Application: GnuPG
Category: privacy/security
Description: GnuPG is "the GNU project's complete and free implementation of the OpenPGP standard as defined by RFC4880."
GnuPG (aka gpg) is a command line application that is often used in conjunction with a third party graphical front end to encrypt/decrypt or sign/verify files or emails. GnuPG is not inherently portable as it broadcasts its existence to these third party apps via registry keys and environment variables.
Download GnuPGPortable 1.4.10 Dev Test 14 [307KB + 5.9MB download/6MB installed]
(MD5: 652F00C3D72272D8B2B28C561EE8199E )
Download experimental ThunderbirdPortable.exe [ 110 KB download]
(MD5: DE2DFFEE15CE6205C17B127B38E99999 )
Download experimental ThunderbirdPortable.nsi [ 20 KB download]
(MD5: 9E2D700FB8F836878B41B651BA29354B )
Release Notes:
The official release of Thunderbird Portable Edition DOES NOT support the CommonFiles GnuPG installation. I have built a modified ThunderbirdPortable (.nsi and .exe) if you would like to test TBP/Enigmail with GnuPG Portable. This is currently UnOfficial and as such not supported by anyone but myself. To use it follow these steps:
1. Install Thunderbird Portable
2. Install GnuPG Portable
3. Overwrite
\PortableApps\ThunderbirdPortable\ThunderbirdPortable.exe
with the experimental ThunderbirdPortable.exe
4. Install Enigmail
Experimental Thunderbird Portable(2010-03-07):
- Updated UnOfficial ThunderbirdPortable.nsi/exe to 1.6.8.0 (for TBP 3.0.3.0)
Experimental Thunderbird Portable(2009-12-12):
- Updated UnOfficial ThunderbirdPortable.nsi/exe to 1.6.7.0 (for TBP 3.0.0.0)
Development Test 14 (2009-09-03):
- Update--GnuPG updated to version 1.4.10
- Update--Using PortableApps Installer 0.91.7 Common Files Plugin method. Installer will download and install GnuPG from the GnuPG.org ftp site.
- Update--Removed experimental Thunderbird Portable and NSIS Portable includes from the installer. These will be distributed separately now.
Development Test 13 (2009-06-25):
- Update--Installer built with PA.c Installer 0.91.5 utilizing the new CommonFiles installer support. No other changes. If you have already downloaded Dev Test 12 there is no need to download Dev Test 13.
Development Test 12 (2009-06-24):
- Update--Experimental ThunderbirdPortable.exe updated to 2.0.0.22
- Update--Installer built with PA.c Installer 0.91.4 Couple of appinfo.ini tweaks and a 0 byte .exe to shoehorn a CommonFiles package into the installer. (just saw 0.91.5 posted. will have to investigate more)
- Fix--NSISPortable doesn't seem to utilize the \Data\Include directory in all cases so custom post install code will place a copy of GnuPGPortable.nsh into \App\NSIS\Include as well \Data\Include
Development Test 11 (2009-04-29):
- Fix--Experimental ThunderbirdPortable.exe was compiled with wrong splash in Dev Test 10.
- New--Added custom installer code to detect NSISPortable and if found offer to place a copy of GnuPGPortable.nsh into the include directory.
Development Test 10 (2009-04-23):
- Update only needed if you compile your own apps with GnuPGPortable.nsh and use ResetGnuPGReg.
- Updated installer to 0.13.3
- Added a check ResetGnuPGReg. If ResetGnuPGReg is called and gpgportable reg key does not exist it will exit. Prior to this calling ResetGnuPGReg without an existing GnuPGPortable key would cause an underrun condition which would then create a GnuPGPortable key with a client count of 4294967295.
- remove launcherlang files from installer. No launcher, so not needed
Development Test 9 (2009-01-02):
- Updated UnOfficial ThunderbirdPortable.nsi to 1.6.3.0 (for TBP 2.0.0.19)
- Updated GnuPGPortable installer to PortableApps.comInstaller version 0.10.4.0.
