# gnupg_verify help needed

- Thread: https://externals.io/message/74900
- Original archive: https://news-web.php.net/php.internals/74900
- Started by Tsvetan Nikolov on 2014-06-14T12:08:17+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #74900 — Tsvetan Nikolov — 2014-06-14T12:08:17+00:00

URL: https://externals.io/message/74900#74900

Hi PHPers,

I've been fighting with gnupg_verify for days now and cannot understand how
it works. It returns an array in the form of:

array ( 0 => array ( 'fingerprint' => 'BLABLABLA' 'validity' => 0
'timestamp' => 1402666925 'status' => 117440521 'summary' => 128 ) )

I don't understand which part of the array actually shows us that the
verification went well. Do I have to compare the fingerprint or the status
is enough. But then I get different statuses and don't know what they all
mean. Same with summary. On other occasions I get different unexplainable
results like status=>0 validity=>4. There is no documentation on what each
of these means.

Thanks for you help!

Regards,
Tsvetan

---

## #74907 — Christoph Becker — 2014-06-14T15:45:25+00:00

URL: https://externals.io/message/74900#74907 · In reply to: #74900

Tsvetan Nikolov wrote:

> I've been fighting with gnupg_verify for days now and cannot understand how
> it works. It returns an array in the form of:
> 
> array ( 0 => array ( 'fingerprint' => 'BLABLABLA' 'validity' => 0
> 'timestamp' => 1402666925 'status' => 117440521 'summary' => 128 ) )
> 
> I don't understand which part of the array actually shows us that the
> verification went well. Do I have to compare the fingerprint or the status
> is enough. But then I get different statuses and don't know what they all
> mean. Same with summary. On other occasions I get different unexplainable
> results like status=>0 validity=>4. There is no documentation on what each
> of these means.

According to <http://www.php.net/manual/en/function.gnupg-verify.php>:

| Verifies the given signed_text and returns information about the
| signature.
| ...
| On success, this function returns information about the signature. On
| failure, this function returns FALSE.

So for basic verification it should suffice to check that the return
value !== false.

[xpost & fup2 php-general@lists.php.net]

-- 
Christoph M. Becker

---

## #74916 — Tsvetan Nikolov — 2014-06-14T18:23:49+00:00

URL: https://externals.io/message/74900#74916 · In reply to: #74907

Thanks Christoph,

This is not sufficient. It returns false only if I enter some random
string. If I try to verify signed text with random signature then it always
returns an array with some data, which in my case doesn't work because I
would like to varify that the text is signed with specific signature and
not with any signature. That's the point of gpg! In this case php returns
array irrespective of which signature is used to sign the text.

Thanks,
Tsvetan




> Tsvetan Nikolov wrote:
>
> > […]
> how
> > […]
> status
> > […]
> each
> > […]
>
> According to <http://www.php.net/manual/en/function.gnupg-verify.php>:
>
> | Verifies the given signed_text and returns information about the
> | signature.
> | ...
> | On success, this function returns information about the signature. On
> | failure, this function returns FALSE.
>
> So for basic verification it should suffice to check that the return
> value !== false.
>
> [xpost & fup2 php-general@lists.php.net]
>
> --
> Christoph M. Becker