PySequoia

This library provides OpenPGP facilities in Python through the Sequoia PGP library. If you need to work with encryption and digital signatures using an IETF standardized protocol, this package is for you!

Note: This is a work in progress. The API is not stable!

Building

set -euxo pipefail
python -m venv .env
source .env/bin/activate
pip install maturin
maturin develop

Installing

PySequoia can be installed through pip:

pip install pysequoia

PyPI version of PySequoia includes native wheels for a variety of architectures and OS combinations. If you are using a combination that is not yet provided a Rust toolchain will be necessary for the installation to succeed.

Testing

This entire document is used for end-to-end integration tests that exercise the package's API surface.

The tests assume that these keys exist:

# generate a key with password
gpg --batch --pinentry-mode loopback --passphrase hunter22 --quick-gen-key passwd@example.com rsa sign,encrypt
gpg --batch --pinentry-mode loopback --passphrase hunter22 --export-secret-key passwd@example.com > passwd.pgp

# generate a key without password
gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key no-passwd@example.com rsa sign,encrypt
gpg --batch --pinentry-mode loopback --passphrase '' --export-secret-key no-passwd@example.com > no-passwd.pgp

Functions

All examples assume that these basic classes have been imported:

from pysequoia import Cert, Sig, Tsk

sign

Signs data and returns armored output:

from pysequoia import sign, SignatureMode

s = Tsk.from_file("tests/fixtures/signing-key.asc")
signed = sign(s.signer(), "data to be signed".encode("utf8"))
print(f"Signed data: {signed!r}")
assert "PGP MESSAGE" in str(signed)

detached = sign(
    s.signer(), "data to be signed".encode("utf8"), mode=SignatureMode.DETACHED
)
print(f"Detached signature: {detached!r}")
assert "PGP SIGNATURE" in str(detached)

clear = sign(s.signer(), "data to be signed".encode("utf8"), mode=SignatureMode.CLEAR)
print(f"Clear signed: {clear!r}")
assert "PGP SIGNED MESSAGE" in str(clear)

sign_file

Signs data from a file and writes the signed output to another file:

from pysequoia import sign_file, SignatureMode
import tempfile, os

s = Tsk.from_file("tests/fixtures/signing-key.asc")

# create a file with data to sign
with tempfile.NamedTemporaryFile(delete=False, suffix=".txt") as inp:
    inp.write("data to be signed".encode("utf8"))
    input_path = inp.name

with tempfile.NamedTemporaryFile(delete=False, suffix=".pgp") as out:
    output_path = out.name

sign_file(s.signer(), input_path, output_path)
signed = open(output_path, "rb").read()
assert b"PGP MESSAGE" in signed

# detached signature to file
with tempfile.NamedTemporaryFile(delete=False, suffix=".sig") as out:
    detached_path = out.name

sign_file(s.signer(), input_path, detached_path, mode=SignatureMode.DETACHED)
detached = open(detached_path, "rb").read()
assert b"PGP SIGNATURE" in detached

os.unlink(input_path)
os.unlink(output_path)
os.unlink(detached_path)

verify

Verifies signed data and returns verified data:

from pysequoia import verify

# sign some data
signing_key = Tsk.from_file("tests/fixtures/signing-key.asc")
signed = sign(signing_key.signer(), "data to be signed".encode("utf8"))


def get_certs_verify(key_ids):
    # key_ids is an array of required signing keys
    print(f"For verification, we need these keys: {key_ids}")
    return [signing_key.extract_certificate()]


# verify the data
result = verify(signed, get_certs_verify)
assert result.bytes.decode("utf8") == "data to be signed"

# let's check the valid signature's certificate and signing subkey fingerprints
assert result.valid_sigs[0].certificate == "afcf5405e8f49dbcd5dc548a86375b854b86acf9"
assert result.valid_sigs[0].signing_key == "afcf5405e8f49dbcd5dc548a86375b854b86acf9"

The function that returns certificates (here get_certs_verify) may return more certificates than necessary.

