I'd like to introduce a new #foss project: Open PGP Signature Verification or OPSV.
This eliminates the need to rely on #keybase verify function and, therefore, keybase at all.
Website: https://opsv.foss.guru/
Code on @codeberg: https://codeberg.org/yarmo/opsv
Public stats by #plausible: https://plausible.io/opsv.foss.guru
Time to #DeleteKeybase once and for all
So this works (gpg --armor --clear-sign):
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
test
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQRve2u5qbYyVV4aA8Eyrx85xO4D8gUCXuvw0wAKCRAyrx85xO4D
8opLAQDK5Spug8MTQuocZj0PUllamGtcdLzd72xraeg5IfnVngD9H8eXUfSjkTB4
0hHQUL6+tZruzw18gStuMMLNoE2utAY=
=6NcD
-----END PGP SIGNATURE-----
@yarmo But this doesn't (gpg --armor --sign) but this is just the same signature, just with the plaintext signed message embedded inside
-----BEGIN PGP MESSAGE-----
owGbwMvMwCVmtF7e8sg75k+Mp7mTGOJef/hcklpcwtVRysIgxsUgK6bIkl+dvXPl
NqPQOCnmgzDFrExAlV8YuDgFYCKurAz/zF6LH1nDe+vk+mVn73LdD5PSkT3+ZMsz
qU9qPPLT0uQdTzP8L1u4re2G9bojezsZZVb9bdw4e73DyfvNV6zu3JNdO80+lAsA
=+VXF
-----END PGP MESSAGE-----
Error: No cleartext signed message.
@kravietz thanks! I bet there's an option somewhere to enable that, will look into!
@kravietz Fixed it! Both types of inputs are supported and correctly verified! I guess I need to extract the embedded message now!
@kravietz is it even possible to extract the text? Does it need a private key to decrypt the message first?
No, this PGP MESSAGE is just a wrapper for OpenPGP packets and in this case the packets only contain signed (but not encrypted) content.
@kravietz "Error: Error during parsing. This message / key probably does not conform to a valid OpenPGP format." 🤔
Correct, it was! 👍 That's great service and I'm definitely including into my standard "tools for regular humans" pack 😀
@kravietz it can now also detect userId and keyId making it a truly one-click service (no input of public key needed). Of course, in the case of keyId alone, the website urges you to find another of verifying the keyId or fingerprint to confirm authenticity of signer.
@yarmo WKD works brilliantly 👍 I have just noticed one possible inconsistency as the WKD validator doesn't seem to be trying the "advanced method" first which seems to be a requirement by the draft...
@kravietz ow, nice catch! I'm using the openpgp.js library which falls back to web crypto api if supported.
Can you check if you use the fallback?
https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API
If not, I'll have to open an issue with the main devs. Thanks for letting me know!
@kravietz as opposed to detached signatures? I've yet to implement it, it's a minor tweak, just gotta do it.
Or did you mean something else?