by full
fingerprint.
This does not appear to be a problem with gpg 1.4.x
I think the following patch should work around the problem, but i doubt it's a
complete fix.
- a/g10/revoke.c
+++ b/g10/revoke.c
@@ -640,7 +640,8 @@ gen_revoke (const char *uname)
} rc = keydb_search (kdbhd, &desc, 1, NULL);
- if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
+ if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND
+ || desc.mode == KEYDB_SEARCH_MODE_FPR20)
/* Not ambiguous. */
{
}