freedomofpress/securedrop — pull request #288 by Hainish (2014-01-27 03:50:53+00:00)
Title: Including gnupg-securedrop module, fixing security vulnerability with ol...

...d python-gnupg module while preserving the methods that securedrop needs

This relates to https://github.com/freedomofpress/securedrop/issues/250

The package `gnupg` fixes numerous security vulnerabilities found in the previous standard module, `python-gnupg`. The new package had also removed some important capabilities essential to securedrop, such as encrypting from a file and outputting to a file. I've added these essential methods and opened up a pull request on the project.

The pending pull request https://github.com/isislovecruft/python-gnupg/pull/40 has not been merged into the `gnupg` package yet. As a stopgap measure, I've create a package on PyPI called `gnupg-securedrop` that includes the fixes needed for this package to work with Securedrop. This is a temporary measure to close this security hole. Hopefully we can move to the `gnupg` module once the pull request is merged.

This will move us from the old, vulnerable `python-gnupg` dependency we're currently relying on, and add the secure `gnupg-securedrop` fork of `gnupg` as a dependency. This also makes a few changes to the API calls as required.