maxtaco
commented
8 years ago Oh man, what a cluster. Which client version were you using when you switched to the client? For non-experts, it is simpler for the local client to export out of GPG's keychain into its own keychain so that way the client can use Go libraries to decrypt and sign. Shelling out is really painful for n reasons, and for more casual users, we were hoping to get away with one shell-out (the initial export).
However, we realize experts like yourself would find such a solution unsatisfactory, so the most recent Go clients use a one-time shell-out to GPG to produce a signature to provisioning the account. After which, we don't have access to the secret key for decrypting and signing, as you can imagine.
morrildl
oconnor663
RichJeanes
I signed up today with a new account, 'morrildl'. I started, but did not complete, the 'add a PGP key' flow in the browser. Specifically, when I got to the step where it offers to let you use the keybase binary, I switched to that flow, since it seemed cleaner/safer than the curl approach.
Because it was the first client and I was looking to add my GPG key, I couldn't use GPG to authenticate, so I used account passphrase. When I tried to add a key via 'keybase pgp select', it failed because I use a yubikey and thus the binary couldn't export my private key(!) for whatever nefarious machinations it wants it for.
So I returned to the web UI, to add my key that way via the curl method, after all. However, the site refuses to let you do this if you have extant clients, including a paper key client. So I went into account settings and deleted them all; this caused the "add a PGP key" link to reappear, so I went back into the curl-based flow.
However, the curl method returns error 908 (also known as issue #982): Code: 908 Name: KEY_NEED_REVOKE Description: You need to delete your active key before uploading a new one
Note again that as of this writing I have never successfully added a key.
Because at this point it was clear that everything was broken, for the lulz I went through the "generate a key for me" flow in the web UI, twice. Neither attempt actually attached a key to my account.
At this point: 1) I can not create new clients, because I had already used passphrase login once, had deleted the paper key client to regain access to web key add UI, and did not have a PGP key added to authenticate directly. 2) I can not add a PGP key, by any means. 3) The web UI tells me I have no key attached. 4) The API tells me (via both curl and 'keybase login') that I need to delete the "active" key before it will let me upload one or create a client.
I next did the "recover passphrase" flow, hoping the reset would fix the above. It did not; I am still in that state. (For instance, 'keybase login' with account passphrase says "ERROR Passphrase provision is not possible since you have at least one provisioned device or pgp key already")
There are of course multiple bugs here: