Path: csiph.com!fu-berlin.de!uni-berlin.de!not-for-mail From: Vinay Sajip Newsgroups: comp.lang.python.announce Subject: ANN: A new version (0.4.4) of python-gnupg has been released. It contains a security-related change - please update to this version Date: Thu, 24 Jan 2019 09:35:19 +0000 (UTC) Lines: 69 Approved: python-announce-list@python.org Message-ID: References: <486227803.367000.1548322519153.ref@mail.yahoo.com> <486227803.367000.1548322519153@mail.yahoo.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Trace: news.uni-berlin.de ki58eCFDpAW63utHYBCfXAqyx22DZ6WN7Y6tLVRv2smw== Return-Path: X-Original-To: python-announce-list@python.org Delivered-To: python-announce-list@mail.python.org X-Spam-Status: OK 0.000 X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; 'bug': 0.03; '[2]': 0.04; 'skip:[ 20': 0.04; '(especially': 0.05; 'subject:ANN': 0.05; 'attribute': 0.07; 'duplicate': 0.07; 'module,': 0.07; 'pypi': 0.07; 'url:pypi': 0.07; '>>>': 0.08; '[3]': 0.09; '[4]': 0.09; '[5]': 0.09; 'defaults': 0.09; 'encrypt': 0.09; 'false,': 0.09; 'false.': 0.09; 'fingerprint:': 0.09; 'from:addr:yahoo.co.uk': 0.09; 'instances,': 0.09; 'keys,': 0.09; 'release,': 0.09; 'signal': 0.09; 'unittest': 0.09; 'versions,': 0.09; 'subject:python': 0.10; 'seems': 0.10; 'python': 0.14; '#21:': 0.16; '(code': 0.16; '2.2.7': 0.16; 'buffering,': 0.16; 'callable': 0.16; 'fingerprints': 0.16; 'from:name:vinay sajip': 0.16; 'gpg': 0.16; 'involved,': 0.16; 'key)': 0.16; 'pgp': 0.16; 'sajip': 0.16; 'skip:[ 30': 0.16; 'subject:related': 0.16; 'subject:security': 0.16; 'subject:version': 0.16; 'timestamp': 0.16; 'url-ip:18.205.93.0/32': 0.16; 'url-ip:18.205.93.1/32': 0.16; 'url-ip:18.205.93.2/32': 0.16; 'url-ip:18.205.93/24': 0.16; 'url-ip:18.205/16': 0.16; 'url:bitbucket': 0.16; 'url:issues': 0.16; 'vinay': 0.16; 'wraps': 0.16; 'module': 0.16; 'cheers': 0.20; 'fixed': 0.20; 'import': 0.22; 'url-ip:151.101.0.223/32': 0.24; 'url-ip:151.101.128.223/32': 0.24; 'url- ip:151.101.192.223/32': 0.24; 'url-ip:151.101.64.223/32': 0.24; 'print': 0.26; 'steve': 0.27; 'url-ip:151.101.192/24': 0.27; '[1]': 0.27; "skip:' 20": 0.27; "can't": 0.28; 'url- ip:151.101.0/24': 0.28; 'url-ip:151.101.128/24': 0.28; 'url- ip:151.101.64/24': 0.28; '>>>': 0.29; 'to:addr:python- announce-list': 0.29; 'expected': 0.30; 'url-ip:151.101/16': 0.31; 'url-ip:151/8': 0.31; 'empty': 0.31; 'mapping': 0.31; 'richard': 0.31; 'fix': 0.31; 'too': 0.32; 'source': 0.32; 'code': 0.34; 'changes': 0.35; 'url-ip:18/8': 0.35; 'later,': 0.35; 'versions': 0.35; 'subject:: ': 0.36; 'gross': 0.36; 'subject:has': 0.36; 'always,': 0.37; 'keys': 0.37; "skip:' 50": 0.37; 'skip:( 40': 0.37; 'true,': 0.37; 'url:downloads': 0.37; 'version,': 0.37; 'use': 0.37; 'subject:-': 0.37; 'list': 0.37; 'url-ip:108/8': 0.38; 'using': 0.38; 'to:addr:python-list': 0.38; 'subject: (': 0.38; 'subject:please': 0.38; 'test': 0.38; 'url:python': 0.39; 'consultants': 0.61; 'jones': 0.61; 'signature': 0.61; 'key': 0.61; 'simple': 0.61; 'brief': 0.61; 'privacy': 0.61; 'your': 0.62; 'skip:v 10': 0.62; 'against': 0.63; 'provide': 0.63; 'skip:g 20': 0.63; 'available': 0.63; '(if': 0.64; 'programs': 0.65; 'appeared': 0.66; 'date,': 0.66; 'normal.': 0.66; 'received:consmr.mail.ir2.yahoo.com': 0.66; 'signatures': 0.66; 'summary:': 0.66; 'received:77.238': 0.67; 'documents': 0.67; 'message-id:@mail.yahoo.com': 0.68; 'welcome': 0.69; 'skip:g 30': 0.71; 