检查GPG / PGP公钥是否有效

Question

Through a web interface I'm trying to check if a given public key is valid or not. The bash command gpg --import key.pub returns import successful/failed based on the given key, but I don't want to use $data = system("/usr/bin/gpg --import $key) for my own security concerns. Is there an alternative?

Answer 1

Ok, I've done a little debugging and this is what I've found:

nginx daemon was running under nginx:nginx , no home dir, nologin shell

When I executed sudo -u nginx php -r "echo system("gpg -k");"

I got /home/nginx/.gnupg: directory does not exist!

So I've executed the following:

mkdir -p /home/nginx/.gnupg; chown -R nginx:nginx /home/nginx/

Then, to test if works:

sudo -u nginx php -r "echo system("gpg --homedir /home/nginx/.gnupg --dry-run --batch --import key.pub");

and I've got output!

Answer 2

Is installing extension an option for you? Because you can use combination of gnupg_import() and gnupg_keyinfo() function from PECL/gnupg extension.

gnupg_keyinfo() returns array of properties and there are various keys which would be useful in this case. see: http://svn.php.net/viewvc/pecl/gnupg/trunk/gnupg.c?revision=330955&view=markup#l662