o Xh.@sdZdZdZdZzddlmZWneyddlmZYnwddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlmZddlmZddlZddlZdZe jd krkz dd lmZmZmZWn eyjdZYnwzddlmZWneyGd d d e jZYnwz ed ZeZeZWneydZe Ze ZYnwe !e"Z#e#j$se#%ee j&j"dkrddZ'n e (dZ)ddZ'e*Z+ddZ,ddZ-ddZ.ddZ/ddZ0ddZ1d d!Z2Gd"d#d#e3Z4Gd$d%d%e3Z5e (d&e j6Z7d'd(d)d*d+d,d-Z8Gd.d/d/e3Z9d0d1Z:Gd2d3d3e;ZGd8d9d9e3Z?Gd:d;d;e4e?Z@Gdd?d?eAZBGd@dAdAe3ZCGdBdCdCe?ZDe (dDEdEe j6ZFe (dFe j6ZGGdGdHdHe3ZHdS)Iah A wrapper for the 'gpg' command:: Portions of this module are derived from A.M. Kuchling's well-designed GPG.py, using Richard Jones' updated version 1.3, which can be found in the pycrypto CVS repository on Sourceforge: http://pycrypto.cvs.sourceforge.net/viewvc/pycrypto/gpg/GPG.py This module is *not* forward-compatible with amk's; some of the old interface has changed. For instance, since I've added decrypt functionality, I elected to initialize with a 'gnupghome' argument instead of 'keyring', so that gpg can find both the public and secret keyrings. I've also altered some of the returned objects in order for the caller to not have to know as much about the internals of the result classes. While the rest of ISconf is released under the GPL, I am releasing this single file under the same terms that A.M. Kuchling used for pycrypto. Steve Traugott, stevegt@terraluna.org Thu Jun 23 21:27:20 PDT 2005 This version of the module has been modified from Steve Traugott's version (see http://trac.t7a.org/isconf/browser/trunk/lib/python/isconf/GPG.py) by Vinay Sajip to make use of the subprocess module (Steve's version uses os.fork() and so does not work on Windows). Renamed to gnupg.py to avoid confusion with the previous versions. Modifications Copyright (C) 2008-2018 Vinay Sajip. All rights reserved. A unittest harness (test_gnupg.py) has also been added. z0.4.3z Vinay Sajipz$13-Jun-2018 12:11:43$)StringION)Popen)PIPEnt) STARTUPINFOSTARTF_USESHOWWINDOWSW_HIDEc@seZdZddZdS) NullHandlercCdSN)selfrecordr r 7/var/www/html/env/lib/python3.10/site-packages/gnupg.pyhandleBzNullHandler.handleN)__name__ __module__ __qualname__rr r r rr As r FTntpathcCsd|S)Nz"%s"r sr r r shell_quoteVsrz[^\w%+,./:=@-]cCsLt|ts tdt||sd}|St|s|}|Sd|dd}|S)a Quote text so that it is safe for Posix command shells. For example, "*.py" would be converted to "'*.py'". If the text is considered safe it is returned unquoted. :param s: The value to quote :type s: str (or unicode on 2.x) :return: A safe version of the input, from the point of view of Posix command shells :rtype: The passed-in type zExpected string type, got %sz''z'%s''z'\'') isinstance string_types TypeErrortypeUNSAFEsearchreplace)rresultr r rr_s  cCsts t|tr |t}|Sr )_py3kr text_typeencode fsencodingrr r rno_quotes r&cCsd}ttjdr tjj}nd} z|d}Wnty'tjdddYn-w|s+n)|t|7}z| |WntyI| | |Yn t d Ynqz| Wnt yjtjd ddYnwtd |dS) NrencodingasciiTz Exception occurred while reading)exc_infozError sending dataz)Exception occurred while closing: ignoredzclosed output, %d bytes sent)hasattrsysstdinr'read UnicodeErrorloggerwarninglenwriter$ exceptioncloseIOErrordebug)instream outstreamsentencdatar r