<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 17/10/2025 15:42, Werner Koch via Gnupg-users wrote:<br>
<blockquote type="cite" cite="mid:87sefhwsou.fsf@jacob.g10code.de">
<pre wrap="">Hi!
On Thu, 16 Oct 2025 21:37, Tennyson T Bardwell said:
</pre>
<blockquote type="cite">
<pre wrap="">In short: I experimented and found that `gpg -d > results.txt` will
write to `results.txt` even if the verification (signature or MDC) of
the wrapped message fails.
</pre>
</blockquote>
<pre wrap="">
Sure, gpg is a Unix tool and as such used in pipeline to process huge
amounts of data.
</pre>
<blockquote type="cite">
<pre wrap="">I think that I understand why this happens[2], why integrity is
important[3], and that writing to a temporary file (and checking the
exit code before use) is the recommended way to handle this. (Although,
</pre>
</blockquote>
<pre wrap="">
Right. Before you further process the data you should verify it.
</pre>
<blockquote type="cite">
<pre wrap="">However, I notice that gpg's `--decrypt` flag does not have a way to
specify the expected signer, meaning that (without parsing stderr)
</pre>
</blockquote>
<pre wrap="">
You can do that with --assert-signer like:
$ gpg -d --assert-signer 8777461F2A074EBC480D359419CC1C9E085B107A foo
gpg: encrypted with brainpoolP384r1 key, ID 2B999FA9CE046B1B, created 2021-06-28
<a class="moz-txt-link-rfc2396E" href="mailto:wk@gnupg.org">"wk@gnupg.org"</a>
gpg: using "63113AE866587D0A" as default secret key for signing
Today is the first day of the rest of your life.
gpg: Signature made Fri 17 Oct 2025 03:15:13 PM CEST
gpg: using EDDSA key 8777461F2A074EBC480D359419CC1C9E085B107A
gpg: Good signature from <a class="moz-txt-link-rfc2396E" href="mailto:wk@gnupg.org">"wk@gnupg.org"</a> [ultimate]
gpg: aka <a class="moz-txt-link-rfc2396E" href="mailto:werner@eifzilla.de">"werner@eifzilla.de"</a> [ultimate]
gpg: aka <a class="moz-txt-link-rfc2396E" href="mailto:wk@g10code.com">"wk@g10code.com"</a> [ultimate]
gpg: aka <a class="moz-txt-link-rfc2396E" href="mailto:werner.koch@gnupg.com">"werner.koch@gnupg.com"</a> [ultimate]
gpg: asserted signer '8777461F2A074EBC480D359419CC1C9E085B107A'
$ echo $?
0
and here using a non-matching signer:
$ gpg -d --assert-signer E8EC28456EA6CFD7A0B15821C1DBABEF2C2096BB foo
gpg: encrypted with brainpoolP384r1 key, ID 2B999FA9CE046B1B, created 2021-06-28
<a class="moz-txt-link-rfc2396E" href="mailto:wk@gnupg.org">"wk@gnupg.org"</a>
gpg: WARNING: server 'keyboxd' is older than us (2.5.12-beta1 < 2.5.13-beta9)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.
gpg: using "63113AE866587D0A" as default secret key for signing
Today is the first day of the rest of your life.
gpg: Signature made Fri 17 Oct 2025 03:15:13 PM CEST
gpg: using EDDSA key 8777461F2A074EBC480D359419CC1C9E085B107A
gpg: Good signature from <a class="moz-txt-link-rfc2396E" href="mailto:wk@gnupg.org">"wk@gnupg.org"</a> [ultimate]
gpg: aka <a class="moz-txt-link-rfc2396E" href="mailto:werner@eifzilla.de">"werner@eifzilla.de"</a> [ultimate]
gpg: aka <a class="moz-txt-link-rfc2396E" href="mailto:wk@g10code.com">"wk@g10code.com"</a> [ultimate]
gpg: aka <a class="moz-txt-link-rfc2396E" href="mailto:werner.koch@gnupg.com">"werner.koch@gnupg.com"</a> [ultimate]
$ echo $?
1
</pre>
</blockquote>
Note that the above user visible output (not the exit code) pretends
to report success,<br>
which is likely to make direct or scripted human users accept the
wrong signature.<br>
<br>
<br>
<blockquote type="cite" cite="mid:87sefhwsou.fsf@jacob.g10code.de">
<pre wrap="">
To observer more information in a scripted application use --status-fd
for example to check for a DECRYPTION_OKAY line. You would see this line
even if you don't have the siblic key for the signature.
</pre>
</blockquote>
<tt>--status-fd is a particularly horrible interface for shell
scripting use, <br>
as it requires </tt><tt>setting up an additional temporary file
and overly complex <br>
parsing commands to</tt><tt> </tt><tt>distinguish different
outcomes.</tt>
<pre wrap="">
</pre>
<blockquote type="cite" cite="mid:87sefhwsou.fsf@jacob.g10code.de">
<pre wrap="">
--assert-signer is available since 2.4.1
</pre>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
Jakob Bohm, CIO, partner, WiseMo A/S. <a
href="https://www.wisemo.com">https://www.wisemo.com</a><br>
Transformervej 29, 2860 Soborg, Denmark. direct: <a
href="tel:+4531131610">+45 31 13 16 10</a><br>
This message is only for its intended recipient, delete if
misaddressed.<br>
WiseMo - Remote Service Management for PCs, Phones and Embedded
</div>
</body>
</html>