Detached signature on multiple files?

[Greg Strong (Greg Strong)]

Hello GnuPG,

What configuration is necessary to create detached signature files for
multiple files when they all have the same file extension?

In the GPG FAQ.txt file I believe this is somewhat covered in section
4.14, "How can I use GnuPG in an automated environment?"

So I created a separate option file in GPGShell with another set of key
rings. I have the option set in GPGShell pointing to both the new
public & secret key rings. I removed the password on the only key on
this special key ring just for auto signing.

Now when I run the command "gpg --batch -sb *.doc" from a Win98 DOS box,
gpg doesn't ask for the password, but it only signs 1 of 4 files that
meet the *.doc syntax.

Is GPG capable of signing multiple files with 1 command from a DOS box
in Win98?

If yes, what configuration is necessary?

- --
Best regards,

Greg Strong
TB! v1.62/Beta1 on Windows 98

PGP public keys:
mailto:***@gwstrong.com?subject=0xB1FE63FA&Body=Please20send20keys

[Anthony E. Greene]

Post by Greg Strong (Greg Strong)
Now when I run the command "gpg --batch -sb *.doc" from a Win98 DOS box,
gpg doesn't ask for the password, but it only signs 1 of 4 files that
meet the *.doc syntax.
Is GPG capable of signing multiple files with 1 command from a DOS box
in Win98?

No. You have to run gpg once for each file. You can use a batch file with
a FOR loop. You can do this on the command line in a *nix shell.

for docfile in `ls *.doc`; do gpg --detach-sign $docfile; done

Tony
- --
Anthony E. Greene <mailto:Anthony%20E.%20Greene%20%***@pobox.com%3E>
OpenPGP Key: 0x6C94239D/7B3D BD7D 7D91 1B44 BA26 C484 A42A 60DD 6C94 239D
AOL/Yahoo Messenger: TonyG05 HomePage: <http://www.pobox.com/~agreene/>
Linux. The choice of a GNU generation <http://www.linux.org/>

[Jason Harris]

--0F1p//8PRICkK4MW
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Post by Anthony E. Greene

Post by Greg Strong (Greg Strong)
Now when I run the command "gpg --batch -sb *.doc" from a Win98 DOS box,
gpg doesn't ask for the password, but it only signs 1 of 4 files that
meet the *.doc syntax.
Is GPG capable of signing multiple files with 1 command from a DOS box
in Win98?

=20
No. You have to run gpg once for each file. You can use a batch file with
a FOR loop. You can do this on the command line in a *nix shell.
=20
for docfile in `ls *.doc`; do gpg --detach-sign $docfile; done

I wrote a Perl script (for Unix) to verify and sign pages on my website.
Beware that it doesn't lock memory pages to keep the passphrase from
being swapped to disk.

Find the signature here:

http://jharris.cjb.net/code/check-sigs-and-sign.asc

--=20
Jason Harris | NIC: JH329, PGP: This _is_ PGP-signed, isn't it?
***@widomaker.com | web: http://jharris.cjb.net/

--0F1p//8PRICkK4MW
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)

iD8DBQE9VptySypIl9OdoOMRAnoiAJ9aEdPPrKaHA9EQP9xjyBoodmAG0ACfUMqV
lH+XuNotPK+7bep1D22Qge8=
=vgIq
-----END PGP SIGNATURE-----

--0F1p//8PRICkK4MW--

[Greg Strong (Greg Strong)]

Hello Anthony,

On Sun, 11 Aug 2002, at 12:24:30 [GMT -0400] your time you wrote in
<mid:***@cp5340>:


AEG> No. You have to run gpg once for each file. You can use a batch
AEG> file with a FOR loop. You can do this on the command line in a *nix
AEG> shell.

AEG> for docfile in `ls *.doc`; do gpg --detach-sign $docfile; done

Thanks! I have no Unix box so that leaves me SOL.

- --
Best regards,

Greg Strong
TB! v1.62/Beta1 on Windows 98

PGP public keys:
mailto:***@gwstrong.com?subject=0xB1FE63FA&Body=Please20send20keys

[David Shaw]

Post by Greg Strong (Greg Strong)
Hello Anthony,
On Sun, 11 Aug 2002, at 12:24:30 [GMT -0400] your time you wrote in
AEG> No. You have to run gpg once for each file. You can use a batch
AEG> file with a FOR loop. You can do this on the command line in a *nix
AEG> shell.
AEG> for docfile in `ls *.doc`; do gpg --detach-sign $docfile; done
Thanks! I have no Unix box so that leaves me SOL.

GnuPG can do multiple detached signatures without any shell magic.

gpg -b *.doc

I don't have a windows box in front of me, but it should work the same
way there. I believe the problem you were having was using "-sb" to
sign, and not just plain "-b".

