1. About

Hockeypuck is an OpenPGP keyserver.

2. Latest Release

The latest release of Hockeypuck is 2.4.

3. Features

3.1. OpenPGP Standards

Hockeypuck targets the HKP draft protocol specification. As this draft is a work in progress, Hockeypuck features may not exactly correspond to the current draft specification.

Public keys and certifications conforming to RFC 9580 and RFC 9980 are supported by the keyserver. This includes SLH-DSA pure PQC keys, and ML-KEM and ML-DSA composite PQC keys with ECC curves 25519 and 448. ML-KEM and ML-DSA with NIST and Brainpool curves as per draft-ietf-openpgp-nist-bp-comp are not yet supported.

v5 keys and certifications (GnuPG) are not currently supported due to several known interoperability problems.

Some v3 key material may be distributed if it uses strong algorithms. v3 binding signatures over v4 encryption subkeys are supported for backwards compatibility reasons. v3 support is deprecated and will be removed in a future release.

3.2. SKS Reconciliation Protocol

Hockeypuck can synchronize public key material with other Hockeypuck servers via the SKS protocol. Hockeypuck also supports PKS sync to non-SKS-compatible keyservers over email, HKP, and VKS, however it does not (yet) support receiving public keys by email.

3.3. Modular storage backend

Hockeypuck uses PostgreSQL ≥ 13 (tested up to v18) for storing public key material. The architecture allows for arbitrary storage backends, however only PostgreSQL is currently supported.

3.4. Flexible rendering

Hockeypuck internally represents key material with a JSON document model that can be used with web applications. HTML responses can be customized by authoring a template that operates on the document model.

4. Install

Several options are available:

• Install with Docker (RECOMMENDED)
• Build and Install from source

5. Next Steps

• Configuring a Hockeypuck server.
• Upgrading a Hockeypuck server.
• Remotely administering a Hockeypuck server.
• Populating Hockeypuck with keyfiles.
• Dumping Hockeypuck database contents to keyfiles.
• Contributing to Hockeypuck.
• Community support for Hockeypuck, for issues and new feature requests.

6. License

Copyright 2012-2025 Casey Marshall and the Hockeypuck contributors. Hockeypuck is distributed under the Affero GNU Public License, version 3.

In general, any use of Hockeypuck privately within an organization (including a company) is fine. Redistribution kicks in only when you publish services to other parties.

The AGPL license (and my intent in licensing it such) DOES NOT permit the following distribution scenarios:

• Distribute a closed-source application binary that builds with Hockeypuck AGPL packages. For example, a folder-syncing app that uses Conflux.
• Publishing a closed-source service that uses Hockeypuck in its deployment to other parties. The AGPL includes web API access as "distribution". For example, a PGP-based web service like keybase.io could be built with Hockeypuck, but it would be required to be open-source under the redistribution terms of the AGPL.

Contact me for licensing alternatives (or if you're still not quite sure).

Authors