1

To verify if file is signed correctly we use command:

gpg --verify <file_name>

and the output shows if file is signed correctly. And if it is, then signer name is shown. But is there possibility to specify in command line argument which user I expect to have signed that file?

I am invoking that command from Java and now I get exit code 0 from GPG whichever user have signed that file. I would like to specify which user I expect so GPG would return non-zero code when file was signed by other user. I know that I can compare GPG command output with my username, but I would like to know if I can check that on GPG command level.

I've looked into documentation, but I did not see that there.

3

You could, perhaps, use a keyring with only that specific key in it, and specify the keyring on the command line (using --no-default-keyring --keyring <file> )

Note that unless you have signed the key used to create the signature, the user name in GnuPG's output is not a good thing to check. Anybody can generate a valid key with a certain user name. Check the key's fingerprint instead.

  • I have few keys generated on my machine and I would like to verify all users, not only mine, so I guess I would have to create keyring for every user. – ctomek Jan 12 '16 at 12:49
1

GnuPG does not allow to restrict the key set without specifying another key file. Use --no-default-keyring to disable the default keyring containing all the keys, and then specify a keyring (which can be a single exported key!) with --keyring public-key.asc. If necessary, export the key immediately before verifying the signature:

gpg --export [user ID|key ID] >public-key.asc
gpg --no-default-keyring --keyring public-key.asc signature.asc

Be aware that this will counterfeit all trust checks through signatures. Do not specify user IDs but fingerprints if you're not completely sure that maliciouus keys could get imported (for example, some mail clients automatically try to fetch missing keys for signed mails). Better use fingerprints instead of user IDs to reference fixed keys.

If you're sure to have referenced a fixed trusted key and you have issued with missing trust when verifying signatures, use --trust-model always or use the stripped-down gpgv version of GnuPG.

0

I see that you are doing this from Java. You might want to take a look at the Bouncy Castle library which allows you to work with OpenPGP data in Java, instead of having to call gpg.

Look at this question to get started: https://stackoverflow.com/questions/19173181/bouncycastle-pgp-decrypt-and-verify

  • I have to stick with GnuPG, but thanks anyway for another idea. – ctomek Jan 12 '16 at 20:46
-1

You could write a shell script to do that easily of course:

Using DOS CMD file called vsig.cmd:

@echo off
gpg --verify  %1 > %temp%\result.txt 2>&1
grep "%2" %temp%\result.txt
if errorlevel 1 (
  echo File was NOT signed by %2
  exit /b 1
) else (
  echo File was signed by %2!
  exit /b 0
)

This will provide the following output:

>vsig cd.txt.asc Rodrigo
gpg: Good signature from "Rodrigo M" <rm@example.com>"
File was signed by Rodrigo!

>vsig cd.txt.asc fred
File was NOT signed by fred.

Also note that exit codes are provided, so that you could call it from Java, and act on the exit codes are you needed.

In this example I used a name for the search term, but you can also use the RSA key ID as a search term

  • He already stated he is using Java and "could compare with" his username, but he instead wants a gpg solution. – d1str0 Mar 13 '16 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.