[ERROR] OSError: Unable to run gpg (gpg) - it may not be available

[Siddhartha Bose]

Hi Everyone,

  I have encountered an issue running same code which was working fine in python3.6 runtime in python 3.9. 

I am using python-gnupg in a deployment package, "import gnupg" works fine but whenever I trying use anything from the module it gives me OSError saying gpg is not available.

Does it mean it is dependent on gpg binary which is no more available on the server? If so do we have a mechanism to get gpg binary in the deployment package of python along with its dependent libraries?

Thanks

Sid

[Siddhartha Bose]

Hi Everyone,

  I have confirmed that default libraries/binaries present in runtime 3.6 has been removed, so gpg which I believe the base app is no more available, and as python-gnupg is wrapper around it, so I believe it is dependent on the fact that gpg should be available. As I said I am deploying python-gnupg as a package, but doesn't have gpg, that is why that error. Now I tried "pip3 install python-gnupg -t . --platform manylinux1_x86_64 --only-binary=:all:" assuming it will install get the binaries as well, but it didn't work because it doesn't have a gpg binary, so how do I get the gpg binary in the deployment package so i can use python-gnupg on top of it.

Thanks

Sid

[Vinay Sajip]

You've provided absolutely no information about the server environment, so I'm not sure there's enough information to answer your question. There is generally no connection between Python versions and the presence or otherwise of gpg on the server. Perhaps look into how packages are installed on the server? For example, using the platform's distro manager?

[Siddhartha Bose]

Hi Vinay,

  Thanks for the response, apologies for the confusion, the package is getting deployed in aws lambda, previously with run time 3.6 it had gpg binary by default which is no more the case with 3.9. So along with python-gnupg I need to have gpg binary in the package. 

It’s not directly related to python-gnupg so it’s ok.

Thanks

Sid

--

---
You received this message because you are subscribed to a topic in the Google Groups "python-gnupg" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/python-gnupg/nNWQstzziTA/unsubscribe.
To unsubscribe from this group and all its topics, send an email to python-gnupg...@googlegroups.com.
To view this discussion on the web, visit https://groups.google.com/d/msgid/python-gnupg/8d714bc0-4955-4c41-9fd3-aae570d449een%40googlegroups.com.

--

Sid
Sent from iPhone

[Paras Sitoula]

Hi Sid, 

I am having a similar problem. Upgrading the python version from 3.6 to 3.9 now broke the gpg encryption part. Could you please share how you included the gpg binary in the package? 

[hemant borole]

Hi @paras, Siddhartha,

I am also having similar issue. Can you please guide how did you include gpg binaries? Is it from /usr/bin/gpg? I am following below procedure to create python venv in Amazon linux 2 to get it resolved but i am trying to understand how can i include gpg binaries in this zip? Please respond. I have been trying to resolve this from last few weeks and got this thread as hope to resolve my issue

python3.9 -m venv my_venv 

 ./my_venv/bin/pip3.9 install python-gnupg 

cp -r ./my_venv/lib/python3.9/site-packages/

cp /usr/bin/gpp ./my_venv/lib/python3.9/site-packages/

cp lambda.function.py ./my_venv/lib/python3.9/site-packages/

python zip -r lambda_function.zip python

and lamdba.py in code

import gnupg

def lambda_handler(event, context):

      gpg = gnupg.GPG(gnupghome="/tmp", gpgbinary='./gpg')
      gpg.encoding = 'utf-8'

 

Thanks

Hemant

[Sid Bose]

Hi Hemant,

  I would encourage on using lambda ecs images where you have bundled gpg in it. As a work around you can use python3.7 to support lambda for now which has gpg available, but eventually you will have to move away from it.

Thank

Sid

You received this message because you are subscribed to the Google Groups "python-gnupg" group.
To unsubscribe from this group and stop receiving emails from it, send an email to python-gnupg...@googlegroups.com.
To view this discussion on the web, visit https://groups.google.com/d/msgid/python-gnupg/d86dfc0a-fbdb-426b-9f8c-5526a70cdf84n%40googlegroups.com.

