Make signed file from content file and its detached signature?

Question

I have a text file which I will call filename.txt. Firstly I call

gpg --output filename.asc --clearsign filename.txt

Signed file filename.asc is created. Then I call

gpg --armor --output filename.sig --detach-sign filename.asc

Signature is extracted from signed file filename.asc and saved in filename.sig.

My question is if it is possible somehow to merge original unsigned file filename.txt and file with ASCII armored signature filename.sig to make signed file? I see no such functionality in GPG, but maybe I don't know something? Or maybe is it possible with others tools (Java processing or anything)?

Simply merging this files results with failed signature verification. In my use case I need to sign file, reply with signature file (without content), then I receive separate siganture and conent file. I need to merge it and encrypt. For now I am not using --detach switch and I just split signed file into two files and then I am simply merging them. But when I use --detach switch siganture changes and it doesn't work when I merge siganture file with content file. It could stay the way it is right now, but I want to extract siganture in standard way using --detach switch rather than just cutting signed file into pieces, but then I don't see an option to merge siganture exported with --detach switch

Answer 1

In general, you can not simply take a detached signature and combine it with the original data to create a clear-signed message, unless you normalize the input before creating the signature.

GnuPG will pack the original input text differently, depending on the type of operation (detached vs. clear-sign). RFC4880 section 7.1 makes note of this (https://www.rfc-editor.org/rfc/rfc4880#section-7.1).

As with binary signatures on text documents, a cleartext signature is calculated on the text using canonical line endings. The line ending (i.e., the <CR><LF>) before the '-----BEGIN PGP SIGNATURE-----' line that terminates the signed text is not considered part of the signed text.

So, we must first normalize the line endings of the input text, then remove the final <CR><LF> from the end of the text.

Here is an example of how the original input data would need to be altered:

gpg --armor --output filename.txt.asc --detach-sign <(sed 's/$/\r/' filename.txt | head -c -2)

That will create the detached signature (filename.txt.asc) after first converting the line endings ('$') to a carriage-return ('\r'), and also remove the carriage-return + line-feed from the end of the text input.

Now you can build a clear-signed message from the signature (filename.txt.asc) and the original file (filename.txt), like so:

gpg --verify <(echo -e "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n$(cat filename.txt)\n$(cat filename.txt.asc)")

(you will have to replace the hash algorithm - SHA1 in my example - with whatever you are actually using)

Also, it should be noted -

gpg --armor --output filename.sig --detach-sign filename.asc Signature is extracted from signed file filename.asc and saved in filename.sig.

This does not extract any signature -- it creates a new signature of the data within the file filename.asc (including the original signature), and saves it to filename.sig. If you pass --clearsign instead of --detach-sign you will see what I mean.