Development Test 8 (2008-11-21):
- Updated UnOfficial ThunderbirdPortable.nsi to 1.6.2.0 (for TBP 2.0.0.18)
- Minor fix in GnuPGPortable installer. It was creating an unused Data directory and ini file under the GnuPG folder.
Development Test 7 (2008-09-29):
- Updated UnOfficial ThunderbirdPortable.nsi to 1.6.1.0 (for TBP 2.0.0.17)
Development Test 6 (2008-09-25):
- Updated UnOfficial ThunderbirdPortable.nsi to 1.6.0.0 (for TBP 2.0.0.16)
- Fixed bug in UnOffical ThunderPortable.nsi that handled .ini overrides improperly.
- Recompiled UnOfficial ThunderbirdPortable.exe with latest version, Just copy it over your ThunderbirdPortable.exe after installing TBP 2.0.0.16
- Modified GnuPGPortable.nsh to remove dependency on FileFunc.nsh for the GetRoot macro.
Development Test 5 (2008-05-02):
- Updated UnOfficial ThunderbirdPortable.nsi to 1.5.8.0 (for TBP 2.0.0.14)
- Recompiled UnOfficial ThunderbirdPortable.exe with latest version, Just copy it over your ThunderbirdPortable.exe after installing TBP 2.0.0.14
- re-added translations directory and included text file describing how to re add the translation files.
Development Test 4 (2008-04-30):
- Updated binaries from 1.4.8 to 1.4.9
- Installer now displays GPL v3
- Removed translation files to reduce install size.
- Updated version in help file
Development Test 3 (2008-03-27):
- Fixed increment counter bug on line 170
- Changed all references from WinPT to GnuPG
- Recompiled UnOfficial ThunderbirdPortable.exe
- Modified UnOfficial Thunderbird Portable to point to CommonFiles location of GnuPGPortable.nsh
Development Test 2.3 (2008-02-27)
Development Test 2.2 (2008-02-15)
Development Test 2 (2008-02-14): Methodology change from GnuPGPortable.exe to GnuPGPortable.nsh
Development Test 1 (2008-02-08): Initial release
Dev Notes:
GnuPGPortable is my attempt at a reusable portable solution for GnuPG. The first half of this solution is a shared layout for GnuPG. The current install layout of GnuPGPortable is thus:
PortableDrive:\
+\PortableApps\
+\CommonFiles\
+\Data\
+\GnuPG\ {GnuPG Home dir, keyrings and conf}
+\GnuPG\
+\App\ {GnuPG binaries}as discussed in this thread.
The second half of the solution is GnuPGPortable.nsh which is included in GnuPG Portable in the source folder. GnuPGPortable.nsh can be included in any app that needs access to GnuPG and with a few lines of code give the launched app a portable GnuPG environment. More detail is included in the help.html.
Visit the Community page
Join our forums
Subscribe to our email newsletter
Subscribe with RSS
Follow us on BlueSky
Follow us on Facebook
Follow us on LinkedIn
Follow us on Mastodon
Included in this release of GnuPGPortable is a modified ThunderbirdPortable.nsi
Lines were either commented out or added, each changed line tagged with MSTINAFF. The flow is changed a little bit, but I believe that it retains all of its functionality along with the added functionality of the (proposed) standardized GnuPG finder.
Give it a shot, let me know what you think.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
Maybe move this to Beta Testing to see if it gets some more attention. Make the post really clear and to the point.
This seem a little discotinued and I would like to know if it can be considered of a replacement to the actual squeme in wich GPG only works in TBP.
I think is the right move and hope something alike with other packages like python and some other libraries and dlls wich are replicated through the PortableApps directories.(mmm I also saw QT but I'm not sure if it is in the non-official-Beta-Test-only apps and remember the GTK Hell).