Detached signatures can be verified by passing additional parameter with the detached signature:

data = "data to be signed".encode("utf8")
detached = sign(signing_key.signer(), data, mode=SignatureMode.DETACHED)
signature = Sig.from_bytes(detached)

result = verify(bytes=data, store=get_certs_verify, signature=signature)

# let's check the valid signature's certificate and signing subkey fingerprints
assert result.valid_sigs[0].certificate == "afcf5405e8f49dbcd5dc548a86375b854b86acf9"
assert result.valid_sigs[0].signing_key == "afcf5405e8f49dbcd5dc548a86375b854b86acf9"

This function can also work with files directly, which is beneficial if the file to be verified is large:

import tempfile

with tempfile.NamedTemporaryFile(delete=False) as tmp:
    data = "data to be signed".encode("utf8")
    detached = sign(signing_key.signer(), data, mode=SignatureMode.DETACHED)
    signature = Sig.from_bytes(detached)

    tmp.write(data)
    tmp.close()

    # verify a detached signature against a file name
    result = verify(file=tmp.name, store=get_certs_verify, signature=signature)

    # let's check the valid signature's certificate and signing subkey fingerprints
    assert (
        result.valid_sigs[0].certificate == "afcf5405e8f49dbcd5dc548a86375b854b86acf9"
    )
    assert (
        result.valid_sigs[0].signing_key == "afcf5405e8f49dbcd5dc548a86375b854b86acf9"
    )

verify succeeds if at least one correct signature has been made by any of the certificates supplied. If you need more advanced policies they can be implemented by inspecting the valid_sigs property.

encrypt

Signs and encrypts a string to one or more recipients:

from pysequoia import encrypt

s = Tsk.from_file("passwd.pgp")
r = Cert.from_bytes(open("tests/fixtures/wiktor.asc", "rb").read())
content = "content to encrypt"
encrypted = encrypt(
    signer=s.signer("hunter22"), recipients=[r], bytes=content.encode("utf8")
)
print(f"Encrypted data: {encrypted.decode('utf8')}")

The signer argument is optional and when omitted the function will return an unsigned (but encrypted) message.

Encryption to symmetric keys is available via the passwords optional argument:

from pysequoia import encrypt

content = "content to encrypt"
encrypted = encrypt(passwords=["sekrit"], bytes=content.encode("utf8"))
print(f"Encrypted data: {encrypted.decode('utf8')}")

encrypt_file

Encrypts data from a file and writes the encrypted output to another file:

from pysequoia import encrypt_file
import tempfile, os

s = Tsk.from_file("passwd.pgp")
r = Cert.from_bytes(open("tests/fixtures/wiktor.asc", "rb").read())

# create a file with content to encrypt
with tempfile.NamedTemporaryFile(delete=False, suffix=".txt") as inp:
    inp.write("content to encrypt".encode("utf8"))
    input_path = inp.name

with tempfile.NamedTemporaryFile(delete=False, suffix=".pgp") as out:
    output_path = out.name

encrypt_file(
    signer=s.signer("hunter22"),
    recipients=[r],
    input=input_path,
    output=output_path,
)
assert b"PGP MESSAGE" in open(output_path, "rb").read()

os.unlink(input_path)
os.unlink(output_path)

decrypt

Decrypts plain data:

from pysequoia import decrypt

sender = Cert.from_file("no-passwd.pgp")
receiver = Cert.from_file("passwd.pgp")

content = "Red Green Blue"

encrypted = encrypt(recipients=[receiver], bytes=content.encode("utf8"))

decrypted = decrypt(
    decryptor=Tsk.from_file("passwd.pgp").decryptor("hunter22"), bytes=encrypted
)

assert content == decrypted.bytes.decode("utf8")
# this message did not contain any valid signatures
assert len(decrypted.valid_sigs) == 0

Decrypt can also verify signatures while decrypting:

from pysequoia import decrypt

sender = Cert.from_file("no-passwd.pgp")
receiver = Cert.from_file("passwd.pgp")

content = "Red Green Blue"

encrypted = encrypt(
    signer=Tsk.from_file("no-passwd.pgp").signer(),
    recipients=[receiver],
    bytes=content.encode("utf8"),
)


def get_certs_decrypt(key_ids):
    print(f"For verification after decryption, we need these keys: {key_ids}")
    return [sender]


decrypted = decrypt(
    decryptor=Tsk.from_file("passwd.pgp").decryptor("hunter22"),
    bytes=encrypted,
    store=get_certs_decrypt,
)

assert content == decrypted.bytes.decode("utf8")

# let's check the valid signature's certificate and signing subkey fingerprints
assert decrypted.valid_sigs[0].certificate == sender.fingerprint
assert decrypted.valid_sigs[0].signing_key == sender.fingerprint

Here, the same remarks as to verify also apply.

