Groups > comp.lang.python.announce > #2884

ANN: A new version (0.4.3) of python-gnupg has been released. It contains a security-related change - please update to this version

Path	csiph.com!fu-berlin.de!uni-berlin.de!not-for-mail
From	Vinay Sajip <vinay_sajip@yahoo.co.uk>
Newsgroups	comp.lang.python.announce
Subject	ANN: A new version (0.4.3) of python-gnupg has been released. It contains a security-related change - please update to this version
Date	Wed, 13 Jun 2018 18:06:51 +0000 (UTC)
Lines	55
Approved	python-announce-list@python.org
Message-ID	<mailman.97.1528977771.25765.python-announce-list@python.org> (permalink)
References	<2072830771.8419896.1528913211931.ref@mail.yahoo.com> <2072830771.8419896.1528913211931@mail.yahoo.com>
Mime-Version	1.0
Content-Type	text/plain; charset=UTF-8
Content-Transfer-Encoding	quoted-printable
X-Trace	news.uni-berlin.de 6bXudD4KMLsHSXT1BydlYw1/Tf3yvDIowbj8Msu/D2qg==
Return-Path	<vinay_sajip@yahoo.co.uk>
X-Original-To	python-announce-list@python.org
Delivered-To	python-announce-list@mail.python.org
X-Spam-Status	OK 0.000
X-Spam-Evidence	'H': 1.00; 'S': 0.00; 'url:pypi': 0.03; '(especially': 0.05; 'from:addr:yahoo.co.uk': 0.05; 'pypi': 0.05; 'keys,': 0.07; 'release,': 0.07; 'subject:ANN': 0.07; 'subject:update': 0.07; 'unittest': 0.07; 'url- ip:104.192.143.1/32': 0.07; 'url-ip:104.192.143.2/32': 0.07; 'url- ip:104.192.143.3/32': 0.07; 'url-ip:104.192.143/24': 0.07; 'url- ip:104.192/16': 0.07; 'url:bitbucket': 0.07; 'gpg': 0.09; 'key)': 0.09; 'pgp': 0.09; 'released.': 0.09; 'skip:[ 30': 0.09; 'skip:g 60': 0.09; 'subject:related': 0.09; 'subject:version': 0.09; 'url:issues': 0.09; '(code': 0.16; '[5]': 0.16; 'dove': 0.16; 'encryption': 0.16; 'fingerprint:': 0.16; 'gnupg': 0.16; 'key:': 0.16; 'skip:g 50': 0.16; 'subprocess': 0.16; 'v1.4.9': 0.16; 'verbose': 0.16; 'steve': 0.16; 'python': 0.16; 'bug': 0.16; 'versions': 0.19; '>>>': 0.21; 'skip:[ 20': 0.21; 'subject:python': 0.22; '>>>': 0.23; "skip:' 10": 0.23; 'url- ip:151.101.0.223/32': 0.25; 'url-ip:151.101.128.223/32': 0.25; 'url-ip:151.101.192.223/32': 0.25; 'url-ip:151.101.64.223/32': 0.25; 'changes': 0.26; 'url-ip:151.101.192/24': 0.26; 'url- ip:151.101.0/24': 0.27; 'url-ip:151.101.128/24': 0.27; 'url- ip:151.101.64/24': 0.27; 'module': 0.27; 'import': 0.27; 'fix': 0.28; 'command': 0.28; 'cheers': 0.28; 'expected': 0.29; 'print': 0.30; 'signed': 0.31; 'earlier': 0.31; 'url:io': 0.31; 'module,': 0.32; 'specified': 0.32; 'subject:change': 0.32; 'url:downloads': 0.32; 'included': 0.32; 'source': 0.32; 'always,': 0.33; 'derived': 0.33; 'signatures': 0.33; 'url-ip:104.198/16': 0.33; 'wraps': 0.33; "skip:' 20": 0.33; 'subject:please': 0.33; 'test': 0.33; 'url:blog': 0.34; 'url-ip:151.101/16': 0.34; 'url-ip:151/8': 0.34; 'code': 0.34; 'points': 0.36; 'list': 0.36; 'allows': 0.37; 'skip:g 30': 0.37; 'strongly': 0.37; 'gnu': 0.38; 'gross': 0.38; 'to:addr:python-announce-list': 0.38; 'subject: (': 0.38; 'version': 0.39; 'subject:-': 0.39; 'url:org': 0.40; 'post': 0.40; 'your': 0.60; 'received:77': 0.61; 'url:0': 0.61; '"not': 0.62; '[4]': 0.62; 'appeared': 0.62; 'jones': 0.63; 