124 lines
4.3 KiB
Plaintext
124 lines
4.3 KiB
Plaintext
GPGME - GnuPG Made Easy
|
|
---------------------------
|
|
|
|
Copyright 2001-2016 g10 Code GmbH
|
|
|
|
This file is free software; as a special exception the author gives
|
|
unlimited permission to copy and/or distribute it, with or without
|
|
modifications, as long as this notice is preserved.
|
|
|
|
This file is distributed in the hope that it will be useful, but
|
|
WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
|
|
implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
PURPOSE.
|
|
|
|
|
|
Introduction
|
|
--------------
|
|
|
|
GnuPG Made Easy (GPGME) is a C language library that allows to add
|
|
support for cryptography to a program. It is designed to make access
|
|
to public key crypto engines like GnuPG or GpgSM easier for
|
|
applications. GPGME provides a high-level crypto API for encryption,
|
|
decryption, signing, signature verification and key management.
|
|
|
|
GPGME comes with language bindings for Common Lisp, C++, QT, Python2
|
|
and Python 3.
|
|
|
|
GPGME uses GnuPG and GpgSM as its backends to support OpenPGP and the
|
|
Cryptographic Message Syntax (CMS).
|
|
|
|
See the files COPYING, COPYING.LESSER, and each file for copyright and
|
|
warranty information. The file AUTHORS has a list of authors and
|
|
useful web and mail addresses.
|
|
|
|
|
|
Installation
|
|
--------------
|
|
|
|
See the file INSTALL for generic installation instructions.
|
|
|
|
Check that you have unmodified sources. See below on how to do this.
|
|
Don't skip it - this is an important step!
|
|
|
|
To build GPGME, you need to install libgpg-error (>= 1.11) and
|
|
Libassuan (>= 2.0.2).
|
|
|
|
For support of the OpenPGP protocol (default), you should use the
|
|
latest version of GnuPG (>= 1.4) , available at:
|
|
ftp://ftp.gnupg.org/gcrypt/gnupg/. For support of the CMS
|
|
(Cryptographic Message Syntax) protocol and lot of other features, you
|
|
need a GnuPG version >= 2.0.
|
|
|
|
For building the GIT version of GPGME please see the file README.GIT
|
|
for more information.
|
|
|
|
|
|
How to Verify the Source
|
|
--------------------------
|
|
|
|
In order to check that the version of GPGME which you are going to
|
|
install is an original and unmodified one, you can do it in one of the
|
|
following ways:
|
|
|
|
a) If you have a trusted Version of GnuPG installed, you can simply check
|
|
the supplied signature:
|
|
|
|
$ gpg --verify gpgme-x.y.z.tar.gz.sig
|
|
|
|
This checks that the detached signature gpgme-x.y.z.tar.gz.sig is
|
|
indeed a a signature of gpgme-x.y.z.tar.gz. The key used to create
|
|
this signature is either of:
|
|
|
|
2048R/4F25E3B6 2011-01-12 [expires: 2019-12-31]
|
|
Key fingerprint = D869 2123 C406 5DEA 5E0F 3AB5 249B 39D2 4F25 E3B6
|
|
Werner Koch (dist sig)
|
|
|
|
rsa2048/E0856959 2014-10-29 [expires: 2019-12-31]
|
|
Key fingerprint = 46CC 7308 65BB 5C78 EBAB ADCF 0437 6F3E E085 6959
|
|
David Shaw (GnuPG Release Signing Key) <dshaw 'at' jabberwocky.com>
|
|
|
|
rsa2048/33BD3F06 2014-10-29 [expires: 2016-10-28]
|
|
Key fingerprint = 031E C253 6E58 0D8E A286 A9F2 2071 B08A 33BD 3F06
|
|
NIIBE Yutaka (GnuPG Release Key) <gniibe 'at' fsij.org>
|
|
|
|
rsa2048/7EFD60D9 2014-10-19 [expires: 2020-12-31]
|
|
Key fingerprint = D238 EA65 D64C 67ED 4C30 73F2 8A86 1B1C 7EFD 60D9
|
|
Werner Koch (Release Signing Key)
|
|
|
|
You may retrieve these files from the keyservers using this command
|
|
|
|
gpg --recv-keys 249B39D24F25E3B6 04376F3EE0856959 \
|
|
2071B08A33BD3F06 8A861B1C7EFD60D9
|
|
|
|
The keys are also available at https://gnupg.org/signature_key.html
|
|
and in released GnuPG tarballs in the file g10/distsigkey.gpg .
|
|
You have to make sure that these are really the desired keys and
|
|
not faked one. You should do this by comparing the fingerprints
|
|
with the fingerprints published elsewhere.
|
|
|
|
b) If you don't have any of the above programs, you have to verify
|
|
the SHA1 checksum:
|
|
|
|
$ sha1sum gpgme-x.y.z.tar.gz
|
|
|
|
This should yield an output _similar_ to this:
|
|
|
|
fd9351b26b3189c1d577f0970f9dcadc3412def1 gpgme-x.y.z.tar.gz
|
|
|
|
Now check that this checksum is _exactly_ the same as the one
|
|
published via the announcement list and probably via Usenet.
|
|
|
|
|
|
Documentation
|
|
---------------
|
|
|
|
For information how to use the library you can read the info manual,
|
|
which is also a reference book, in the doc/ directory. The programs
|
|
in the tests/ directory may also prove useful.
|
|
|
|
Please subscribe to the gnupg-devel@gnupg.org mailing list if you want
|
|
to do serious work.
|
|
|
|
For hacking on GPGME, please have a look at doc/HACKING.
|