r _copy_datas8        r>cCs8tjt||fd}|dtd|||||S)NtargetargsTzdata copier: %r, %r, %r) threadingThreadr> setDaemonr1r8start)r9r:wrr r r_threaded_copy_datas  rGcCs*d|}||}||tddS)Nz%s zWrote passphrase)r$r4r1r8)stream passphraser'r r r_write_passphrases  rJcCst|ttttfSr )rlisttupleset frozenset)instancer r r _is_sequencerPcCs8z ddlm}||}W|Styt|}Y|Sw)Nr)BytesIO)iorR ImportErrorr)rrRrvr r r_make_memory_streams   rVcCs>trt|tr ||}t|St|tur||}t|Sr )r"rstrr$rrV)rr'r r r_make_binary_streams   rXc@sfeZdZdZdZdZdZdZdZeeeeedZ dd d d d Z d diZ ddZ ddZ e ZddZdS)Verifyz#Handle status messages for --verifyrr*)TRUST_UNDEFINED TRUST_NEVERTRUST_MARGINAL TRUST_FULLYTRUST_ULTIMATEzpermission deniedz file existszfile not foundznot a directory)r*#Qa zincorrect passphrasecCsd||_d|_d|_|_|_d|_|_d|_d|_d|_d|_ d|_ d|_ d|_ d|_ d|_dSNF)gpgvalid fingerprint creation_date timestamp signature_idkey_idusername key_statusstatuspubkey_fingerprintexpire_timestamp sig_timestamp trust_text trust_levelr rgr r r__init__s  zVerify.__init__cC|jSr )rhr r r r __nonzero__zVerify.__nonzero__c Cs||jvr||_|j||_dS|dvrtd||dS|dkr3d|_d|_|dd\|_|_ dS|dkrNd|_|dd\|_}}}|_ d |_dS|d krdd|_d |_|dd\|_|_ dS|d krzd |_d|_|dd\|_|_ dS|dkr|dd\|_ |_ |_ |_|d|_d|_dS|dkr|\|_|_ |_ dS|dkrd|_||_d|_dS|dkrd|_||_d|_dS|dvrd|_|d|_|dkrd|_nd|_|j|_dS|dvr8d|_||_|dkrd|_dSd |}|}|dr-t|d}t|d!@} |d"@}| r!|j} n|j} || vr-| |}|js6||_dSdS|d#vr?dStd$||dS)%NWARNINGERRORpotential problem: %s: %sBADSIGFz signature badr*ERRSIGzsignature errorEXPSIGzsignature expiredGOODSIGTzsignature goodVALIDSIGr\zsignature validSIG_IDDECRYPTION_FAILEDzdecryption failed NO_PUBKEYz no public key) EXPKEYSIG REVKEYSIGrrzsigning key has expiredzsigning key was revoked) UNEXPECTEDFAILURErzunexpected dataz error - %sii)DECRYPTION_INFO PLAINTEXTPLAINTEXT_LENGTH NO_SECKEY BEGIN_SIGNINGmessage ignored: %s, %s) TRUST_LEVELSrtrur1r2rhrpsplitrmrnrkrirjrsrrrqrlroisdigitintboolGPG_SYSTEM_ERROR_CODESGPG_ERROR_CODESr8) r keyvaluealgo hash_algoclsmessagepartscode system_errormappingr r r handle_statuss              zVerify.handle_statusN)rrr__doc__r]r^r_r`rarrrrwrz__bool__rr r r rrYs0  rYc@s^eZdZdZdZddZddZeZddd d d d d Z ddddddZ ddZ ddZ dS) ImportResultz#Handle status messages for --importzcount no_user_id imported imported_rsa unchanged n_uids n_subk n_sigs n_revoc sec_read sec_imported sec_dups not_importedcCs4||_g|_g|_g|_|jD]}t||dqdSr )rgimportedresults fingerprintscountssetattr)r rgr!r r rrwXs zImportResult.__init__cCs|jrdS|js dSdS)NFT) not_importedrryr r rrz`s  zImportResult.__nonzero__zNot actually changedzEntirely new keyz New user IDszNew signaturesz New subkeyszContains private key)0124816zNo specific reason givenzInvalid CertificatezIssuer Certificate missingzCertificate Chain too longzError storing certificate)rrr3rc Cs|dvr td||dS|dvrdS|dkr#|jdddddS|dkre|\}}g}t|jD]\}}t|t|Bt|krK||q6d |d }|j|||d |j |dS|d krz|\}}Wn|}d }Y|j|||j |ddS|d kr|} t |j D]\} } t|| t| | qdS|dkr|jdddddS|dkr|jdddddS|dkr|jdddddStd||dS)Nr|r)IMPORTEDKEY_CONSIDEREDNODATArzNo valid data found)riproblemtext IMPORT_OK )riokrIMPORT_PROBLEMz IMPORT_RES KEYEXPIREDz Key expired SIGEXPIREDzSignature expiredrz Other failurer)r1r2rappendrrK ok_reasonitemsrjoinrproblem_reason enumeraterrr8) r rrreasonrireasonsrr reasontext import_resicountr r rrxs^        zImportResult.handle_statuscCs4g}|d|j|jr|d|jd|S)Nz %d importedz%d not imported, )rrrr)r lr r rsummarys  zImportResult.summaryN) rrrrrrrwrzrrrrrr r r rrRs.  +rz\\x([0-9a-f][0-9a-f])r   )z\nz\rz\fz\vz\bz\0c@seZdZddZddZdS) SendResultcCs ||_dSr )rgrvr r rrw zSendResult.__init__cCstd||dS)NzSendResult: %s: %s)r1r8r rrr r rrrQzSendResult.handle_statusN)rrrrwrr r r rrs rcCs8t|D]\}}|t|kr||||<qd||<qdS)N unavailable)rr3)r@ fieldnamesrArvarr r r _set_fieldss   rc@sDeZdZdZdZdZddZddZdd Z d d Z d d Z dS) SearchKeysz Handle status messages for --search-keys. Handle pub and uid (relating the latter to the former). Don't care about the rest r*z#type keyid algo length date expirescCs||_d|_g|_g|_dSr )rgcurkeyruidsrvr r rrws zSearchKeys.__init__cCs&i}t||j|g|d<g|d<|S)Nrsigs)rFIELDS)r rAr!r r r get_fieldss zSearchKeys.get_fieldscCs|||_}||dSr )rrrr rArr r rpubszSearchKeys.pubcCsX||j}tdd|}tD] \}}|||}q|jd||j|dS)NcSstt|ddS)Nr*)chrrgroup)mr r rz SearchKeys.uid..r) UID_INDEXESCAPE_PATTERNsub BASIC_ESCAPESrr rrr)r rAuidkvr r rrs zSearchKeys.uidcCr r r rr r rrrzSearchKeys.handle_statusN) rrrrrrrrwrrrrr r r rrs rcsdeZdZdZdZdZfddZddZeZ Z dd Z d d Z d d Z ddZddZZS)ListKeysa Handle status messages for --list-keys, --list-sigs. Handle pub and uid (relating the latter to the former). Don't care about (info from src/DETAILS): crt = X.509 certificate crs = X.509 certificate and private key available uat = user attribute (same as user id except for field 10). sig = signature rev = revocation signature pkd = public key data (special field format, see below) grp = reserved for gpgsm rvk = revocation key z}type trust length algo keyid date expires dummy ownertrust uid sig cap issuer flag token hash curve compliance updated origincs tt||d|_i|_dSrf)superrrw in_subkeykey_maprv __class__r rrws zListKeys.__init__cCsL|||_}|dr|d|d|d=g|d<||d|_dS)NrrsubkeysF)rrrrrr r rrs  z ListKeys.keycCsn|d}||jvrtd||js%||jd<|j||j|j|<dS|jdd||j|j|<dS)Nrz$Unexpected fingerprint collision: %srirr)r ValueErrorrrrr)r rAfpr r rfpr s    z ListKeys.fprcCs.|di}i}t||j||||d<dS)N subkey_infor\) setdefaultrr)r rrAinfo_mapinfor r r_collect_subkey_infos zListKeys._collect_subkey_infocC8|d|dg}|jd|||j|d|_dS)Nr\rerTrrrrr rAsubkeyr r rrs z ListKeys.subcCs4|ddg}|jd|||j|d|_dS)Nr\rTrrr r rssb(s  z ListKeys.ssbcCs&|jd|d|d|dfdS)Nrr\r )rr)r rAr r rsig.s&z ListKeys.sig)rrrrrrrrwrrsecrrrrr __classcell__r r rrrs    rc@seZdZdZddZdS)ScanKeysz/ Handle status messages for --with-fingerprint.cCr)Nr\rrTrrr r rr5s z ScanKeys.subN)rrrrrr r r rr 2s r c@s,eZdZddZereZdSeZddZdS) TextHandlercCs|j|jj|jjSr )r=decodergr' decode_errorsryr r r_as_text>szTextHandler._as_textcCrxr )r=ryr r r__str__Fr{zTextHandler.__str__N)rrrrr"r __unicode__r r r rr =s  r c@,eZdZdZddZddZeZddZdS) Cryptz2Handle status messages for --encrypt and --decryptcCs(t||d|_d|_d|_d|_dS)NF)rYrwr=rrprmrvr r rrwLs  zCrypt.__init__cC|jrdSdSNTF)rryr r rrzS zCrypt.