'url- ip:108.177.119.100/32': 0.63; 'url-ip:108.177.119.101/32': 0.63; 'url-ip:108.177.119.102/32': 0.63; 'url-ip:108.177.119.113/32': 0.63; 'url-ip:108.177.119.138/32': 0.63; 'url- ip:108.177.119.139/32': 0.63; 'received:77.238': 0.63; 'programs': 0.63; 'digital': 0.66; 'subject:. ': 0.66; 'privacy': 0.66; '[3]': 0.70; 'encrypted': 0.70; 'url:4': 0.76; 'enjoy!': 0.84; 'usage:': 0.84; 'subject:this': 0.86; 'pfxlen:2': 0.93; 'received:consmr.mail.ir2.yahoo.com': 0.93
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.uk; s=s2048; t=1528913228; bh=GVa3lQWIECnSpUVkhp+OTNxkCvUJgNJfmOYDXoFyuOw=; h=Date:From:To:Subject:References:From:Subject; b=dth7Lb66w7NXyd6GA/uuy2C0sXPasp2CfPJb4yqQs8Xml9LuCYmfJ38o/wuwLSwjEh8nj1m1TE4LEvwY5ZoXzp1VbIL/IiWsiVwYw423hQ+90w5voMBthbhhdDCyDxhxJqDq+Ru1oFr972doqI3O51oXjtSF5xZ/XoJp0KdCkusT3rhPamg9A9MM2fIi/imxy1fb4+8tLIiobQxoSxPPbaqQwLT3ZVuLgzlwJH5gXsNhHB9FIYGEHoqySmMlt3OdoPS/u+X7FqU8cp/wPMgRjzxKdCM7nv4jRCZBeSxGd3Qe2EEryiw0f9+ZeDpPG/DJs1ektKYArHspPnViSWb6lQ==
X-YMail-OSG	BzLas5AVM1nI9rVBzajGj.7OkhvKCLVCKUbkfm235EGdVvR0VUtvG3Kk8PvYZh5 RQALWlnD3aevAnAJnTJSYj64yojTuE5XI6TBlpMAa.u9J9Ol7PGW_2CZF_CVhfnBAaM0uwEd2hZp jrKs1Lp6Z2vRUnHsc6_pe77bozD79tk1iormxCEUNGPT8j2uEud8rP9BsQyGin9hJsTLWAmh0WXB aUkQUObFUx5g3s8.XMp6xnynVbPmQ8j5jpDla1dqen37iCzdMVA9fRzznWsEFCS7K0T1xcLAsfc3 rYrVLyfg3G0nmo958abXPpw2_Rj1mcRI4U0Bd7AhBNc7z71dl657iw15D2dzyHZaheLWtZ859J0D 4wF.6o1RGZAuGNnwd_C.8TZNbDVxnzP0bfu_z53L3J_WrEthEigvWybLS5bXOGa_oePifzb_BZZP mn_BhBF0Za813coOIdVuVT8vAq9BpSZFWsPT.DD48cMm9yjxOspnC_ZZr8rEdK6DVF7LE3IhdkpN IruGJ5.qnnsRrbd1wr6o2bF3p4Vii4VVIMwtiyOOb3du0_JFS5VBIVCdm7W6eZPqNVuOYg.gQPiK 8HWGYBvb49fxPWx8_pSenx8ST_vIISlbtIf.6YILNShSSKmkuLEggKnMLh4k2loDuow_JnaE7mKR kt_7mEygl_KlC6QoC5KIVGIQIxuQSO.02SL3VrOskeF4f4uX0boYPlw3gyhj.wwIysRQt5o7mmEf k0nKweNvNLoMnXxzuuV7vF2N3XzyLHg3sbBOsGssA19TVIxR7ZGf0WWJ4PisXyY2dG4HtvIapUUA Qqfb4V__owE8VfkhqgbZFH3BP5ny4e2JTCjPfjsv6Q4tj96Z9nEIGo1h3zzF7NrdfR3awhI315rp SYUYK5EXS0SWJXNaLXgdaHUaqZIinZUlKL1k5uubwKwg9D76C.Ij.Qv4.dtAQ3Mg-
X-Mailer	WebService/1.1.11950 YMailNorrin Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/66.0.3359.181 Chrome/66.0.3359.181 Safari/537.36
X-Mailman-Approved-At	Thu, 14 Jun 2018 08:02:50 -0400
X-Content-Filtered-By	Mailman/MimeDel 2.1.26
X-BeenThere	python-announce-list@python.org
X-Mailman-Version	2.1.26
Precedence	list
List-Id	Announcement-only list for the Python programming language <python-announce-list.python.org>
List-Unsubscribe	<https://mail.python.org/mailman/options/python-announce-list>, <mailto:python-announce-list-request@python.org?subject=unsubscribe>
List-Archive	<http://mail.python.org/pipermail/python-announce-list/>
List-Post	<mailto:python-announce-list@python.org>
List-Help	<mailto:python-announce-list-request@python.org?subject=help>
List-Subscribe	<https://mail.python.org/mailman/listinfo/python-announce-list>, <mailto:python-announce-list-request@python.org?subject=subscribe>
X-Mailman-Original-Message-ID	<2072830771.8419896.1528913211931@mail.yahoo.com>
X-Mailman-Original-References	<2072830771.8419896.1528913211931.ref@mail.yahoo.com>
Xref	csiph.com comp.lang.python.announce:2884