Something like for this App to work you would have to download also the XXXX-CommonPortable Library
John needs to take the lead on this, and he says that he is planning that a future version of TBP will use CommonFiles. Until he releases that version, we can either use a cobbled version, or test and wait.
I think you'll find that in order to use the CommonFiles\Data\GnuPG key/conf directory with TBP, you can simply set GNUPGHOME as an environment variable before calling TBP. Or continue to use the GPG file in the TBP directory tree until the changes get made -- WinPT, GPA, and TBP should all look in the TBP directories if the keys are not found in CommonFiles. Once TBP has been updated, we can begin migrating things.
As for selecting the folder in which GPG.exe is stored, that's a bit trickier. For now, letting each application that needs it have its own copy is not too onerous, assuming the 5MB can be spared on the removable drive. In fact, it might be better if TBP has a copy that it is sure to be able to use, while WinPT has a copy with which it is compatible; and both could be relatively sure they are not using a copy from the host computer that has itself been compromised.
MC
The latest Thunderbird Portable, 2.0.0.12, doesn't appear to look in CommonFiles for either the keys/conf or for gpg.exe.
It's interesting that Thunderbird, at least, appears to look on the PATH for gpg.exe (once it doesn't find it in ThunderbirdPortable\Apps\gpg). So if the TBP launcher would add the CommonFiles\GnuPG\App path to the PATH, that part would be done.
The same applies to the GNUPGHOME environment variable. If it points to a folder like CommonFiles\Data\GnuPG, Thunderbird/enigmail will use it.
After I installed the GPG for Thunderbird distribution (1.4.7), the TBP started putting Data\gpg into the GNUPGHOME variable, overriding CommonFiles\Data\GnuPG (when I set the variable up before calling TBP). So now I can't use that trick to get TBP to look at the CommonFiles location. Oh well.
Maybe John will get to it in the next version of TBP. Until then, I guess we have to let TBP be our guide and let everything default to the legacy location.
MC
Now that GPA is working, I've been experimenting with compression of the executables.
It occurs to me that after compressing GPG, it is not a "release" version any more. In particular, the only signatures or hashes available apply to the package, not to the GPG.exe executable, so the only way a person could be sure they have a legitimate version is to download the package, test its sig (or SHA1 hash) and use that version -- and they would probably not get the benefit of UPX compression.
We should be modeling good security behavior for people, by pointing out to them that the GPG.exe is different from the one found on the official site, and offering an explanation and a way to check it themselves.
If GPG.exe will work with an authenticode signature, I propose that JTH carefully download, verify, and compress his own copy of GPG.exe, and then code-sign it himself, then create a detached sig file with GnuPG. That puts more responsibility on him, but it is the only way I can think of to get a copy of GPG.exe that mere mortals have a chance of tracing back to a trusted source. And yes, I'm thinking that they may want to do the test more regularly than just at the time of the install, so having an authenticode signature would provide an easy way to make sure the file has not been compromised after using a public computer.
I certainly don't want to give people the impression that any old file named "gpg.exe" that they find on a machine or on the Internet can be trusted, and I do like the idea of showing them how they can and should test and evaluate software, especially software they download, even if it is from a trusted source like PortableApps. That is particularly so with software like GPG.exe that is used to verify other software as well as documents and e-mail.
MC
You make some very good points. The benefit from upx is about 0.5MB so I don't think anyone will cry if that is lost. But as you point out that still doesn't address the fact that the only hashes and sigs are of the GnuPG package and not the individual files. Authenticode signature seems to be the way to go, but I don't think that responsibility should fall to JTH. I feels more appropriate that the admins of GnuPG should authenticode sign their binaries. However as far as I am aware, getting an authenticode signing certificate requires a sizable financial investment, so that suggestion may go over about as well as a fart in church.
I could re write the GnuPG Portable installer to just be a wrapper around the genuine signed Gnu PG installer. But again it is left to the user to verify the package, and even then after install there is no way to spot check the executables.
