How to verify gnupg signature with python gnupg module?

Question

I have a problem with a verification signature with the Python gnupg module. With this module, I can encrypt and sign the file:

 gpg.encrypt_file(stream, encrypt_for, sign=sign_by, passphrase=key_passwd, output=file_out) 

Such an encrypted file can be decrypted using the gpg command line, output:

 gpg: encrypted with 2048-bit ELG-E key, ID 518CD1AD, created 2011-04-14 "client" gpg: Signature made 04/14/11 13:36:14 using DSA key ID C7C006DD gpg: Good signature from "server" 

It can also be decrypted by the Python gnupg module, the output file has decrypted content, but I cannot verify the signature. Code that decodes and verifies:

 def decrypt_file(file_in, file_out, key_passwd): gpg = gnupg.GPG() f = open(file_in, "rb") data = f.read() f.close() gpg.decrypt(data, passphrase=key_passwd, output=file_out) verified = gpg.verify(data) if not verified: raise ValueError("Signature could not be verified!") 

The exception I received:

 decrypting file... Exception in thread Thread-12: Traceback (most recent call last): File "c:\Python26\lib\threading.py", line 534, in __bootstrap_inner self.run() File "c:\Python26\lib\threading.py", line 486, in run self.__target(*self.__args, **self.__kwargs) File "c:\Python26\lib\site-packages\gnupg.py", line 202, in _read_response result.handle_status(keyword, value) File "c:\Python26\lib\site-packages\gnupg.py", line 731, in handle_status raise ValueError("Unknown status message: %r" % key) ValueError: Unknown status message: u'UNEXPECTED' Traceback (most recent call last): File "ht_gnupg.py", line 32, in <module> test() File "ht_gnupg.py", line 27, in test decrypt_file('test_p.enc', 'test_p.txt', 'client') File "ht_gnupg.py", line 18, in decrypt_file raise ValueError("Signature could not be verified!") ValueError: Signature could not be verified! 

I am using gnupg-0.2.7 from python-gnupg-0.2.7.win32.exe using ActiveStatus Python 2.6.

I also tried gpg.verify_file() , but I got the same error. The ASCII file is armored and looks like this:

 -----BEGIN PGP MESSAGE----- Version: GnuPG v1.4.9 (MingW32) hQIOA0EAndRRjNGtEAf/YxMQaFMnBwT3Per6ypoMYaO1AKQikRgJJMJ90a/EoZ44 ... =G6Ai -----END PGP MESSAGE----- 

How to check signature, for example, gpg command line?

Answer 1

See this example for an example script showing you how to verify signatures when decrypting.

The code (as of 2011-04-05) follows:

 from cStringIO import StringIO import gnupg import logging import os import shutil def generate_key(gpg, first_name, last_name, domain, passphrase=None): "Generate a key" params = { 'Key-Type': 'DSA', 'Key-Length': 1024, 'Subkey-Type': 'ELG-E', 'Subkey-Length': 2048, 'Name-Comment': 'A test user', 'Expire-Date': 0, } params['Name-Real'] = '%s %s' % (first_name, last_name) params['Name-Email'] = ("%s.% s@ %s" % (first_name, last_name, domain)).lower() if passphrase is None: passphrase = ("%s%s" % (first_name[0], last_name)).lower() params['Passphrase'] = passphrase cmd = gpg.gen_key_input(**params) return gpg.gen_key(cmd) def init_logging(): logging.basicConfig(level=logging.DEBUG, filename="gpg.log", filemode="w", format="%(asctime)s %(levelname)-5s %(name)-10s %(threadName)-10s %(message)s") def print_info(decrypted): print('User name: %s' % decrypted.username) print('Key id: %s' % decrypted.key_id) print('Signature id: %s' % decrypted.signature_id) #print('Signature timestamp: %s' % decrypted.sig_timestamp) print('Fingerprint: %s' % decrypted.fingerprint) def main(): init_logging() if os.path.exists('keys'): shutil.rmtree('keys') gpg = gnupg.GPG(gnupghome='keys') key = generate_key(gpg, "Andrew", "Able", "alpha.com", passphrase="andy") andrew = key.fingerprint key = generate_key(gpg, "Barbara", "Brown", "beta.com") barbara = key.fingerprint #First - without signing data = 'Top secret' encrypted = gpg.encrypt_file(StringIO(data), barbara, #sign=andrew, passphrase='andy', output='encrypted.txt') assert encrypted.status == 'encryption ok' # Data is in encrypted.txt. Read it in and verify/decrypt it. data = open('encrypted.txt', 'r').read() decrypted = gpg.decrypt(data, passphrase='bbrown', output='decrypted.txt') print_info(decrypted) #Now with signing data = 'Top secret' encrypted = gpg.encrypt_file(StringIO(data), barbara, sign=andrew, passphrase='andy', output='encrypted.txt') assert encrypted.status == 'encryption ok' # Data is in encrypted.txt. Read it in and verify/decrypt it. data = open('encrypted.txt', 'r').read() decrypted = gpg.decrypt(data, passphrase='bbrown', output='decrypted.txt') print_info(decrypted) if __name__ == '__main__': main()