Show key headers only | View raw

A new version of the Python module which wraps GnuPG has been released.
What Changed?=============This is a security-fix release, and all users are strongly encouraged to upgrade.This fix mitigates against CVE-2018-12020. See the discoverer's blog post [6] formore information.
Brief summary:

* Added --no-verbose to the gpg command line, in case verbose is specified in  gpg.conf - we don't need verbose output.
This release [2] has been signed with my code signing key:
Vinay Sajip (CODE SIGNING KEY) <vinay_sajip at yahoo.co.uk>Fingerprint: CA74 9061 914E AC13 8E66 EADB 9147 B477 339A 9B86
Recent changes to PyPI don't show the GPG signature with the download links.An alternative download source where the signatures are available is the project'sown downloads page [5].
What Does It Do?================The gnupg module allows Python programs to make use of thefunctionality provided by the Gnu Privacy Guard (abbreviated GPG orGnuPG). Using this module, Python programs can encrypt and decryptdata, digitally sign documents and verify digital signatures, manage(generate, list and delete) encryption keys, using proven Public KeyInfrastructure (PKI) encryption technology based on OpenPGP.
This module is expected to be used with Python versions >= 2.4, as itmakes use of the subprocess module which appeared in that version ofPython. This module is a newer version derived from earlier work byAndrew Kuchling, Richard Jones and Steve Traugott.
A test suite using unittest is included with the source distribution.
Simple usage:
>>> import gnupg>>> gpg = gnupg.GPG(gnupghome='/path/to/keyring/directory')>>> gpg.list_keys()
[{...'fingerprint': 'F819EE7705497D73E3CCEE65197D5DAC68F1AAB2','keyid': '197D5DAC68F1AAB2','length': '1024','type': 'pub','uids': ['', 'Gary Gross (A test user) <gary.gr... at gamma.com>']},{...'fingerprint': '37F24DD4B918CC264D4F31D60C5FEFA7A921FC4A','keyid': '0C5FEFA7A921FC4A','length': '1024',...'uids': ['', 'Danny Davis (A test user) <danny.da... at delta.com>']}]>>> encrypted = gpg.encrypt("Hello, world!", ['0C5FEFA7A921FC4A'])>>> str(encrypted)
'-----BEGIN PGP MESSAGE-----\nVersion: GnuPG v1.4.9 (GNU/Linux)\n\nhQIOA/6NHMDTXUwcEAf.-----END PGP MESSAGE-----\n'>>> decrypted = gpg.decrypt(str(encrypted), passphrase='secret')>>> str(decrypted)
'Hello, world!'>>> signed = gpg.sign("Goodbye, world!", passphrase='secret')>>> verified = gpg.verify(str(signed))>>> print "Verified" if verified else "Not verified"
'Verified'
As always, your feedback is most welcome (especially bug reports [3],patches and suggestions for improvement, or any other points via themailing list/discussion group [4]).
Enjoy!
Cheers
Vinay SajipRed Dove Consultants Ltd.
[1] https://bitbucket.org/vinay.sajip/python-gnupg[2] https://pypi.python.org/pypi/python-gnupg/0.4.3[3] https://bitbucket.org/vinay.sajip/python-gnupg/issues[4] https://groups.google.com/forum/#!forum/python-gnupg[5] https://bitbucket.org/vinay.sajip/python-gnupg/downloads/[6] https://neopg.io/blog/gpg-signature-spoof/

Back to comp.lang.python.announce | Previous | Next | Find similar | Unroll thread

Thread

ANN: A new version (0.4.3) of python-gnupg has been released. It contains a security-related change - please update to this version Vinay Sajip <vinay_sajip@yahoo.co.uk> - 2018-06-13 18:06 +0000

csiph-web