__nonzero__cCs4|dvr td||dS|dkrd|_dS|dvr%|dd|_dS|dkr.d |_dS|d kr7d |_dS|d kr@d |_dS|dkrLd|_d|_dS|dkrXd|_d|_dS|dkrad|_dS|dkrjd|_dS|dkrsd|_dS|dkr|d|_dS|dkr|ddd|_dS|dvrdSt |||dS)Nr|rrzno data was provided)NEED_PASSPHRASEBAD_PASSPHRASEGOOD_PASSPHRASEMISSING_PASSPHRASErKEY_NOT_CREATEDNEED_PASSPHRASE_PIN_ NEED_PASSPHRASE_SYMzneed symmetric passphraseBEGIN_DECRYPTIONzdecryption incompleteBEGIN_ENCRYPTIONzencryption incompleteDECRYPTION_OKAYz decryption okTEND_ENCRYPTIONz encryption okINV_RECPzinvalid recipientr key expired SIG_CREATEDz sig createdrz sig expiredENC_TOr*r) USERID_HINTGOODMDCEND_DECRYPTIONCARDCTRLBADMDC SC_OP_FAILURE SC_OP_SUCCESSPINENTRY_LAUNCHEDr) r1r2rpr lowerrrrmrYrrr r rrYs>          zCrypt.handle_statusNrrrrrwrzrrr r r rrJs  rc@s4eZdZdZddZddZeZddZdd Zd S) GenKeyz$Handle status messages for --gen-keycCs||_d|_d|_dSr )rgrrirvr r rrws zGenKey.__init__cCrrriryr r rrzrzGenKey.__nonzero__cCs |jpdS)Nrr4ryr r rrrzGenKey.__str__cCsT|dvr td||dS|dkr|\|_|_dS|dvr!dStd||dS)Nr|r KEY_CREATED)PROGRESSrrr)r1r2rrrir8rr r rrszGenKey.handle_statusN) rrrrrwrzrrrr r r rr3s r3cs eZdZdZfddZZS) ExportResultzHandle status messages for --export[-secret-key]. For now, just use an existing class to base it on - if needed, we can override handle_status for more specific message handling. cs"|dvrdStt|||dS)N)EXPORTED EXPORT_RES)rr7rrrr rrszExportResult.handle_status)rrrrrr r r rrr7sr7c@s@eZdZdZddZddZdddd Zd d Zd d ZeZ dS) DeleteResultz?Handle status messages for --delete-key and --delete-secret-keycCs||_d|_dSNr)rgrprvr r rrws zDeleteResult.__init__cCrxr rpryr r rrr{zDeleteResult.__str__z No such keyzMust delete secret key firstzAmbiguous specification)rrrcCs2|dkr|j|d||_dStd||dS)NDELETE_PROBLEMzUnknown error: %rr)rgetrpr1r8rr r rrs  zDeleteResult.handle_statuscCs |jdkSr;r<ryr r rrzrzDeleteResult.__nonzero__N) rrrrrwrrrrzrr r r rr:sr:c@r) Signz!Handle status messages for --signcCs.||_d|_d|_d|_d|_d|_d|_dSr )rgrrrirprmrnrvr r rrws z Sign.__init__cCs |jduSr r4ryr r rrzrzSign.__nonzero__cCs|dvr td||dS|dvrd|_dS|dkrd|_dS|dkr6|\|_}|_}|_|_d|_dS|d krF|d d \|_|_ dS|d krOd |_dS|dvrUdSt d||dS)N)r}r~rr)rrr& KEYREVOKEDz key revokedr'zsignature createdr)rr*rzbad passphrase)rrrr) r1r2rprrrrkrirmrnr8)r rrrrr r rrs$    zSign.handle_statusNr2r r r rr?s   r?z(gpg \(GnuPG(?:/MacGPG2)?\) (\d+(\.\d+)*)r(z [0-9a-f]+$c @sNeZdZdZeeeeee e e e e ed Z   dBddZdd ZdCd d Zd d ZdDddZdEddZdFddZddZddZ  dGddZddZdHddZdDdd Zd!d"Zd#d$Zd%d&Z  dId'd(Z  dJd)d*Z!d+d,Z"dKd-d.Z#d/d0Z$dLd2d3Z%d4d5Z&d6d7Z'   dMd8d9Z(d:d;Z)dd?Z+d@dAZ,dS)OGPGstrict) cryptdeletegenerateimportsendrKscanrsignverifyexportrgNFc CsR||_||_|rt|tr|g}||_|rt|tr|g}||_||_||_t|tr.|g}||_ d|_ d|_ |rGt j |jsGt |jdz|dg}Wntydd|j} t| t| w|jd|} |j|| |jd|jdkrtd |j| jft| j} | sd|_dSd d } td d | d!| D|_dS)a9Initialize a GPG process wrapper. Options are: gpgbinary -- full pathname for GPG binary. gnupghome -- full pathname to where we can find the public and private keyrings. Default is whatever gpg defaults to. keyring -- name of alternative keyring file to use, or list of such keyrings. If specified, the default keyring is not used. options =-- a list of additional options to pass to the GPG binary. secret_keyring -- name of alternative secret keyring file to use, or list of such keyrings. Nzlatin-1iz --versionz1Unable to run gpg (%s) - it may not be available.rJr.rzError invoking gpg: %s: %s.r(cSg|]}t|qSr )r.0rr r r 8rz GPG.