Decryption using symmetric keys is available via the passwords optional argument:

from pysequoia import encrypt

content = "content to encrypt"
encrypted = encrypt(passwords=["sekrit"], bytes=content.encode("utf8"))
print(f"Encrypted data: {encrypted.decode('utf8')}")
decrypted = decrypt(passwords=["sekrit"], bytes=encrypted)
print(f"Decrypted bytes: {decrypted.bytes!r}")

assert content == decrypted.bytes.decode("utf8")

decrypt_file

Decrypts data from a file and writes the decrypted output to another file:

from pysequoia import decrypt_file
import tempfile, os

sender = Cert.from_file("no-passwd.pgp")
receiver = Cert.from_file("passwd.pgp")

content = "Red Green Blue"

encrypted = encrypt(recipients=[receiver], bytes=content.encode("utf8"))

# write encrypted data to a file
with tempfile.NamedTemporaryFile(delete=False, suffix=".pgp") as inp:
    inp.write(encrypted)
    input_path = inp.name

with tempfile.NamedTemporaryFile(delete=False, suffix=".txt") as out:
    output_path = out.name

decrypted = decrypt_file(
    decryptor=Tsk.from_file("passwd.pgp").decryptor("hunter22"),
    input=input_path,
    output=output_path,
)

# content is written to the output file, not returned in memory
assert decrypted.bytes is None

# read decrypted content from the output file
assert open(output_path, "rb").read().decode("utf8") == content

# this message did not contain any valid signatures
assert len(decrypted.valid_sigs) == 0

os.unlink(input_path)
os.unlink(output_path)

Decrypt file can also verify signatures while decrypting:

from pysequoia import decrypt_file
import tempfile, os

sender = Cert.from_file("no-passwd.pgp")
receiver = Cert.from_file("passwd.pgp")

content = "Red Green Blue"

encrypted = encrypt(
    signer=Tsk.from_file("no-passwd.pgp").signer(),
    recipients=[receiver],
    bytes=content.encode("utf8"),
)

# write encrypted data to a file
with tempfile.NamedTemporaryFile(delete=False, suffix=".pgp") as inp:
    inp.write(encrypted)
    input_path = inp.name

with tempfile.NamedTemporaryFile(delete=False, suffix=".txt") as out:
    output_path = out.name


def get_certs_decrypt_file(key_ids):
    print(f"For verification after decryption, we need these keys: {key_ids}")
    return [sender]


decrypted = decrypt_file(
    decryptor=Tsk.from_file("passwd.pgp").decryptor("hunter22"),
    input=input_path,
    output=output_path,
    store=get_certs_decrypt_file,
)

assert open(output_path, "rb").read().decode("utf8") == content

# let's check the valid signature's certificate and signing subkey fingerprints
assert decrypted.valid_sigs[0].certificate == sender.fingerprint
assert decrypted.valid_sigs[0].signing_key == sender.fingerprint

os.unlink(input_path)
os.unlink(output_path)

Certificates

The Cert class represents one OpenPGP certificate (commonly called a "public key").

This package additionally verifies the certificate using Sequoia PGP's StandardPolicy. This means that certificates using weak cryptography can fail to load, or present a different view than in other OpenPGP software (e.g. if a User ID uses SHA-1 in its back-signature, it may be missing from the list of User IDs returned by this package).

