Path: csiph.com!fu-berlin.de!uni-berlin.de!not-for-mail
From: Vinay Sajip <vinay_sajip@yahoo.co.uk>
Newsgroups: comp.lang.python.announce
Subject: ANN: A new version (0.4.3) of python-gnupg has been released. It contains a security-related change - please update to this version
Date: Wed, 13 Jun 2018 18:06:51 +0000 (UTC)
Lines: 55
Approved: python-announce-list@python.org
Message-ID: <mailman.97.1528977771.25765.python-announce-list@python.org>
References: <2072830771.8419896.1528913211931.ref@mail.yahoo.com> <2072830771.8419896.1528913211931@mail.yahoo.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Precedence: list
Xref: csiph.com comp.lang.python.announce:2884

A new version of the Python module which wraps GnuPG has been released.
What Changed?=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DThis is a security-fix =
release, and all users are strongly encouraged to upgrade.This fix mitigate=
s against CVE-2018-12020. See the discoverer's blog post [6] formore inform=
ation.
Brief summary:

* Added --no-verbose to the gpg command line, in case verbose is specified =
in=C2=A0 gpg.conf - we don't need verbose output.
This release [2] has been signed with my code signing key:
Vinay Sajip (CODE SIGNING KEY) <vinay_sajip at yahoo.co.uk>Fingerprint: CA7=
4 9061 914E AC13 8E66 EADB 9147 B477 339A 9B86
Recent changes to PyPI don't show the GPG signature with the download links=
.An alternative download source where the signatures are available is the p=
roject'sown downloads page [5].
What Does It Do?=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DThe gnupg m=
odule allows Python programs to make use of thefunctionality provided by th=
e Gnu Privacy Guard (abbreviated GPG orGnuPG). Using this module, Python pr=
ograms can encrypt and decryptdata, digitally sign documents and verify dig=
ital signatures, manage(generate, list and delete) encryption keys, using p=
roven Public KeyInfrastructure (PKI) encryption technology based on OpenPGP=
.
This module is expected to be used with Python versions >=3D 2.4, as itmake=
s use of the subprocess module which appeared in that version ofPython. Thi=
s module is a newer version derived from earlier work byAndrew Kuchling, Ri=
chard Jones and Steve Traugott.
A test suite using unittest is included with the source distribution.
Simple usage:
>>> import gnupg>>> gpg =3D gnupg.GPG(gnupghome=3D'/path/to/keyring/directo=
ry')>>> gpg.list_keys()
[{...'fingerprint': 'F819EE7705497D73E3CCEE65197D5DAC68F1AAB2','keyid': '19=
7D5DAC68F1AAB2','length': '1024','type': 'pub','uids': ['', 'Gary Gross (A =
test user) <gary.gr... at gamma.com>']},{...'fingerprint': '37F24DD4B918CC2=
64D4F31D60C5FEFA7A921FC4A','keyid': '0C5FEFA7A921FC4A','length': '1024',...=
'uids': ['', 'Danny Davis (A test user) <danny.da... at delta.com>']}]>>> e=
ncrypted =3D gpg.encrypt("Hello, world!", ['0C5FEFA7A921FC4A'])>>> str(encr=
ypted)
'-----BEGIN PGP MESSAGE-----\nVersion: GnuPG v1.4.9 (GNU/Linux)\n\nhQIOA/6N=
HMDTXUwcEAf.-----END PGP MESSAGE-----\n'>>> decrypted =3D gpg.decrypt(str(e=
ncrypted), passphrase=3D'secret')>>> str(decrypted)
'Hello, world!'>>> signed =3D gpg.sign("Goodbye, world!", passphrase=3D'sec=
ret')>>> verified =3D gpg.verify(str(signed))>>> print "Verified" if verifi=
ed else "Not verified"
'Verified'
As always, your feedback is most welcome (especially bug reports [3],patche=
s and suggestions for improvement, or any other points via themailing list/=
discussion group [4]).
Enjoy!
Cheers
Vinay SajipRed Dove Consultants Ltd.
[1] https://bitbucket.org/vinay.sajip/python-gnupg[2] https://pypi.python.o=
rg/pypi/python-gnupg/0.4.3[3] https://bitbucket.org/vinay.sajip/python-gnup=
g/issues[4] https://groups.google.com/forum/#!forum/python-gnupg[5] https:/=
/bitbucket.org/vinay.sajip/python-gnupg/downloads/[6] https://neopg.io/blog=
/gpg-signature-spoof/