David

[Greg Strong (Greg Strong)]

Hello David,

On Wed, 14 Aug 2002, at 17:11:29 [GMT -0400] your time you wrote in
<mid:***@akamai.com>:


DS> nuPG can do multiple detached signatures without any shell magic.

DS> gpg -b *.doc

DS> I don't have a windows box in front of me, but it should work the
DS> same way there. I believe the problem you were having was using
DS> "-sb" to sign, and not just plain "-b".

What I did was create a separate public & secret key ring. In GPGShell I
created a separate options file which points the new key rings. I
imported the public & secret key I wanted to use to sign multiple files
into the new public public & secret key rings. I then removed the
password completely. For good measure I save the GnuPG preferences in
GPGkeys, then I exited GPGtray & GPGkeys of GPGshell. I started GPGtray
& GPGkeys again. I opened up a DOS box on Win98. I changed directories
to where the multiple files are located to which I want signatures for
each *.doc file. I ran the command:

gpg -b *.doc

Of the 5 doc files only the last was signed with the above command. So
do you see anything wrong with what I did that prevented multiple
signatures?

- --
Best regards,

Greg Strong
TB! v1.62/Beta1 on Windows 98

PGP public keys:
mailto:***@gwstrong.com?subject=0xB1FE63FA&Body=Please20send20keys

[David Shaw]

Post by Greg Strong (Greg Strong)
DS> I don't have a windows box in front of me, but it should work the
DS> same way there. I believe the problem you were having was using
DS> "-sb" to sign, and not just plain "-b".
What I did was create a separate public & secret key ring. In GPGShell I
created a separate options file which points the new key rings. I
imported the public & secret key I wanted to use to sign multiple files
into the new public public & secret key rings. I then removed the
password completely. For good measure I save the GnuPG preferences in
GPGkeys, then I exited GPGtray & GPGkeys of GPGshell. I started GPGtray
& GPGkeys again. I opened up a DOS box on Win98. I changed directories
to where the multiple files are located to which I want signatures for
gpg -b *.doc
Of the 5 doc files only the last was signed with the above command. So
do you see anything wrong with what I did that prevented multiple
signatures?

I'm sorry - I misremembered what multiple files for -b does. Now that
I look at it again, this will not work. When you specify -b with
multiple files, you are actually signing all the files together
(i.e. "gpg -b a b c" signs a concatenated with b concatenated with c).

David

[Greg Strong (Greg Strong)]

Hello David,

On Wed, 14 Aug 2002, at 20:59:13 [GMT -0400] your time you wrote in
<mid:***@akamai.com>:


DS> I'm sorry - I misremembered what multiple files for -b does. Now
DS> that I look at it again, this will not work.

Don't be sorry. I learned that it can't be done on a Windows PC.
Learning is good for me.

- --
Best regards,

Greg Strong
TB! v1.62/Beta1 on Windows 98

PGP public keys:
mailto:***@gwstrong.com?subject=0xB1FE63FA&Body=Please20send20keys

[Ryan Malayter]

Post by Greg Strong (Greg Strong)
Thanks! I have no Unix box so that leaves me SOL.

Not hardly... The equivalent Windows NT/2000 syntax would be:

FOR %f IN (*.doc) DO gpg --detach-sign %f

Of course, you might want to pass your passphrase automatically to gpg
using a pipe, like so:
FOR %f IN (*.txt) DO echo passphrase|gpg --passphrase-fd 0
--detach-sign %f

This works when typed directly on the command line, but for some reason,
you have you use double for percent signs in front of the variable name
in a windows batch file.

[Greg Strong (Greg Strong)]

Hello Ryan,

On Thu, 15 Aug 2002, at 10:36:52 [GMT -0500] your time you wrote in
<mid:***@mail.bai.org>:


RM> Not hardly... The equivalent Windows NT/2000 syntax would be:

RM> FOR %f IN (*.doc) DO gpg --detach-sign %f

This works but asks for passphrase each time.

When I export both public & secret key to another public & secret key
ring. I also remove the passphrase on the key. I then create a new
option file for GPGshell which points to new public & secret key rings,
then select the new option file, the above command works fine (i.e.
signs multiple files).

RM> Of course, you might want to pass your passphrase automatically to
RM> gpg using a pipe, like so: FOR %f IN (*.txt) DO echo
^^^
should be doc?
RM> passphrase|gpg --passphrase-fd 0 --detach-sign %f

This would be nice because I wouldn't have to remove passphrase & create
separate key rings. The command never asked for my passphrase. When
using a pipe doesn't the program have to ask for passphrase once. I am
on Win98, so is this command compatible with Win98? If no and on Win2k
wouldn't I still have to provide passphrase at least once?

