search

rpgp / rpgp

OpenPGP implemented in pure Rust, permissively licensed
https://docs.rs/pgp
Apache License 2.0
716 stars 76 forks source link

Signing file and include signature #251

Open floers opened 9 months ago

floers commented 9 months ago

Hello,

I want to sign a PDF file with rpgp as I would do it via gpg --clearsign --output signed.pdf test.pdf. I looked into the tests and tried it already but only came up with concatenating the required parts (signed message header, pdf content, signature) and writing them to the file. Unfortunately the result is not valid.

Thanks for your help.

hko-s commented 5 months ago

Cleartext signatures are a mechanism that applies to text files (see https://openpgp.dev/book/signing_data.html#cleartext-signatures for some details). I don't think they can be used with a pdf?

Maybe a detached signature is what you want? (A detached signature is a small file that can be stored separately of the pdf file, and be used to verify the integrity of the pdf)

wiktor-k commented 3 months ago

They might have been thinking about inline signatures (gpg --sign) that have the signed data and the signature in the same output file.

As you've said clearsigned binary files are not really a thing (although I guess technically it's possible to create them).

dignifiedquire commented 3 months ago

you can use either StandaloneSignature or the cleartext construction in #328