It's not much, but this is why I've been packaging a signature with my installer, so that there is at least some sort of accountability.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
Please fold this in to your Dev Test 1 thread and delete this. This is standard practice to avoid clutter.
Also, please make it clear that Thunderbird Portable does not support your unofficial GnuPG Portable package.
Sometimes, the impossible can become possible, if you're awesome!
I started the Dev Test 2 thread as there was a significant shift in methodology. I will try to consolidate and clean up.
And I will revise the original post to make sure that it is clear that the official Thunderbird Portable Edition does not support this Dev Test.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
I really hope that this becomes final and JTH will pick up your work. GnuPG as common files for TBP/Enigmail + WinPT will be awesome!
I think I have found a bug. In around line 170 it reads
${registry::Write} "HKEY_CURRENT_USER\Software\GnuPGPortable" "ClientCount" $2 "REG_DWORD" $3 StrCmp $2 "0" TheEnd StrCpy $3 "Error: Increment Client Count."Shouldn't the middle line be "StrCmp $3 ..." -- $3 (the one all the way at the end of the previous line) is the variable containing the result code (0 for good, -1 for error).
MC
very good catch! I will fix this and repackage both GnuPG Portable and WinPT Portable.
Edit:
I have made the change and it seems to be working fine. I have also changed the name of the Reg Key backups from
HKEY_CURRENT_USER\Software\GNU\GnuPG-BackupByWinPTPortable
to
HKEY_CURRENT_USER\Software\GNU\GnuPG-BackupByGnuPGPortable
If you compile against GnuPGPortable.nsh (waves to rab040ma) this will necessitate a recompile.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
Did you re-use the same dev 2.3 file name?
MC
figured if it required a recompile then it should probably move up a major rev number.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
What version of GnuPG is packaged here? I'm maitaining the Development Test page and I'd like to keep all my info accurate and up-to-date.
The developer formerly known as ZGitRDun8705
The version of GnuPG in the package is 1.4.8
Thank you very much for staying on top of the development tests, the page looks great!
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
Thanks. Can you also provide the base app version and Dev Test version number for WinPT? Also, try to stay away from x.x test release numbers, any time a change is made, the release number should increase by a whole number.
Edit: i see u just updated the page...don't worry about posting the info here, but please keep my request in mind.
The developer formerly known as ZGitRDun8705
Thank you for your patience, I am trying to make everything conform to SOP. I anticipate my next lashing will be over documentation. :o
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
thought i give my support, cant wait for the full portable diction.
Just noticed that 1.4.9 is out now. GnuPG Portable will be updated shortly.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
Should I continue to include the translations files? They account for about 3 MB of the final install size and it only applies to the direct commandline use of gpg. Since the goal of this particular project is to make gpg available to other applications (front ends and such) the gpg translations become mostly useless.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
I'd at least include instructions for how to set up the locale files, in case some geek wants to use it at the command line.
MC
I would just polightly ask how far is the project implementation of gpg?
So far I am using the gpg as used by the portable TB. This is perfect for mails, but some other front and for the gpg would be nice too. But all this will probably need the 'common files' way.
Should I try to install second version of gpg the 'common files' way so some front ends would be able to use it?
Will the TB own version still work , will they work independently after all?
Otto Sykora
Basel, Switzerland
The GPG "front-ends" (WinPT and GPA) work with the TB installation of GPG.
In fact, until John sets TB up to use the GnuPG Portable (common files) setup, the TB setup is the only one that does work consistently.
There's nothing terribly bad about having GPG "living" in the TB directory tree, and it is not hard for WinPT or GPA to look there for it. It does make sense that GnuPG live in CommonFiles, and I think that is the ultimate goal, but until then, leave it in TB.
MC
As rab040ma said, for the easiest out of the box experience WinPT Portable and GPA Portable will use GPG from the TB directory (as long as gpg portable is not installed.)
That said, the official GPG for TB installer contains 1.4.7 which is a few versions old.
