5

Has anyone written any tutorials or have any documentation on how to use GnuPGME so I would be able to write a function such as gpgSign(std::string fileToBeSigned, std::string outPutFileName) in C++?

2
  • The library itself is written in C which means that you could use it within C++ without much effort. You should just read about using c libraries with c++.
    – v01d
    Mar 7, 2012 at 9:29
  • I'm a aware that I could use the C library but I'm completely lost on where to look to even get close to writing a function.
    – allejo
    Mar 18, 2012 at 20:10

2 Answers 2

5

Below is a C example with verbose comments that does what you are looking for - it is not the most direct approach, but should illustrate the how to accomplish signing a file. It does not handle selection of signers, but the GPGME docs should help you there.

You can save the file and make edits and test directly from the command line. To compile, just save as "gpgsign.c", and execute gcc gpgsign.c -lgpgme -o gpgsign (NOTE: you must have libgpgme installed). Then you can execute the using gpgsign <input file> <output file>

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <stdlib.h>
#include <errno.h>
#include <locale.h>

#include <gpgme.h>

#define fail_if_err(err)                                    \
    do {                                                    \
        if (err) {                                          \
            fprintf (stderr, "%s:%d: %s: %s\n",             \
                __FILE__, __LINE__, gpgme_strsource (err),  \
                gpgme_strerror (err));                      \
            exit (1);                                       \
        }                                                   \
    }                                                       \
    while (0)

void gpgSign(const char *fileToBeSigned, const char *outputFileName) {
    gpgme_ctx_t ctx;
    gpgme_error_t err;
    gpgme_data_t in, out;
    FILE *outputFile;
    int BUF_SIZE = 512;
    char buf[BUF_SIZE + 1];
    int ret;
    /* Set the GPGME signature mode
        GPGME_SIG_MODE_NORMAL : Signature with data
        GPGME_SIG_MODE_CLEAR  : Clear signed text
        GPGME_SIG_MODE_DETACH : Detached signature */
    gpgme_sig_mode_t sigMode = GPGME_SIG_MODE_CLEAR;

    /* Begin setup of GPGME */
    gpgme_check_version (NULL);
    setlocale (LC_ALL, "");
    gpgme_set_locale (NULL, LC_CTYPE, setlocale (LC_CTYPE, NULL));
#ifndef HAVE_W32_SYSTEM
    gpgme_set_locale (NULL, LC_MESSAGES, setlocale (LC_MESSAGES, NULL));
#endif
    /* End setup of GPGME */

    // Create the GPGME Context
    err = gpgme_new (&ctx);
    // Error handling
    fail_if_err (err);

    // Set the context to textmode
    gpgme_set_textmode (ctx, 1);
    // Enable ASCII armor on the context
    gpgme_set_armor (ctx, 1);

    // Create a data object pointing to the input file
    err = gpgme_data_new_from_file (&in, fileToBeSigned, 1);
    // Error handling
    fail_if_err (err);

    // Create a data object pointing to the out buffer
    err = gpgme_data_new (&out);
    // Error handling
    fail_if_err (err);

    // Sign the contents of "in" using the defined mode and place it into "out"
    err = gpgme_op_sign (ctx, in, out, sigMode);
    // Error handling
    fail_if_err (err);

    // Open the output file
    outputFile = fopen (outputFileName, "w+");

    // Rewind the "out" data object
    ret = gpgme_data_seek (out, 0, SEEK_SET);
    // Error handling
    if (ret)
        fail_if_err (gpgme_err_code_from_errno (errno));

    // Read the contents of "out" and place it into buf
    while ((ret = gpgme_data_read (out, buf, BUF_SIZE)) > 0) {
        // Write the contents of "buf" to "outputFile"
        fwrite (buf, ret, 1, outputFile);
    }

    // Error handling
    if (ret < 0)
        fail_if_err (gpgme_err_code_from_errno (errno));

    // Close "outputFile"
    fclose(outputFile);
    // Release the "in" data object
    gpgme_data_release (in);
    // Release the "out" data object
    gpgme_data_release (out);
    // Release the context
    gpgme_release (ctx);
}

int 
main (int argc, char **argv) {
    if (argc != 3) {
        printf("Usage: gpgsign <input file> <output file>\n");
        exit (1);
    }
    printf("Signing %s and placing the result into %s\n", argv[1], argv[2]);
    gpgSign(argv[1], argv[2]);
    return 0;
}
3
  • The parameters of the last printf should be argv[1] and argv[2], not 0 and 1.
    – Diti
    May 7, 2014 at 22:16
  • @Diti Fixed. Good catch.
    – kylehuff
    May 8, 2014 at 21:48
  • Can you also add verification of the signature? Mar 17, 2017 at 8:56
5

This answer probably comes too late, but if I were you I'd rather use Keyczar which is a high-level crypto toolkit with a simple API. Java, C++, Python bindings are available.

GPGME is still quite low-level IMO for someone who needs crypto functionality without too much tweaking. Of course a crypto expert needs this type of complexity.

Personally, I try to avoid libraries that require me to set up this engine and that context in 100 lines of boilerplate code before I can do something basic... but I am no expert at anything.

4
  • Someone downvoted my answer without giving any reasons. I wonder why: Keyczar fits the requirements originally asked for well. My other point still stands: most of us need simple high-level crypto APIs. All of us appreciate the work of those experts who create the low-level APIs, and I am indebted to kylehuff for having explained all the low-level steps above. But there should be a function gpgSign(const std::string& fileToBeSigned, const std::string& outPutFileName) for the rest of us. Nov 26, 2013 at 11:06
  • 1
    I don't understand why people keep downvoting this answer. I would really appreciate a comment explaining what is wrong with what I wrote. See my comment above for some clarifications. Thanks. Apr 20, 2014 at 17:59
  • If I had to guess, I'd say it is because your answer does not speak to the question asked. The question asked was specifically about GnuPG GPGME, not a request for alternatives. That is not to say your answer (and related points) do not have merit; just that they are not applicable to the question asked.
    – kylehuff
    May 8, 2014 at 21:58
  • 1
    I know I'm digging up a grave here, but I felt the need to atleast add to this answer. I prefer this answer, since using a proven higher level crypto library (like with most high-level libraries) keeps you from reinventing the wheel. This also means a developer won't need to rewrite a lot of the same code pertaining to encryption setup, which might create security holes when it's done manually.
    – Joep_H
    May 12, 2014 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.