Ytdyklly

I am trying to write server and client PHP-CLI scripts with gpg-encrypted data using PHP's gnupg_* extensions on Ubuntu-18.04 and PHP-7.2.

After sending the welcome message, the server sends its public key, and sets up its private key as the decrypt key, while the client sets up the public key as the encrypt key.

This involves using gnupg_keyinfo() and extracting the fingerprint from the complex array of info.

The format of the info is unclear (to me at least!).

The server script has:

    putenv('GNUPGHOME=/home/****/.gnupg');

    $gpg = gnupg_init();

    $info = gnupg_keyinfo($gpg, "username");

    $gpg_fingerprint = $info[0][0]["subkeys"]["fingerprint"];

    $reply = gnupg_adddecryptkey(gpg, $gpg_fingerprint, $gpg_passphrase);

and the client script has:

putenv('GNUPGHOME=/home/****/.gnupg');

$gpg = $gnupg_init();

$info = gnupg_keyinfo($gpg, $public_key);

$gpg_fingerprint = $info[0]["fingerprint"];

$reply = gnupg_addencryptkey($gpg, $gpg_fingerprint);

Obviously both the "$gpg_fingerprint = " lines are wrong, but what should they be?

If the fingerprint is the only thing that uniquely identifies the key, why isn't it easier to access?

Or is there an easier way to do this?

I have found a script which gets fingerprint:

$gpg = gnupg_init();

$infos = gnupg_keyinfo($gpg, $email);

$countkeys = count($infos);

if($countkeys == 0) { print "No keys match $emailn"; exit; }

// choose which key if more than 1

$keychoice = 0;

if($countkeys > 1)

{   print "$email matches $countkeys keysn";

    for($i=0; $i<$countkeys; $i++)

    {   $name = $infos[$i]['uids'][0]['name'];

        $comment = $infos[$i]['uids'][0]['comment'];

        $timestamp = $infos[$i]['subkeys'][0]['timestamp'];

        $fingerprint = $infos[$i]['subkeys'][0]['fingerprint'];

        print "$i: $name, $comment, $timestamp, $fingerprint)."n";

    }

    loop2:

    print "n?: ";

    $keychoice = trim(fgets(STDIN));

    if(($keychoice < 0) || ($keychoice >= $countkeys)) { print "invalid choicen"; goto loop2; }

}

// get fingerprint 

$fingerprint = $infos[$keychoice]['subkeys'][0]['fingerprint'];

print "Fingerprint: $fingerprintn";   

Since fingerprint is required for gnupg_addencryptkey() it would seem to be a gnupg design problem that it is buried away in 4-dimensional array.