Certificates have two forms, one is ASCII armored and one is raw bytes:

tsk = Tsk.generate("Test <test@example.com>")
cert = tsk.extract_certificate()

print(f"Armored cert: {cert}")
print(f"Bytes of the cert: {bytes(cert)!r}")

The public Cert never contains secret key material. To export the secret parts, serialize the Tsk itself:

print(f"Armored TSK: {tsk}")
print(f"Bytes of the TSK: {bytes(tsk)!r}")

Parsing

Certificates can be parsed from files (Cert.from_file) or bytes in memory (Cert.from_bytes).

cert1 = Tsk.generate("Test <test@example.com>").extract_certificate()
buffer = bytes(cert1)

parsed_cert = Cert.from_bytes(buffer)
assert str(parsed_cert.user_ids[0]) == "Test <test@example.com>"

They can also be picked from "keyring" files (Cert.split_file) or bytes in memory (Cert.split_bytes) which are collections of binary certificates.

cert1 = Tsk.generate("Test 1 <test-1@example.com>").extract_certificate()
cert2 = Tsk.generate("Test 2 <test-2@example.com>").extract_certificate()
cert3 = Tsk.generate("Test 3 <test-3@example.com>").extract_certificate()

buffer = bytes(cert1) + bytes(cert2) + bytes(cert3)
certs = Cert.split_bytes(buffer)
assert len(certs) == 3

generate

Creates a new general purpose key with a given User ID:

alice = Tsk.generate("Alice <alice@example.com>")
alice_pub = alice.extract_certificate()
fpr = alice_pub.fingerprint
print(f"Generated cert with fingerprint {fpr}:\n{alice_pub}")

Multiple User IDs can be passed as a list to the generate function:

cert = Tsk.generate(user_ids=["First", "Second", "Third"]).extract_certificate()
assert len(cert.user_ids) == 3

Newly generated certificates are usable in both encryption and signing contexts:

alice = Tsk.generate("Alice <alice@example.com>")
bob = Tsk.generate("Bob <bob@example.com>").extract_certificate()

content = "content to encrypt"

encrypted = encrypt(
    signer=alice.signer(), recipients=[bob], bytes=content.encode("utf8")
)
print(f"Encrypted data: {encrypted!r}")

The default is to generate keys according to RFC4880. By providing a profile parameter to the generate function, modern PGP keys can also be generated:

from pysequoia import Profile

mary = Tsk.generate(
    "Modern Mary <mary@example.com>", profile=Profile.RFC9580
).extract_certificate()
print(f"Generated cert with fingerprint {mary.fingerprint}:\n{mary}")

Note that legacy PGP implementations may not be able to consume these certificates yet.

Cipher suites

The cryptographic algorithms used for the generated key can be selected with the cipher_suite parameter. The default is Cv25519; RSA, NIST, and Curve448 suites are also available:

from pysequoia import CipherSuite

tsk = Tsk.generate("RSA <rsa@example.com>", cipher_suite=CipherSuite.RSA4k)
cert = tsk.extract_certificate()
print(f"Generated RSA cert with fingerprint {cert.fingerprint}")

The full list of suites is Cv25519, Cv448, RSA2k, RSA3k, RSA4k, P256, P384, P521, MLDSA65_Ed25519, and MLDSA87_Ed448.

Post-quantum cryptography

The two MLDSA* cipher suites generate post-quantum keys that combine ML-DSA/ML-KEM with a classical algorithm. These suites require Profile.RFC9580 (v6 keys):

from pysequoia import CipherSuite, Profile

pqc = Tsk.generate(
    "Post-Quantum <pqc@example.com>",
    profile=Profile.RFC9580,
    cipher_suite=CipherSuite.MLDSA65_Ed25519,
)

# these keys sign, verify, encrypt, and decrypt like any other
data = "post-quantum signed data".encode("utf8")
signed = sign(pqc.signer(), data)
result = verify(signed, lambda key_ids: [pqc.extract_certificate()])
assert result.bytes == data

Using MLDSA65_Ed25519 produces an ML-DSA-65 + Ed25519 signing key and an ML-KEM-768 + X25519 encryption subkey; MLDSA87_Ed448 selects the higher-security ML-DSA-87 + Ed448 / ML-KEM-1024 + X448 variant.

