GNOME Bugzilla – Bug 635152
gpg verification should not write signature to the filesystem
Last modified: 2010-11-19 16:48:45 UTC
I think it would generally be better if GMime avoided writing mime parts (including OpenPGP signatures) to disk. It turns out you can send the signature to gpg via a piped file descriptor the same way that you send the message body itself, using the --enable-special-filenames flag to gpg: http://lists.gnupg.org/pipermail/gnupg-users/2010-November/039866.html
Ah, thanks for this useful info! I completely agree that writing to the fs sucks big time and I'd like to avoid doing it too!
hmmm, unfortunately I can't get this to work :-( gpg: invalid option "-&4" my command-line is: gpg --verbose --no-secmem-warning --no-greeting --no-tty --batch --yes --charset=UTF-8 --status-fd=10 --keyserver-options no-auto-key-retrieve --enable-special-filenames --verify -&4 -&11 since I'm not subscribed to the gpg list, can you ask some follow-up questions? - which versions of gpg support this? (I'm on 2.0.15) - is there a special order needed for the content / signature fds? e.g. does the content-fd have to come before the signature-fd? or is it the other way around? - is there a special order of command-line args? e.g. does it matter where --batch is placed? or where --enable-special-filenames is placed? etc. Just trying to understand why this command is not working for me. thanks
whoops, i'm having the same problem you are (i'm using gpg 1.4.11). i've asked for clarification on the list, and i'll follow up here if i get it. Thanks for your responsiveness here, Jeffrey.
After i followed up in that thread, Werner wrote: > The usual options vs. file name problem. Add the option stopper: > > gpg --enable-special-filenames --verify \ > --batch -- '-&4' '-&3' 3<test 4<test.asc so "--" is the magic string. i couldn't find any order of the option arguments that didn't work. and the order of the non-option arguments for --verify is fixed: it is signature first, data second.
fixed in both branches, thanks!