__init__..)" gpgbinary gnupghomerrkeyringsecret_keyringverbose use_agentrWoptionson_datar'ospathisdirmakedirs_open_subprocessOSErrorr1r5 result_map_collect_outputr. returncoderstderr VERSION_REmatchr=versionr$rLgroupsr) r rRrSrVrWrTrXrUpmsgr!rdotr r rrwsJ          &z GPG.__init__cCs |jddddg}dtjvr|ddg|r(t|dr(|jd kr(d d g|d d <|gd |jr<|dt|jg|jrS| d|jD] }|dt|gqG|j re|j D] }|dt|gqY|rn|ddg|j rv| d|j r||j |||S)z Make a list of command line elements for GPG. The value of ``args`` will be appended. The ``passphrase`` argument needs to be True if a passphrase will be sent to GPG, else False. z --status-fdrz--no-ttyz --no-verbose DEBUG_IPCz--debugipcrfrZr*z--pinentry-modeloopbackr*)--fixed-list-modez--batch --with-colonsz --homedirz--no-default-keyringz --keyringz--secret-keyringz--passphrase-fdrz --use-agent) rRrZenvironextendr,rfrSr&rTrrUrWrX)r rArIcmdfnr r r make_args:s0        z GPG.make_argscCsrddlm}|||}|jrt||tsd}n t}t|_t|_ t |dt t t |d}t d|j|||S)Nr) list2cmdlineF)shellr.stdoutrc startupinfoz%s: %s) subprocessrvrurVprintrrdwFlagsr wShowWindowrrr1r8pid)r rArI debug_printrssir!r r rr^Ys    zGPG._open_subprocesscCsg} |}t|dkrnB|||}|jrt|td||dddkrO|dd}|dd}|d}t|dkrG|d}nd}| ||qd ||_ dS)NTrz%srz [GNUPG:] r*r) readliner3rrstriprVr{r1r8rrrrc)r rHr!lineslineLkeywordrr r r_read_responsezs(        zGPG._read_responsecCsvg} |d}t|dkrntd|dd|||r%||qtr3t|||_dSd||_dS)NTr)rz chunk: %rr) r/r3r1r8rr"rrr=)r rHr!rYchunksr=r r r _read_datas   zGPG._read_datac Cst|j|j}tj|j||fd}|dt d|| |j }tj|j |||j fd}|dt d|| |||durP|||durhz|Wn tygYnw||dS)a Drain the subprocesses output streams, writing the collected output to the result. If a writer thread (writing to the subprocess) is given, make sure it's joined before returning. If a stdin stream is given, close it before returning. r?Tzstderr reader: %rzstdout reader: %rN)codecs getreaderr'rcrBrCrrDr1r8rErxrrYrwaitr6r7) r processr!writerr.rcrrrxdrr r rras.       zGPG._collect_outputc Cs^|||du}|st|j|j}n|j}|r t|||jt||}||||||S)z;Handle a call to GPG - pass input data, collect output dataN)r^r getwriterr'r.rJrGra) r rAfileobjr!rIbinaryrhr.rr r r _handle_ios zGPG._handle_iocK*t||j}|j|fi|}||S)z sign message)rXr' sign_filer6)r rkwargsfr!r r rrIs zGPG.signcCs.tj|r |dg|dt|gdS)z@If writing to a file which exists, avoid a confirmation message.z--yesz--outputN)rZr[existsrrr&)r rAoutputr r rset_output_without_confirmations  z#GPG.set_output_without_confirmationTc Cstd||r dg} ndg} |r| dn|r| d|r)| dt|g|r1|| ||r8| ||jd|} || |du} z| j} |rTt | ||j t || } Wnt yjt d d} Ynw|| | | | | S) z sign filez sign_file: %sz-sz-saz --detach-signz --clearsign --default-keyrINzerror writing message)r1r8rrrr&rr`r^r.rJr'rGr7loggingr5ra)r filekeyidrI clearsigndetachrr extra_argsrAr!rhr.rr r rrs6       z GPG.sign_filecKr)a<Verify the signature on the contents of the string 'data' >>> GPGBINARY = os.environ.get('GPGBINARY', 'gpg') >>> gpg = GPG(gpgbinary=GPGBINARY, gnupghome="keys") >>> input = gpg.gen_key_input(passphrase='foo') >>> key = gpg.gen_key(input) >>> assert key >>> sig = gpg.sign('hello',keyid=key.fingerprint,passphrase='bar') >>> assert not sig >>> sig = gpg.sign('hello',keyid=key.fingerprint,passphrase='foo') >>> assert sig >>> verify = gpg.verify(sig.data) >>> assert verify )rXr' verify_filer6)r r=rrr!r r rrJ s z GPG.verifyc Cstd|||jd|}dg}|r|||dur'|j|||dd|Stdddl}|jd d \}} |} |rB|td | t || t || t | | t |z| |} |j| || jd Wt | |St | w) zCVerify the signature on the contents of the file-like object 'file'zverify_file: %r, %rrJ--verifyNTrzHandling detached verificationrpygpg)prefixzWrote to temp file: %rrL)r1r8r`rrrtempfilemkstempr/r6rZr4rr&r^rar.unlink) r r data_filename close_filerr!rArfdrtrrhr r rr s2        zGPG.verify_filecCshtd||dd|jd|}dg}|r|||t|dgt|}|j|||dd|S) z;Verify the signature in sig_filename against data in memoryzverify_data: %r, %r ...NrrJr-Tr)r1r8r`rrr&rVr)r sig_filenamer=rr!rArHr r r verify_data<s zGPG.verify_datacCs\|jd|}td|ddt||j}|jdg||ddtd|j||S) z7 Import the key_data into our keyring. rFzimport_keys: %rNr--importTrzimport_keys result: %r)r`r1r8rXr'r__dict__r6)r key_datar!r=r r r import_keysLs zGPG.import_keyscGt|jd|}td|td|j}dt|dg}|dd|D|j|||dd td |j| |S) alImport a key from a keyserver >>> import shutil >>> shutil.rmtree("keys", ignore_errors=True) >>> GPGBINARY = os.environ.get('GPGBINARY', 'gpg') >>> gpg = GPG(gpgbinary=GPGBINARY, gnupghome="keys") >>> os.chmod('keys', 0x1C0) >>> result = gpg.recv_keys('pgp.mit.edu', '92905378') >>> assert result rFz recv_keys: %rr --keyserverz --recv-keyscSrNr r&rPrr r rrQirz!GPG.recv_keys..Trzrecv_keys result: %r r`r1r8rXr'r&rrrrr6r keyserverkeyidsr!r=rAr r r recv_keysXs  z GPG.recv_keyscGr) zSend a key to a keyserver. Note: it's not practical to test this function without sending arbitrary data to live keyservers. rGz send_keys: %rrrz --send-keyscSrNr rrr r rrQzrz!GPG.send_keys..Trzsend_keys result: %rrrr r r send_keysos  z GPG.send_keysc Csd}|r|jdkr|dur|rtdd}t|r!dd|D}nt|g}d|g}|||jd |}|r>|jdkrN||}|j|||jd |St d |j } z|j || ||d d W| |S| w)a4 Delete the indicated keys. Since GnuPG 2.1, you can't delete secret keys without providing a passphrase. However, if you're expecting the passphrase to go to gpg via pinentry, you should specify expect_passphrase=False. (It's only checked for GnuPG >= 2.1). rrmNzHFor GnuPG >= 2.1, deleting secret keys needs a passphrase to be providedz secret-keycSrNr rrOr r rrQrz#GPG.delete_keys..z --delete-%srDrLrTrIr) rfrrPr&rrr`r^rar.rXr'rr6) r rsecretrIexpect_passphrasewhichrAr!rhrr r r delete_keyss2        zGPG.delete_keysc Csd}|rd}|jdkr|dur|rtdt|r!dd|D}nt|g}d|g}|r2|d |r;|d d g|||jd |} |rN|jdkr]||} |j| | | j d nt d|j } z|j || | |ddW| n| wtd| j| j} |r| |j |j} | S)aW Export the indicated keys. A 'keyid' is anything gpg accepts. Since GnuPG 2.1, you can't export secret keys without providing a passphrase. However, if you're expecting the passphrase to go to gpg via pinentry, you should specify expect_passphrase=False. (It's only checked for GnuPG >= 2.1). rz -secret-keyrmNzIFor GnuPG >= 2.1, exporting secret keys needs a passphrase to be providedcSrNr rrr r rrQrz#GPG.export_keys..z --export%s--armorz--export-optionszexport-minimalrKrLTrzexport_keys result: %r)rfrrPr&rrrr`r^rar.rXr'rr6r1r8r=r r) r rrarmorminimalrIrrrAr!rhrr r r export_keyss>        zGPG.export_keysc Cs|j||}|j|||jd|j|j|j}d}|D]/}|j r*t |t d| |s7|S|d}|sAq!