Fine-grained algorithm selection

For combinations beyond the paired presets, the signing and encryption algorithms can be chosen independently with the keyword-only signing_algorithm and encryption_algorithm parameters. This enables mixes such as stateless SLH-DSA signing with classical encryption, or a classical signing key with a post-quantum ML-KEM encryption subkey:

from pysequoia import Profile, SigningAlgorithm, EncryptionAlgorithm

# SLH-DSA signing key with the default encryption subkey
slh = Tsk.generate(
    "SLH-DSA <slh@example.com>",
    profile=Profile.RFC9580,
    signing_algorithm=SigningAlgorithm.SLHDSA128f,
)
signed = sign(slh.signer(), b"slh-dsa signed data")
result = verify(signed, lambda key_ids: [slh.extract_certificate()])
assert result.bytes == b"slh-dsa signed data"

# classical signing paired with a post-quantum encryption subkey
mixed = Tsk.generate(
    "Mixed <mixed@example.com>",
    profile=Profile.RFC9580,
    encryption_algorithm=EncryptionAlgorithm.MLKEM768_X25519,
)
encrypted = encrypt(recipients=[mixed.extract_certificate()], bytes=b"secret")
decrypted = decrypt(decryptor=mixed.decryptor(), bytes=encrypted)
assert decrypted.bytes == b"secret"

Signing algorithms are Ed25519, Ed448, MLDSA65_Ed25519, MLDSA87_Ed448, SLHDSA128s, SLHDSA128f, and SLHDSA256s. Encryption algorithms are X25519, X448, MLKEM768_X25519, and MLKEM1024_X448. As with the PQC cipher suites, post-quantum algorithms require Profile.RFC9580.

Expiration

The expiration is controlled via validity_seconds keyword argument:

assert (
    Tsk.generate(user_id="test", validity_seconds=3600).extract_certificate().expiration
    is not None
)

Using None generates a certificate with no expiration:

assert (
    Tsk.generate(user_id="test", validity_seconds=None).extract_certificate().expiration
    is None
)

By default certificates are generated without expiration time:

assert Tsk.generate("test").extract_certificate().expiration is None

[!WARNING] This behavior differs from the (now deprecated) Cert.generate which had a default expiration of 3 years.

merge

Merges packets from a new version into an old version of a certificate:

old = Cert.from_file("tests/fixtures/wiktor.asc")
new = Cert.from_file("tests/fixtures/wiktor-fresh.asc")
merged = old.merge(new)

User IDs

Listing existing User IDs:

cert = Cert.from_file("tests/fixtures/wiktor.asc")
user_id = cert.user_ids[0]
assert str(user_id).startswith("Wiktor Kwapisiewicz")

Adding new User IDs:

tsk = Tsk.generate("Alice <alice@example.com>")
cert = tsk.extract_certificate()
assert len(cert.user_ids) == 1
cert = cert.add_user_id(
    value="Alice <alice@company.invalid>", certifier=tsk.certifier()
)

assert len(cert.user_ids) == 2

Revoking User IDs:

tsk = Tsk.generate("Bob <bob@example.com>")
cert = tsk.extract_certificate()

cert = cert.add_user_id(value="Bob <bob@company.invalid>", certifier=tsk.certifier())
assert len(cert.user_ids) == 2

# create User ID revocation
revocation = cert.revoke_user_id(user_id=cert.user_ids[1], certifier=tsk.certifier())

# merge the revocation with the cert
cert = Cert.from_bytes(bytes(cert) + bytes(revocation))
assert len(cert.user_ids) == 1

Notations

Notations are small pieces of data that can be attached to signatures (and, indirectly, to User IDs).

The following example reads and displays a Keyoxide proof URI:

cert = Cert.from_file("tests/fixtures/wiktor.asc")
user_id = cert.user_ids[0]
notation = user_id.notations[0]

assert notation.key == "proof@metacode.biz"
assert notation.value == "dns:metacode.biz?type=TXT"

Notations can also be added:

from pysequoia import Notation

tsk = Tsk.from_file("tests/fixtures/signing-key.asc")
cert = tsk.extract_certificate()

# No notations initially
assert len(cert.user_ids[0].notations) == 0
cert = cert.set_notations(
    tsk.certifier(), [Notation("proof@metacode.biz", "dns:metacode.biz")]
)