If you are comfortable running un official software, there is a modified and unoffical ThunderbirdPortable.exe in the GPG Portable source directory which lets Thunderbird use GPG Portable (common files location)
As far as I am aware there are no remaining issues with GPG Portable and it is just awaiting official support.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
@mstinaff: Please update this app at the overview page with the test releases (https://portableapps.com/development/test).
No sense updating anything until John releases a Thunderbird Portable that can use GnuPG Portable ... or are you saying that he did that while we weren't looking?
MC
Took me a moment to figure out what you meant by update. Then I saw that the version number on the test releases page was out of sync. Thanks!
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
Sometimes it's hard to find the right words in a foreign language
Thanks for figuring out what I meant ...
The one I downloaded had an MD5 hash of: 31a1265e47e8737a1f5a1b8247634c88
This is the one I downloaded:
http://downloads.sourceforge.net/portableapps/GPG_for_Thunderbird_Portab...
GPG for Thunderbird Portable (2008-07-25 20:19)
GPG_for_Thunderbird_Portable_1.4.9.paf.exe 1850552
First to answer your question. I do not know the md5 for the GPG for Thunderbird Portable download.
Second a clarification:
GPG for Thunderbird Portable is the official GPG installation for Thunderbird Portable and is made just for Thunderbird Portable. Install instructions here.
GnuPG Portable from this thread is a CommonFiles installation of GnuPG aimed at using one GnuPG install for multiple GPG enabled portable apps. GnuPG Portable contains an unofficial copy of ThunderbirdPortable (.nsi and .exe) that makes GPG for ThunderbirdPortable unnecessary.
Summed up, GnuPG Portable and GPG for Thunderbird Portable are two different and independent solutions to the problem of where to place the GPG binaries.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
Just want to let you know that this works for me under WinXP & Vista. Thanks!
I have just downloaded the new Thunderbird Portable 2.0.0.21 and reviewed the launcher. It is identical to 2.0.0.19 so you may use the experimental ThunderbirdPortable.exe from Dev Test 9 with this release. Upgrade directions if you are already using the experimental ThunderbirdPortable.exe are:
1. Download and install TBP 2.0.0.21
2. Thank Mr. Haller
3. Copy ThunderbirdPortable.exe from:
\PortableApps\CommonFiles\GnuPG\Other\Source\
To:
\PortableApps\ThunderbirdPortable\
I will be taking this opportunity to update the GnuPG Portable installer to the latest official PortableApps version, but this is not a needed upgrade if you already have Dev Test 9
Thanks!
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
I just thought I'd let you know that I installed this last night. It's been needed for some time. It works great!!! Thank you very much!!!
They really are out to get you!!
Hi,
It seems there is a bug.
I have a path for portable TB like: D:\name\....
According to my understanding, when portable TB starts, portable GPG sets the correct path in prefs.js for gpg.exe. But the path is not correct: it is something like D:\name\\.... There is only one \ after the D:. In the case of \n, it is interpreted as a CR by TB and gpg is not found. If I have another letter instead of n, it works well.
I have solved the problem by modifying ThunderbirdPortable.nsi line 384 by replacing:
FileWrite $0 `user_pref("extensions.enigmail.agentPath", "$GPGPATHDIRECTORY\gpg.exe");`
with
${StrReplace} '$1' '\' '\\' '$GPGPATHDIRECTORY\gpg.exe'
FileWrite $0 `user_pref("extensions.enigmail.agentPath", '$1') ;`
with StrReplace from http://nsis.sourceforge.net/StrRep
Is GnuPG still being developed?
EDIT: I just installed the current Dev Test, which created a start menu folder. Pretty sure that's not supposed to happen.
SWAG
Is this still being worked on?
SWAG
Any chance someone is picking this back up or it is complete somewhere on the site?
.:.
~maggard
For Thunderbird: https://portableapps.com/support/thunderbird_portable#encryption
BTW @John: the GPG version is outdated.
Previously known as kAlug.