|d}||vrPt|||q!|S)NrLzpub uid sec fpr sub ssb sigline: %r:r)r`rar.r=r r'r splitlinesrrVr{r1r8rstripgetattr) r rhkindr!rvalid_keywordsrrrr r r_get_list_outputs. zGPG._get_list_outputcCsX|rd}nd}|r d}d|ddg}|r!t|tr|g}||||}||dS)aP list the keys currently in the keyring >>> import shutil >>> shutil.rmtree("keys", ignore_errors=True) >>> GPGBINARY = os.environ.get('GPGBINARY', 'gpg') >>> gpg = GPG(gpgbinary=GPGBINARY, gnupghome="keys") >>> input = gpg.gen_key_input(passphrase='foo') >>> result = gpg.gen_key(input) >>> fp1 = result.fingerprint >>> result = gpg.gen_key(input) >>> fp2 = result.fingerprint >>> pubkeys = gpg.list_keys() >>> assert fp1 in pubkeys.fingerprints >>> assert fp2 in pubkeys.fingerprints rkeysz secret-keysz --list-%s --fingerprintrK)rrrrr^r)r rrrrrArhr r r list_keyss    z GPG.list_keyscCsJ|jdkr gd}n tdgd}|t|||}||dS)an List details of an ascii armored or binary key file without first importing it to the local keyring. The function achieves this on modern GnuPG by running: $ gpg --dry-run --import-options import-show --import On older versions, it does the *much* riskier: $ gpg --with-fingerprint --with-colons filename rm)z --dry-runz--import-optionsz import-showrzTTrying to list packets, but if the file is not a keyring, might accidentally decrypt)z--with-fingerprintrprorH)rfr1r2rr&r^r)r filenamerArhr r r scan_keys s    z GPG.scan_keys pgp.mit.educ Cs|}t|r d|}ddt|dt|g}||}|jd|}|j|||jd|j |j |j  }ddg}|D]-}|j rGt|td ||sRq>|d } | s\q>| d } | |vrkt|| | q>|S) aj search keyserver by query (using --search-keys option) >>> import shutil >>> shutil.rmtree('keys', ignore_errors=True) >>> GPGBINARY = os.environ.get('GPGBINARY', 'gpg') >>> gpg = GPG(gpgbinary=GPGBINARY, gnupghome='keys') >>> os.chmod('keys', 0x1C0) >>> result = gpg.search_keys('') >>> assert result, 'Failed using default keyserver' >>> #keyserver = 'keyserver.ubuntu.com' >>> #result = gpg.search_keys('', keyserver) >>> #assert result, 'Failed using keyserver.ubuntu.com' 0xrrz --search-keysrrLrrrrr)r HEX_DIGITS_RErer&r^r`rar.r=r r'rrrVr{r1r8rrr) r queryrrArhr!rrrrrr r r search_keys#s<    zGPG.search_keyscCs>dg}|jd|}t||j}|j|||dd||S)aGenerate a key; you might use gen_key_input() to create the control input. >>> GPGBINARY = os.environ.get('GPGBINARY', 'gpg') >>> gpg = GPG(gpgbinary=GPGBINARY, gnupghome="keys") >>> input = gpg.gen_key_input(passphrase='foo') >>> result = gpg.gen_key(input) >>> assert result >>> result = gpg.gen_key('foo') >>> assert not result z --gen-keyrETr)r`rXr'rr6)r inputrAr!rr r rgen_keyNs   z GPG.gen_keycKsi}t|D]\}}|dd}t|r|||<q|dd|dd|ddtj d p>tj d p>d }t }|d d |dd|fd| d}t|D] \}}|d||f7}q^|d7}|S)z> Generate --gen-key input per gpg doc/DETAILS rrzKey-TypeRSAz