Today (27/1) I ran aide (=tripwire) on my machine and noticed noticed a new file:
~/.gnupg/pubring.kbx
which is dated 25 Jan. I last ran aide 25/1 (early) and the only thing updated since then is syncthing.
I noticed that you are using pgp keys for the update server. (however as I am updating syncthing from the repository not via the syncthing program, I have never installed the syncthing update keys in ~/.gnupg/pubring.gpg
(this machine is running Kubuntu 14.04) Q1 I don’t use pgp keys for anything else, so can I confirm that this new file ~/.gnupg/pubring.kbx was put there by the update from syncthing 0.14.20 to 0.14.21?
Q2 Also, (assuming the answer to Q1 is yes) my version of gnupgp is 1.14.16 and I think the .kbx file format only works with v2 and above. Not a problem for me (because I use the repos) but could this be a problem for people anyone else?