'subject:this': 0.74; 'trigger': 0.74; 'url:4': 0.74; 'subject:. ': 0.74; 'digital': 0.81; 'verification': 0.84; 'davis': 0.84; 'fingerprint': 0.84; 'improvement,': 0.84; 'is\xc2\xa0': 0.84; 'url:forum': 0.84; 'encrypted': 0.91; 'enjoy!': 0.91; 'expiry': 0.91; 'guard': 0.91; 'url- ip:108.177/16': 0.91 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.uk; s=s2048; t=1548322546; bh=q9Gh3zc3dNYHgzPJDtbqxaKgWKYTb/iPjwDq3IV5rV8=; h=Date:From:To:Subject:References:From:Subject; b=ObWl4s49wbQwJQvb9+MKkXjfmYay87JYBWPU0y2cU6OHS+hfxhmyzJGjMjeAZZAjAsPGGdoAC7wYbNa8dGishWZjuqkp6ax1cr+6ytNySuWkiyZY0GK/IUNsdoRJSU1p4nvXyYA7JDFnrOga40tT/65Hjw1/pa3FJA+WZNzdLR4V76QkfYoRsIKY70BakOcwMHIu5UY/87xX7KLy8Ef7FrWTN64N/Rf3jCQyfGmEQrJCq9JNPGJagJGQ2/vvp83j8/yZiOZ3h9JqrIGv7XkwELeqt7GTktAFdFv9d3j2Ady3yAFg95bpiQmPmnkdyI/YvTa+2ga5vWzjUPwvMEIRwA== X-YMail-OSG: fp51114VM1mpSfWkqFUmGIt3QhlkytCd2ocZL8PGYvgXL7D9cEoK0Tj1.fYVd7s Ty1KliTMcs5a_WiqzyUuANhB_zM7AtyL1FU7UHqC6Iu6Bvlt4yvo_z3fEsbWvRULpuZdfp7kujXP tQWpRbh4TaGerdH2F8ZMxhJ8vg5LGmhx1QokSES0JXiVWDl.biC1OKX_VGMhR9JwyNVUnjY5lciH BBHKxnAgt.52pya6BlzOWBk7M9XQcIFLFBIaqdNqZY3A7K9UQmup_ALlE1BFrelgK7i.eOKOi998 HKFQXi_1ropDU22fs_um3_WIzgrr84LDLgUEYp7V72hfzPuJt8EGFPr3J4RkbcYnsLgEcS6WMK9S 6sVPv6JTpgXNFrvT0ZXRCjZljNIpIz0AekICkEvv0Eseg3JzWV35JQ.PMxtgyyGwCEU5F2rXEw.x RdR9muEN162Tf4bzao8DLxyISbl8TtjkG4xsEN6mN8jEHLiEOwoT5IMxvp.nikuTIH0S7RxrKN6j Ux5NzKlljNcehbNtf86.z3IoZPCPVZPpH66b7ai0yACWKlsc3Ls6RwugFDGgJGavvpnS6S_EsKQz O6FMJp_mFASkgUi0I5LsCbLq2ZK2HWp2fo8tVvarrqY8J4bGBPto_yUyZ6rvZl_fJjYU50eLCLJL N3d1N7z3lBu5nDAsolUN_.jXor26eC9rg_fni8xI5WssAeoQgTreY_FVmJVyYJGpEJEMqKPx4Ymz aVmEWFc9rLafhA7PUoYH1_doxRlKZqbzh7rbWYkYZ4PnpqKqhTcZIpw6t9KRJcSbMf3UfFlJ4Fl1 _KigUouiwq06fgV6SlrLTK0hl5hFMVxmbBdDnUJxvI3PREw3G.XrKvZqlhTlZ9UnMA7rsnOZgq9T VYKTnFuSqHny_C7477qOnFzB_s9i0Syx7wzlLguNq2c9VXSQrVaQ661rXOhpT4WMzzrtDSLjHHtG FkKl.Lj9MwMmBHsJW66Rf.oSh_U3KgbKb43aa5sh0_7z8_DzM.HudSbYR.XvBazyjk0I2aoor_9A zvi7fOVRqbST0pxHCAZdxmYXtSqO1Ndaex86TCQ8i1XcA_epRyDwMOmXX_GMBUwuRqURdIKbg1YP R0A-- X-Mailer: WebService/1.1.13027 YMailNorrin Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 Vivaldi/2.2.1388.37 X-Mailman-Approved-At: Fri, 25 Jan 2019 08:07:55 -0500 X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: python-announce-list@python.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Announcement-only list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Mailman-Original-Message-ID: <486227803.367000.1548322519153@mail.yahoo.com> X-Mailman-Original-References: <486227803.367000.1548322519153.ref@mail.yahoo.com> Xref: csiph.com comp.lang.python.announce:3050 A new version of the Python module which wraps GnuPG has been released. What Changed?=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DThis is an enhancement = and security-fix release, and all users are stronglyencouraged to upgrade. Brief summary: * Fixed #108: Changed how any return value from the on_data callable is=C2= =A0 processed. In earlier versions, the return value was ignored. In this v= ersion,=C2=A0 if the return value is False, the data received from gpg is n= ot=C2=A0 buffered. Otherwise (if the value is None or True, for example), t= he=C2=A0 data is buffered as normal. This functionality can be used to do y= our own=C2=A0 buffering, or to prevent buffering altogether. =C2=A0 The on_data callable is also called once with an empty byte-string t= o=C2=A0 signal the end of data from gpg. * Fixed #97: Added an additional attribute check_fingerprint_collisions to= =C2=A0 GPG instances, which defaults to False. It seems that gpg is happy= =C2=A0 to have duplicate keys and fingerprints in a keyring, so we can't be= too=C2=A0 strict. A user can set this attribute of an instance to True to = trigger a=C2=A0 check for collisions. * Fixed #111: With GnuPG 2.2.7 or later, provide the fingerprint of a signi= ng=C2=A0 key for a failed signature verification, if available. * Fixed #21: For verification where multiple signatures are involved, a=C2= =A0 mapping of signature_ids to fingerprint, keyid, username, creation date= ,=C2=A0 creation timestamp and expiry timestamp is provided. * Added a check to disallow certain control characters ('\r', '\n', NUL) in= =C2=A0 passphrases. This fix mitigates against CVE-2019-6690. This release [2] has been signed with my code signing key: Vinay Sajip (CODE SIGNING KEY) Fingerprint: CA7= 4 9061 914E AC13 8E66 EADB 9147 B477 339A 9B86 Recent changes to PyPI don't show the GPG signature with the download links= .An alternative download source where the signatures are available is the p= roject'sown downloads page [5]. What Does It Do?=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DThe gnupg m= odule allows Python programs to make use of thefunctionality provided by th= e Gnu Privacy Guard (abbreviated GPG orGnuPG). Using this module, Python pr= ograms can encrypt and decryptdata, digitally sign documents and verify dig= ital signatures, manage(generate, list and delete) encryption keys, using p= roven Public KeyInfrastructure (PKI) encryption technology based on OpenPGP= . This module is expected to be used with Python versions >=3D 2.4, as itmake= s use of the subprocess module which appeared in that version ofPython. Thi= s module is a newer version derived from earlier work byAndrew Kuchling, Ri= chard Jones and Steve Traugott. A test suite using unittest is included with the source distribution. Simple usage: >>> import gnupg>>> gpg =3D gnupg.GPG(gnupghome=3D'/path/to/keyring/directo= ry')>>> gpg.list_keys() [{...'fingerprint': 'F819EE7705497D73E3CCEE65197D5DAC68F1AAB2','keyid': '19= 7D5DAC68F1AAB2','length': '1024','type': 'pub','uids': ['', 'Gary Gross (A = test user) ']},{...'fingerprint': '37F24DD4B918CC2= 64D4F31D60C5FEFA7A921FC4A','keyid': '0C5FEFA7A921FC4A','length': '1024',...= 'uids': ['', 'Danny Davis (A test user) ']}]>>> e= ncrypted =3D gpg.encrypt("Hello, world!", ['0C5FEFA7A921FC4A'])>>> str(encr= ypted) '-----BEGIN PGP MESSAGE-----\nVersion: GnuPG v1.4.9 (GNU/Linux)\n\nhQIOA/6N= HMDTXUwcEAf.-----END PGP MESSAGE-----\n'>>> decrypted =3D gpg.decrypt(str(e= ncrypted), passphrase=3D'secret')>>> str(decrypted) 'Hello, world!'>>> signed =3D gpg.sign("Goodbye, world!", passphrase=3D'sec= ret')>>> verified =3D gpg.verify(str(signed))>>> print "Verified" if verifi= ed else "Not verified" 'Verified' As always, your feedback is most welcome (especially bug reports [3],patche= s and suggestions for improvement, or any other points via themailing list/= discussion group [4]). Enjoy! Cheers Vinay SajipRed Dove Consultants Ltd. [1] https://bitbucket.org/vinay.sajip/python-gnupg[2] https://pypi.python.o= rg/pypi/python-gnupg/0.4.4[3] https://bitbucket.org/vinay.sajip/python-gnup= g/issues[4] https://groups.google.com/forum/#!forum/python-gnupg[5] https:/= /bitbucket.org/vinay.sajip/python-gnupg/downloads/