in reply to extracting original from gpg clearsigned file

Is this tar file from an email or something? Is it MIME::Base64 encoded, or encoded by another method, or is it binary?

PGP/GPG signed files should not modify the information between the 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[download]
and 
-----BEGIN PGP SIGNATURE-----

[download]

tags, the only thing I've noticed is a munging of the .signature delimiter -- to - --.

Sorry if I'm stating the obvious with this, but one thing that's just struck me, crazy though it is: you're not trying to get a file from something like 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)

iD8dBQE8Rg1UOcb+EPeM7ggRApQSAJ0dqFfLKZ5QkRUAHJFZHcjJ5dV2-QCeOPEH
ybtpRe\\KLR7bCdt0YOtcnk=
=dugR
-----END PGP SIGNATURE-----

[download]

Are you?

That's only a signature which is sometimes distributed as another file - for example the linux kernel tarball has a kernel-2.x.x.tar.gz.sign file associated with it, which contains the PGP signature for the kernel tarball.

You use that file with PGP/GPG to check that the (in this example) kernel tarball hasn't been changed - similar to checking an md5sum - the tarball isn't part of that GPG signature!
All the signature tells you is which key/who signed it, and gives some checksum information for the file you should check it against.

Cheers

BazB.

Replies are listed 'Best First'.
Re: Re: extracting original from gpg clearsigned file
by jmarans (Novice) on Jan 17, 2002 at 21:09 UTC
    The original tarfile is created on a linux box using
    tar on a group of files that are variously text, and
    gzip'd binary. It really is just a regular tar file.

    I then do a gpg --clearsign <filename> and get a
    filename.asc as output.

    I thought the --clearsign option would only sandwich the
    file between 2 text strings, but that looks like a
    non-starter. Even turning off compression, -z 0,
    doesn't seem to do it. So I've gone back to trying
    to get GnuPG::Interface to decrypt a .gpg signed file
    output by gpg --sign <filename>.

    There's something about GnuPG::Interface I'm not
    getting ...
[reply]

In Section Seekers of Perl Wisdom