我正在使用python-gpg来签名/加密/验证/解密tar存档。
代码段 -
# import private key into gnupghome
_pvtKey = urllib2.urlopen(_certurl)
_pv_data = _pvtKey.read()
gpg.import_keys(_pv_data)
.....
stream = open("/tar/at/some/path/arh.tar", "rb")
status = gpg.sign_file(stream, passphrase=_salt, detach=True, output="/output/sig/here.sig")
代码生成的sig文件就好了。但是,如果我尝试使用公钥验证sig / tar,我收到以下消息 -
gpg: armor header: Version: GnuPG v1
gpg: Signature made Tue 28 Aug 2018 07:48:28 PM UTC using RSA key ID 6B93AF63
gpg: using PGP trust model
gpg: BAD signature from "[email protected]"
gpg: binary signature, digest algorithm SHA1
相反,如果我尝试直接在linux上生成sig文件并验证,它工作正常。
我对此失去了理智,任何指针都在吗?
为了防止其他人遇到这个错误,我通过完全离开库并通过Popen进行签名来解决它。以下参考资料帮助 -
http://jeromebelleman.gitlab.io/posts/devops/pygpgstdin/
Python/POpen/gpg: Supply passphrase and encryption text both through stdin or file descriptor