Key-Lengthiz Name-RealzAutogenerated KeyLOGNAMEUSERNAME unspecifiedz Name-Emailz%s@%srz Key-Type: %s z%s: %s z%commit ) rKrr titlerWrrrZrqr>socket gethostnamepop)r rparmsrvallognamehostnameoutr r r gen_key_inputbs*    zGPG.gen_key_inputc Csdg} |rdg} |dur| dt|gn|stdt|s#|f}|D] } | dt| gq%|r8| d|r@|| ||durJ| dn |rV| dd t|g|r]| d | rd| | |jd |} |j| || |dd t d | j | S)z9Encrypt the message read from the file-like object 'file'z --encryptz --symmetricTz --cipher-algoz2No recipients specified with asymmetric encryptionz --recipientrz--signr--always-trustrCrzencrypt result: %r) rrr&rrPrrr`rr1r8r=) r r recipientsrI always_trustrIrr symmetricrrA recipientr!r r r encrypt_files8     zGPG.encrypt_filecKs,t||j}|j||fi|}||S)aXEncrypt the message contained in the string 'data' >>> import shutil >>> if os.path.exists("keys"): ... shutil.rmtree("keys", ignore_errors=True) >>> GPGBINARY = os.environ.get('GPGBINARY', 'gpg') >>> gpg = GPG(gpgbinary=GPGBINARY, gnupghome="keys") >>> input = gpg.gen_key_input(name_email='user1@test', passphrase='pp1') >>> result = gpg.gen_key(input) >>> fp1 = result.fingerprint >>> input = gpg.gen_key_input(name_email='user2@test', passphrase='pp2') >>> result = gpg.gen_key(input) >>> fp2 = result.fingerprint >>> result = gpg.encrypt("hello",fp2) >>> message = str(result) >>> assert message != 'hello' >>> result = gpg.decrypt(message, passphrase='pp2') >>> assert result >>> str(result) 'hello' >>> result = gpg.encrypt("hello again", fp1) >>> message = str(result) >>> result = gpg.decrypt(message, passphrase='bar') >>> result.status in ('decryption failed', 'bad passphrase') True >>> assert not result >>> result = gpg.decrypt(message, passphrase='pp1') >>> result.status == 'decryption ok' True >>> str(result) 'hello again' >>> result = gpg.encrypt("signed hello", fp2, sign=fp1, passphrase='pp1') >>> result.status == 'encryption ok' True >>> message = str(result) >>> result = gpg.decrypt(message, passphrase='pp2') >>> result.status == 'decryption ok' True >>> assert result.fingerprint == fp1 )rXr'rr6)r r=rrr!r r rencrypts *z GPG.encryptcKrr )rXr' decrypt_filer6)r rrr=r!r r rdecrypts z GPG.decryptcCsfdg}|r ||||r|d|r|||jd|}|j||||ddtd|j|S)Nz --decryptrrCTrzdecrypt result: %r)rrrrr`rr1r8r=)r rrrIrrrAr!r r rrs   zGPG.decrypt_filec Cstj}||vrdt|}td||f||d}ddl}z[|\}}g}t|tr1|g}|D] } | d| |fq3t j |t j } t d| t || |jt ||jd|} |d|g} |j| | | jd Wt || St |w) Nrz-Invalid trust level: "%s" (must be one of %s)rZrz%s:%s:zwriting ownertrust info: %srDz--import-ownertrustrL)rYrrsortedrrrrrrrZlinesepr1r8r4r$r'r6r`r^rar.remove) r r trustlevellevelspossrrrtrrrr!rhr r r trust_keyss2       zGPG.trust_keys)rgNFFNNN)Fr )NNrf)NNTFFNN)NTN)FNT)FTFNT)FNF)r)NFNTNFN)FNNN)-rrrrrr:r3rrrr rr?rYr7r`rwrur^rrrarrIrrrJrrrrrrrrrrrrrrrrrrr r r rrAst < !    $    % 2  +0 %/ rA)Ir __version__ __author____date__rSrrT cStringIOrlocalerrZrerrzrrr-rBrnamerrlogging.NullHandlerr Handlerunicoder" basestringrr# NameErrorrW getLoggerrr1handlers addHandlerr[rcompilergetfilesystemencodingr%r&r>rGrJrPrVrXobjectrYrIrrrrrKrrr r rr3r7r:r?r$rdrrAr r r rs"            "" X 'I  7 %