[hemant borole]

Hi Sid,

I have tried using ECS images & lambda. Everything works fine except decryption part. It is not giving me any error but i can see below output in stderr & status of decrypted data and also when i checked gpg version in container, it is showing  gpg (GnuPG) 2.0.22 So i believe it has to do something with passphrase prompting...when i tried to decrypt locally through python i was using --pinentry-mode=loopback to suppress prompt but that is not working as gpg version is outdated in container that i launched from ECS. Can you please help if you encountered any such issue while decrypting.?

gpgdata = gpg.decrypt_file(encrypted_filepath, passphrase=passphrase, always_trust=True, output=decrypted_filepath)
        print(gpgdata.ok)-->  False
        print(gpgdata.status)--> good passphrase
        print(gpgdata.stderr)--> [GNUPG:] ENC_TO 4B09334FF6DFCFBC 1 0 ......[GNUPG:] USERID_HINT 4B09334FF6DFCFBC <key name removed <recipients email id removed >...[GNUPG:] NEED_PASSPHRASE 4B09334FF6DFCFBC 208009E9D551A357 1 0.....[GNUPG:] GOOD_PASSPHRASE

***Dockerfile***

root@ip-10-29-240-252:~/lambda-BI# cat Dockerfile
# Python 3.9 lambda base image
FROM public.ecr.aws/lambda/python:3.10

# Install pip-tools so we can manage requirements
RUN yum install python-pip -y

RUN yum install -y gnupg2

RUN yum install -y ca-certificates wget

# Copy requirements.txt file locally
COPY requirements.txt ./

# Install dependencies into current directory
RUN python3.10 -m pip install -r requirements.txt

# Copy lambda file locally
COPY lambda_function.py .

# Define handler file name
CMD ["lambda_function.lambda_handler"]

Thanks

Hemant

[hemant borole]

Hi All,

BY default all ECR lambda/Python images have gpg 2.0 installed so decryption doesnot work as it prompt so I have followed below instructions from link in Dockerfile and i was able to resolve it. Also we need to add path & then add gpg config file to allow pinetry loopback. I will provide more details if anyone facing similar problem.

https://askubuntu.com/questions/1242572/how-to-upgrade-to-gnupg-2-2-8

[Niraj Bhatt]

I am also getting same error. I built gpg from scratch and putting it along with other dependencies in python folder in a layer. 

So my layer.zip has

python

  - dependencies

  - gpg file (built using steps mentioned in https://github.com/aws-samples/pgp-decryption-for-transfer-family/blob/main/setupEnvironment.sh#L24 )

I put in a print statement in lambda code print(f"file {os.path.exists('/opt/python/gpg')}") and result was True so file /opt/python/gpg exist however t still throws an OsError.

{

  "errorMessage": "Unable to run gpg (/opt/python/gpg) - it may not be available.",
  "errorType": "OSError",
  "requestId": "3858809d-889d-4a9c-ad64-3d01160257d1",
  "stackTrace": [
    "  File \"/var/task/index.py\", line 255, in lambda_handler\n    file_path = decrypt_file(s3_object, file_path, private_key, passphrase)\n",
    "  File \"/var/task/gnupg_wrapper.py\", line 23, in decrypt_file\n    gpg = gnupg.GPG(gnupghome='/tmp', gpgbinary='/opt/python/gpg',verbose=True)\n",
    "  File \"/opt/python/gnupg.py\", line 1094, in __init__\n    raise OSError(msg)\n"
  ]
}

I don't think it's python-gnupg issue however I am not able to setup both gnupg and python-gnupg on AWS lambda unless I containerize the entire codebase which I don't want to do.

Anyone has used python-gnupg in a lambda with gnupg custom install successfully? (without container image)