gnupg

What it is and what it does

gnupg is a Python wrapper around the GnuPG command-line tool, allowing you to perform cryptographic operations—key generation, encryption, decryption, and signing—from Python code. It is a rewrite of an earlier library that fixed shell injection vulnerabilities caused by unsanitized subprocess calls.

The package provides a GPG class that manages a local keyring and communicates with the GnuPG binary via subprocess. You instantiate it with paths to your keyring files and GnuPG binary, then call methods like gen_key(), encrypt(), and decrypt() to perform operations. It has no runtime Python dependencies but requires GnuPG to be installed on the system.

Use it for:

• Automate GPG key generation and management in Python applications without manual shell scripting.
• Encrypt sensitive data in a Python service before storage or transmission.
• Decrypt files or messages signed by external parties as part of a larger workflow.
• Build a Python-based key distribution system that relies on GPG trust models.
• Integrate GPG operations into CI/CD pipelines or batch processing jobs.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A Python wrapper around GnuPG that lets you generate keys, encrypt, and decrypt messages programmatically, with patches for shell injection vulnerabilities.

Yes, with conditions. The package is stable and in the top 5000 PyPI downloads, with no known vulnerabilities. However, it is dormant—last release was 2017-09-06—so it may not support modern Python versions or recent GnuPG features. Install it if you need GPG integration in a Python 2 or early Python 3 codebase and can tolerate lack of active maintenance.

Install

gnupg on PyPI

pip install gnupg

uv add gnupg

poetry add gnupg

Installing gnupg

Before you install

High install friction: no runtime dependencies but requires a working GnuPG binary on the system. Maintenance is dormant—last release was 2017-09-06, over 3264 days ago, though the repository remains active with a recent commit on 2024-08-01.

License in practice

Licensed under GPLv3+, a copyleft license. Any application that links this library must also be distributed under a compatible open-source license or obtain an exception.

Quickstart

pip install gnupg

from gnupg import GPG

gpg = GPG(binary='/usr/bin/gpg', homedir='./keys')
message = "test"
encrypted = str(gpg.encrypt(message, recipient_key_id))
decrypted = str(gpg.decrypt(encrypted))

GnuPG binary must be installed and accessible on the system (e.g., /usr/bin/gpg on Linux/macOS).

Verify before relying

• Whether patches for shell injection vulnerabilities cover all supported Python versions.
• Current compatibility with modern GnuPG versions and Python 3.x releases beyond 3.4.
• Whether dormant maintenance affects security patches or bug fixes going forward.

Package facts

Evidence: gnupg-2.3.1-py2.7.egg; gnupg-2.3.1-py3.4.egg; gnupg-2.3.1.tar.gz

Tags

More Python Modules packages