RM> This works when typed directly on the command line, but for some
RM> reason, you have you use double for percent signs in front of the
RM> variable name in a windows batch file.

No problem but I need to get working on command line first. According to
gpg.man file:


--passphrase-fd n
Read the passphrase from file descriptor n. If
you use 0 for n, the passphrase will be read
from stdin. This can only be used if only
one passphrase is supplied. Don't use this
option if you can avoid it.

I am no programmer but do enjoy learning, so my question is what is
stdin? Is this some temporary file on Win2k or NT machine where the
passphrase is stored?

TIA!

- --
Best regards,

Greg Strong
TB! v1.62/Beta1 on Windows 98

PGP public keys:
mailto:***@gwstrong.com?subject=0xB1FE63FA&Body=Please20send20keys

[Ryan Malayter]

This would be nice because I wouldn't have to remove=20
passphrase & create separate key rings. The command
never asked for my passphrase. When using a pipe doesn't=20
the program have to ask for passphrase once. I am on=20
Win98, so is this command compatible with Win98? If no=20
and on Win2k wouldn't I still have to provide passphrase=20
at least once?

I believe the FOR command works in the Win9x command interpreter as
well, but I don't remember for sure. I've been using almost
exclusively NT/2000/XP since 1996 - much more stable. The problem
with providing the passphrase via pipe is that it is plainly visible
on screen when you type it on the command line.=20
It would probably be best to set this up as a batch file that takes
the passphrase as a parameter, and then puts it into the FOR command.
Or, better yet, write a Windows Scripting Host file (wither VBscript
or Jscript) that reads the user password in a secure fashion; windows
scripting is not too difficult a thing to pick up.

I am no programmer but do enjoy learning, so my question=20
is what is stdin? Is this some temporary file on Win2k or=20
NT machine where the passphrase is stored?

This is a feature that shows the UNIX & CP/M roots of the DOS
command
shell (although there is no DOS in Windows NT/2000/XP, the command
interface is very similar). Stdin is "standard input", the primary
means of user interaction, usually the keyboard. There is also
stdout, which is usually the console, and stderr, which is also
usually the console. However, any of these can be redirected to
something else, like files or even other programs. This is what the
pipe (|) operator does in the command line I gave you: it makes the
output of "echo" the standard in (i.e. keyboard) for gpg; which is
looking for the passphrase on its stdin.=20

As another example, the > operator on the command line makes stdout
a
file. Try:
echo "Howdy partner" > howdy.txt
And look at the resulting file.

HTH,
:::Ryan Malayter
:::Sr. Network & Database Administrator
:::Bank Administration Institute
:::Chicago, Illinois, USA
:::PGP Key: http://www.malayter.com/pgp-public.txt

[Greg Strong (Greg Strong)]

Hello Ryan,

On Thu, 15 Aug 2002, at 14:30:53 [GMT -0500] your time you wrote in
<mid:***@mail.bai.org>:


RM> I believe the FOR command works in the Win9x command interpreter as
RM> well, but I don't remember for sure. I've been using almost
RM> exclusively NT/2000/XP since 1996 - much more stable.

I checked the DOS 5.0 manual and the FOR command is in it. I would
imagine the FOR command works in Win98. It has to because the 1st
command line you gave worked. It has to do with this part:

echo passphrase|gpg --passphrase-fd 0 --detach-sign %f


When I type the full command in the output in Win98 DOS box is the
following:

D:\Email02>echo PASSPHRASE
PASSPHRASE

It appears gpg is NOT running. It is simply echoing the word
"PASSPHRASE" in the command. I think it has to do with how we are trying
to capture the password with the "echo" command.


So I tried the following command:

FOR %f IN (*.doc) DO gpg --passphrase-fd 0 --detach-sign %f

Now the passphrase is not asked for but gpg is looking for it in the
file descriptor 0. See output below:

D:\Email02>gpg --passphrase-fd 0 --detach-sign MON106.DOC
gpg: NOTE: THIS IS A DEVELOPMENT VERSION!
gpg: It is only intended for test purposes and should NOT be
gpg: used in a production environment or with production keys!
Reading passphrase from file descriptor 0 ...

It is doing this for every *.doc file in the directory. So what command
has to be included so that gpg asks and stores the password in file
descriptor 0 for the subsequent files.

RM> The problem with providing the passphrase via pipe is that it is
RM> plainly visible on screen when you type it on the command line. It
RM> would probably be best to set this up as a batch file that takes the
RM> passphrase as a parameter, and then puts it into the FOR command.
RM> Or, better yet, write a Windows Scripting Host file (wither VBscript
RM> or Jscript) that reads the user password in a secure fashion;
RM> windows scripting is not too difficult a thing to pick up.

