Installation
The first step in integrating GnuPG for ColdFusion is downloading the GnuPG binaries (or source code, for the more adventurous). Binaries are available at www.gnupg.org/(en)/download/index.html for most operating systems (examples in this article are based on a Windows implementation). Once you have downloaded the binaries, it is a good idea to verify the signature or MD5 checksum on the file to validate the integrity of the download. If you already have a version of GnuPG (or PGP), import the public key from www.gnupg.org/(en)/signature_key.htm and the appropriate signature file from the main GnuPG download page. Verify the signature file by opening the command prompt, navigating to the location of the compressed binaries and signature file, and typing:

gpg --verify "gnupg-w32cli-1.2.5.zip.sig"

You should see:

gpg --verify "gnupg-w32cli-1.2.5.zip.sig"
gpg: Signature made 07/26/04 05:48:55 using DSA key ID 57548DCD
gpg: Good signature from "Werner Koch (gnupg sig) <dd9jn@gnu.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner
Primary key fingerprint: 6BD9 050F D8FC 941B 4341 2DCC 68B7 AB89 5754 8DCD

You have a good signature from Werner Koch for this file. The warning stems from an additional step needed to trust the signature. To do this, you need to execute the "--edit-key" command:

gpg --edit-key "dd9jn@gnu.org"

You will see:

gpg (GnuPG) 1.2.5; Copyright © 2004 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

Pub 1024/57548DCD created: 1998-07-07 expires: 2004-12-31 trust: -/-
(1). Werner Koch (gnupg sig) <dd9jn@gnu.org>

Command>

You will notice that there is a prompt named Command. At this prompt, type "trust" to bring up the trust options:

pub 1024D/57548DCD created: 1998-07-07 expires: 2004-12-31 trust: -/-
(1). Werner Koch (gnupg sig) <dd9jn@gnu.org>

Please decide how far you trust this user to correctly
Verify other users' keys (by looking at passports,
Checking fingerprints from difference sources...)?

1 = Don't know
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately
m = back to the main menu

Your decision?

I chose "5" to ultimately trust the key, and verified my choice.

pub 1024D/57548DCD created: 1998-07-07 expires: 2004-12-31 trust: f/-
(1). Werner Koch (gnupg sig) <dd9jn@gnu.org>
Please note that the shown key validity is not necessarily correct
Unless you restart the program.

Command>

Type "quit" to exit GnuPG's command prompt. Now, if you run the same verification as before (gpg --verify "gnupg-w32cli-1.2.5.zip.sig"), you will see:

gpg: Signature made 07/26/04 08:48:55 using DSA key ID 57548DCD
gpg: Good signature from "Werner Koch (gnupg sig) <dd9jn@gnu.org>"
gpg: check the trustdb
gpg: checking at depth 0 signed=0 of(-/q/n/m/f/u)=0/0/0/0/06
gpg: next trustdb check due at 2004-12-31

Please note that this is a detached signature, so both the signature file and downloaded file need to be in the same directory.

If you do not have a version of GnuPG (or PGP), you will need an MD5 checker like FastSum (www.fastsum.com) to verify the file's fingerprint. The command for checking the MD5 checksum will look like this:

C:\fastSum\fastSum.exelocationOfGnuPGDownload\gnupg-w32cli-1.2.5.zip

The result will look like this:

MD5 Checksum calculation and verification utility. [1.6.0.92] EN
(C) 2003 Kirill Zinov and Vitaly Rogotsevich. Web site: www.fastsum.com

Calculating...

c:\downloads\gnupg-w32cli-1.2.5.zip3D93D73942117C4C0182CB15E01DE70F

Calculation summary:
Processed 1 files in 0 folders with total size 1.43 Mb.
Elapsed time: 00:00:00 Average speed: 27.72 Mb\Sec.

• Source Code