[File] [PATCH] of Magdir/pgp for ASCii armored PGP files

Jörg Jenderek joerg.jen.der.ek at gmx.net
Tue Nov 5 20:03:17 UTC 2019

Hash: SHA1

some days ago i export my GPG keys in ASCII armored format with file
name extension asc. When i run file run file command i got unexpected
results. So i look at hundreds other PGP asc files. So for version
5.37 on some examples i get an output like:

joerg-privat.asc:                       ASCII text
joerg-public.asc:                       PGP public key block
KNOPPIX_V8.2-2018-05-10-DE.iso.md5.asc: ASCII text
test2.txt.asc:                          PGP message
unbound_setup_1.9.4.exe.asc:            PGP signature Signature (old)

Furthermore with option --extension only ??? is displayed.

The file command describes some examples only as ASCII text. The file
identifier tool TrID  ( see http://mark0.net/soft-trid-e.html )
describes the misidentified examples correctly.

The public key is recognised by start magic line in Magdir/pgp like
 2 string ---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK- PGP private key
Now add lines in the same manner for private key starting with line li
 2 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key
On website reposcope.com magic, mime type and file name extension is
mentioned. So add this reference by comment line like
 # Reference:	https://reposcope.com/mimetype/application/pgp-keys
Afterwards show this information by lines
 !:mime	application/pgp-keys
 !:ext	asc

Text encrypted with PGP is detected by line
 0	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
Now i add in same manner for clear text signed messages a test line
 0 string-----BEGIN\040PGP\040SIGNED\040MESSAGE- PGP signed message
The magic is describe in the GNU Privacy Handbook. So i use that as
reference by line like
 # Reference:	https://www.gnupg.org/gph/en/manual/x135.html

Sometimes it is not clear which mime type must by used. So one site
says application/pgp and the other says application/pgp-encrypted.
Furthermore i only inspected samples with asc file name extension.
But according to trid also AEXPK, PGP, PUB and TXT may occur. So
maybe additional extensions must be added. Some times the used magic
starts with 3 minus characters at offset 2 and some times the used
magic start with 5 minus character at offset 0. I don not know what
was the reason for that. Furthermore i found some asc files where
some text lines occur befor the magic. I do not know if this is an
accident and is allowed. Such examples are still not detected. So
maybe a PGP expert can refine the current magic lines.

After applying the above mentioned modifications by patch
file-5.37-pgp-asc.diff then i get a more describing output like:

clamav-0.100.2.key.asc:                 PGP public key block
joerg-privat.asc:                       PGP private key block
joerg-public.asc:                       PGP public key block
KNOPPIX_V8.2-2018-05-10-DE.iso.md5.asc: PGP signed message
test2.txt.asc:                          PGP message
unbound_setup_1.9.4.exe.asc:            PGP signature Signature (old)

I hope my diff file can be applied in future version of
file utility.

With best wishes
Jörg Jenderek
- --
Jörg Jenderek

Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

-------------- next part --------------
--- file-5.37/magic/Magdir/pgp.old	2019-04-19 00:42:27 +0000
+++ file-5.37/magic/Magdir/pgp	2019-11-05 19:49:06 +0000
@@ -59,14 +59,34 @@
 #>15	string	PGP\040SIGNATURE-	signature
+# Update:	Joerg Jenderek
+# URL:		http://en.wikipedia.org/wiki/Pretty_Good_Privacy
+# Reference:	https://reposcope.com/mimetype/application/pgp-keys
+2	string	---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK-	PGP private key block
+#!:mime	text/PGP
+!:mime	application/pgp-keys
+!:ext	asc
 2	string	---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK-	PGP public key block
 !:mime	application/pgp-keys
+!:ext	asc
 >10	search/100	\n\n
 >>&0	use		pgp
 0	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
-!:mime	application/pgp
+# https://reposcope.com/mimetype/application/pgp-encrypted
+#!:mime	application/pgp
+!:mime	application/pgp-encrypted
+!:ext	asc
+#!:ext	asc/pgp/gpg
 >10	search/100	\n\n
 >>&0	use		pgp
+# Reference:	https://www.gnupg.org/gph/en/manual/x135.html
+0	string	-----BEGIN\040PGP\040SIGNED\040MESSAGE-	PGP signed message
+#!:mime	text/plain
+!:mime	text/PGP
+#!:mime	application/pgp
+!:ext	asc
 0	string	-----BEGIN\040PGP\040SIGNATURE-		PGP signature
+# https://reposcope.com/mimetype/application/pgp-signature
 !:mime	application/pgp-signature
+!:ext	asc
 >10	search/100	\n\n
 >>&0	use		pgp
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.37-pgp-asc.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20191105/f8be9d7b/attachment.obj>

More information about the File mailing list