I like to do things in steps. Obviously there is a problem, but what.
When attempting to figure out I think about section 4.14, "How can I use
GnuPG in an automated environment" in the GPG FAQ.txt file. I already
have multiple signing with your 1st command looking at separate key
rings with no password on the key. So this all maybe a mute point.

I am no programmer but do enjoy learning, so my question is what is
stdin? Is this some temporary file on Win2k or NT machine where the
passphrase is stored?

RM> This is a feature that shows the UNIX & CP/M roots of the DOS
RM> command shell (although there is no DOS in Windows NT/2000/XP, the
RM> command interface is very similar). Stdin is "standard input", the
RM> primary means of user interaction, usually the keyboard. There is
RM> also stdout, which is usually the console, and stderr, which is also
RM> usually the console. However, any of these can be redirected to
RM> something else, like files or even other programs. This is what the
RM> pipe (|) operator does in the command line I gave you: it makes the
RM> output of "echo" the standard in (i.e. keyboard) for gpg; which is
RM> looking for the passphrase on its stdin.

Thanks, good to know.

RM> As another example, the > operator on the command line makes stdout
RM> a file. Try: echo "Howdy partner" > howdy.txt And look at the
RM> resulting file.

I've used the > operator to re-direct to a text file in the past.

Thanks for the help.

- --
Best regards,

Greg Strong
TB! v1.62/Beta1 on Windows 98

PGP public keys:
mailto:***@gwstrong.com?subject=0xB1FE63FA&Body=Please20send20keys

[Mark H. Wood]

FOR has been around in Microsoft OSes for a long time, but bear in mind
that COMMAND.COM (DOS, Win/DOS) and CMD.EXE (NT) are different command
interpreters. There's a lot of stuff in CMD that's missing or different
in COMMAND. So stuff that works on NT may not work on Win9x/ME.

NT had that Posix subsystem, ya know, so there was some incentive for the
NT team to make CMD behave as Posix fans would expect. The Win/DOS team
had no such incentive and was probably much more concerned with lingering
codesize constraints.

[Greg Strong (Greg Strong)]

Hello Mark,

On Fri, 16 Aug 2002, at 08:48:00 [GMT -0500 (EST)] your time you wrote
in <mid:Pine.LNX.4.33.0208160840500.13457-***@mhw.ULib.IUPUI.Edu>:


MHW> FOR has been around in Microsoft OSes for a long time, but bear in
MHW> mind that COMMAND.COM (DOS, Win/DOS) and CMD.EXE (NT) are different
MHW> command interpreters. There's a lot of stuff in CMD that's missing
MHW> or different in COMMAND. So stuff that works on NT may not work on
MHW> Win9x/ME.

Unless I've made a mistake with Ryan's 2nd command line syntax
suggestion, it is starting to look like it does NOT work on Win98. With
Ryan's 1st command line syntax with section 4.14 suggestion in the GPG
FAQ.txt file I can create multiple detached signature files with one
command.

Thanks for the info from both you and Ryan.

- --
Best regards,

Greg Strong
TB! v1.62/Beta1 on Windows 98

PGP public keys:
mailto:***@gwstrong.com?subject=0xB1FE63FA&Body=Please20send20keys

[Greg Strong (Greg Strong)]

Hello Erik,

On Fri, 16 Aug 2002, at 12:04:48 [GMT -0400] your time you wrote in
<mid:***@mochamail.com>:


E> I was able to make it work with the following commandline:

E> FOR %%f IN (*.txt) DO gpg --passphrase-fd 0 < pasphrase.txt
E> --detach-sign %%f (passphrase is read from 'passphrase.txt')

Thanks it works. I should mention 3 issues for others who are
interested.

1) Save passphrase in a file name less than or equal to 8 characters
because on Win98 in DOS box the tilde (~) will be used to truncate
the name of the file to 8 characters. In other words if I saved my
passphrase to "pasphrase.txt" which is 9 characters long, then in a
DOS box it must be entered as "PASPHR~1.TXT".

2) When creating detached signature files with GnuPG from the command
line the syntax of the file name for the detached signature file is
different than when created with GPGtools of GPGshell. For example
the original file name to create a detached signature is "test.doc"
with GPGtools the detached signature file's name is "test.doc.sig"
whereas from the command line it is "test.sig"

3) Do a secure wipe of the file which your passphrase was stored. I use
Eraser which has Gutmann or US DOD wipe options available. Obviously
this is of concern where your PC is not secure. Others on the list
I'm sure have other thoughts about security on a Windows machine, but
that is a discussion I don't want to even get into.

Thanks again for the help Erik.

- --
Best regards,

Greg Strong
TB! v1.62/Beta1 on Windows 98

PGP public keys:
mailto:***@gwstrong.com?subject=0xB1FE63FA&Body=Please20send20keys