rnp
rnp copied to clipboard
rnpgp
Write PHP module which makes use of RNP functionality.
Description
It appears that there are not much of OpenPGP implementations, available for the PHP language. Given that Drupal and Wordpress are quite popular as a site backend there could be some demand for PHP PGP module. Hopefully somebody from the PHP world would give us sime insights on this so we may prioritize this issue.
I can try to write such module, I had some experience with PHP module API.
However, PHP code can always call external command line tool, like gpg or rnp.
However, PHP code can always call external command line tool, like
gpgorrnp.
This would not be a good approach for high-loaded servers, and may lead to some vulnerabilities, like this one: https://ubuntu.com/security/CVE-2018-12020
ok, how it should look like? All API functions from <rnp/rnp.h> exported as close as possible to original C version?
ok, how it should look like? All API functions from <rnp/rnp.h> exported as close as possible to original C version?
It should be something similar to ruby-rnp/py-rnp : first part is a raw lib which just imports C functions, and second is native PHP wrapper with classes, native types and so on. I doubt that PHP users will strictly follow FFI API rules for object and buffer destroying, use raw C strings and so on :)
Which PHP version should be targeted? https://www.php.net/supported-versions.php PHP 7.4 probably is going to be EOL-ed when this module becomes ready and reaches repositories.
@antonsviridenko perhaps let's leave that decision to you since you are definitely more familiar with PHP than I am 😄
Actually 3rd party module for interaction with gnupg does exist. https://pecl.php.net/package/gnupg https://github.com/php-gnupg/php-gnupg
@antonsviridenko Yeah, but it uses gpgme which invokes gnupg executable. Also it would restrict user to the LGPL license.
How language bindings (py-rnp, ruby-rnp, swift-rnp) are synchronized with RNP API updates?
How language bindings (py-rnp, ruby-rnp, swift-rnp) are synchronized with RNP API updates?
Manually :) There is no any formal process yet. Probably we should make one, or add some CI, so bindings would track newly added FFI functions.
Started to work on PHP module, 5 API functions are implemented so far :) https://github.com/rnpgp/php-rnp
Any ideas about password provider implementations for PHP? :)
If PHP script runs as a command line, it can use stdin password provider, like default in CLI, but most frequent use is in context of web server process.
@antonsviridenko In web server context I see only two ways - via some callback (is it possible for PHP?), or via string constant. The second option however would need to know in advance to which key(s) or/and passwords data is encrypted. Probably we should extend our API with some rnp_get_recipients() call to be able to analyze input data for recipients.
Yeah, it appears callbacks are available in PHP.
https://www.php.net/manual/en/language.types.callable.php
Btw, how it is done in other language bindings?
@antonsviridenko ruby-rnp uses callback or predefined password approach, please see this example: https://github.com/rnpgp/ruby-rnp/blob/main/examples/password_provider.rb
Let's talk about the license of this module. If we want it to be included into the PECL, "The PHP License, version 3.01" is preferred.
https://pecl.php.net/account-request.php
@antonsviridenko it looks like they support the BSD license too? Let’s use the same BSD license for simplicity in managing our project. Thanks!
@ronaldtse ok, added LICENSE file with Ribose license text https://github.com/rnpgp/php-rnp/blob/main/LICENSE
So, minimal amount of required APIs for key generation/sign/verify/encrypt/decrypt operations is implemented so far. PHP API looks like this now - https://github.com/rnpgp/php-rnp/blob/main/rnp.stub.php. Time to write some PHP documentation :)
Keys are referenced using fingerprint strings or arrays containing such strings ($keys_fp, $recipient_keys_fp, return value of rnp_op_generate_key())
@ronaldtse Did you receive any response from PECL-Dev? Probably you need to subscribe to this mailing list first, your email is not visible in mailing list archives, probably it did not reach them
https://marc.info/?l=pecl-dev&r=1&b=202208&w=2
@antonsviridenko you're absolutely right -- I've just re-done it and the message is now on the list. Thanks!
What version number should we assign to the first release of this module? PECL requires versioned releases as I see.