How to verify PGP signed emails via PHP (-extension)?

I am trying to verify a GnuPG signed email (https://gpgtools.org/) with the PHP GnuPG extension (http://php.net/manual/en/book.gnupg.php).

After reading this blog-post: http://blog.nguyenvq.com/blog/2010/09/29/sign-or-encrypt-emails-or-files/ I am able to verify the email via the CLI + by using the python script “clearmime” (http://domnit.org/scripts/clearmime):

clearmime < foo.email | gpg --verify
gpg: Signature made Sun Aug 26 00:02:54 2018 SAST
gpg:                using RSA key B01D589706E1AB264ACFD0B90F9434592DA39F44
gpg: Good signature from "Gunter Grodotzki <gunter@grodotzki.co.za>" [ultimate]

However when trying to do similar in PHP does not fully work:

$signed_text = <<<EOF
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
NotDashEscaped: You need GnuPG to verify this message

Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
    charset=us-ascii

testmail
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEsB1YlwbhqyZKz9C5D5Q0WS2jn0QFAluB0g4ACgkQD5Q0WS2j
n0RX5w/+I9eCTaGO7h9Gn8WKge6jysa/2JpCaE+AjKaqqsxTyD7ctFPNVCIEblLB
alLwkEJQW+I6zVdC5MdLzdLL5LVum7p6XJ+U1Z1iI6HknIivUBEmE1kw8Nyao3cR
z08fSzYvgAsRaODpwUQQ2uVQbSHoOQK2JgJWPiQpSytYNRxO7Uf2st++JHsM7lJ3
oFSbv975vcVjs+gXv6kqdOy2sQd/s6egymGLq93YEON0NoeZkNvDq6upCBecuZA1
46yGGyDZ5jO3B6Wxcv5td41Lq+m6ELKlDZ3/lsBCML7owD+oTvafIvsp7ksOFgn9
4xZdnSjm/vm9ldmmvPjHf37LbQgIGzNxq78wwErUPBaq1MbjW1+34oe68fUcqpyZ
yNXfD4WwQFR09x21uBeBryVY7BJQJInh81YO5xOAlUv42X/ns2d1A2w/V6ClUCS0
ZRWBLMINGWB9o5RGhjB+y36k8+zTIIfYSWsRMNQbILx9H4QJQJZiB8U7vpRoQhLW
eEyXuYqPrKbIxbAfddK7GO8vYnSMA1+20eEdV6N6820HWHPMtUsh+hWq3Z5ZVPB7
Sng4N60qreMXo3r3w3iSF8nTUK+UMjVlNfS1ZnwnymMPbtVllxoW6NkPw9zauccf
lCFJV88IHG9JZXW5W8WH9x0IqHXVqzXGTcHsHhqoLgvNFk+e/DI=

=S+zc
-----END PGP SIGNATURE-----
EOF;

$plaintext = 'testmail';

$gpg = new gnupg();

$plaintext = null;
$info = $gpg->verify($signed_text, false, $plaintext);
var_dump($info);

I get the following results:

array(1) {
  [0] =>
  array(5) {
    'fingerprint' =>
    string(16) "0F9434592DA39F44"
    'validity' =>
    int(0)
    'timestamp' =>
    int(0)
    'status' =>
    int(117440520)
    'summary' =>
    int(4)
  }
}

string(86) "Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
    charset=us-ascii

testmail
"

According to https://stackoverflow.com/a/32796890/567193 – a status of “4” means the signature is bad.

How can I get the same results with PHP as I did via CLI? E.g. “good signature” verification?

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s