# Has one notation now
print(str(cert.user_ids[0].notations))
assert len(cert.user_ids[0].notations) == 1
# Check the notation data
notation = cert.user_ids[0].notations[0]

assert notation.key == "proof@metacode.biz"
assert notation.value == "dns:metacode.biz"

Key expiration

Certs have an expiration getter for retrieving the current key expiry time:

cert = Cert.from_file("tests/fixtures/signing-key.asc")

# Cert does not have any expiration date:
assert cert.expiration is None

cert = Cert.from_file("tests/fixtures/wiktor.asc")
# Cert expires on New Year's Eve
assert str(cert.expiration) == "2022-12-31 12:00:02+00:00"

Key expiration can also be adjusted with set_expiration:

from datetime import datetime

tsk = Tsk.from_file("tests/fixtures/signing-key.asc")
cert = tsk.extract_certificate()

# Cert does not have any expiration date:
assert cert.expiration is None

# Set the expiration to some specified point in time
expiration = datetime.fromisoformat("2021-11-04T00:05:23+00:00")
cert = cert.set_expiration(expiration=expiration, certifier=tsk.certifier())
assert str(cert.expiration) == "2021-11-04 00:05:23+00:00"

Key revocation

Certs can be revoked. While expiration makes the key unusable temporarily to encourage the user to refresh a copy revocation is irreversible.

tsk = Tsk.generate("Test Revocation <revoke@example.com>")
cert = tsk.extract_certificate()
revocation = cert.revoke(certifier=tsk.certifier())

# creating revocation signature does not revoke the key
assert not cert.is_revoked

# importing revocation signature marks the key as revoked
revoked_cert = Cert.from_bytes(bytes(cert) + bytes(revocation))
assert revoked_cert.is_revoked

Secret keys

Certificates with secret keys are generated through Tsk.generate() and can be used for signing and decryption.

c = Tsk.generate("Testing key <test@example.com>")

Signatures

Detached signatures can be read directly from files (Sig.from_file) or bytes in memory (Sig.from_bytes):

from pysequoia import Sig

sig = Sig.from_file("tests/fixtures/sig.pgp")

print(f"Parsed signature: {repr(sig)}")

assert sig.issuer_fingerprint == "e8f23996f23218640cb44cbe75cf5ac418b8e74c"
assert sig.issuer_key_id == "75cf5ac418b8e74c"
assert sig.created == datetime.fromisoformat("2023-07-19T18:14:01+00:00")
assert sig.expiration == None
assert sig.signers_user_id == None

Packet iteration

The PacketPile class provides low-level access to individual OpenPGP packets in a key block, signed message, or other OpenPGP data. Each packet exposes a tag property identifying the packet type, along with type-specific accessors for extracting fields.

from pysequoia.packet import PacketPile, Tag, SignatureType

cert = Tsk.generate("Test <test@example.com>").extract_certificate()
pile = PacketPile.from_bytes(bytes(cert))

for packet in pile:
    if packet.tag == Tag.PublicKey or packet.tag == Tag.PublicSubkey:
        print(
            f"Key: fpr={packet.fingerprint}, algo={packet.key_algorithm}, created={packet.key_created}"
        )

    elif packet.tag == Tag.UserID:
        print(
            f"User ID: {packet.user_id} (name={packet.user_id_name}, email={packet.user_id_email})"
        )

    elif packet.tag == Tag.Signature:
        print(
            f"Signature: type={packet.signature_type}, hash={packet.hash_algorithm}, created={packet.signature_created}"
        )
        if packet.issuer_fingerprint is not None:
            print(f"  issuer: {packet.issuer_fingerprint}")
        if packet.signature_validity_period is not None:
            print(f"  expires in: {packet.signature_validity_period}")
        if packet.signature_expiration_time is not None:
            print(f"  expiration time: {packet.signature_expiration_time}")
        if packet.key_flags is not None:
            print(f"  key flags: {packet.key_flags}")
        if (
            packet.signature_type == SignatureType.DirectKey
            and packet.key_validity_period is not None
        ):
            print(f"  key validity period: {packet.key_validity_period}")

Individual packets also carry their raw body bytes (without the tag and length header), which can be useful for hashing or storing packet data:

from pysequoia.packet import PacketPile, Tag

packet = list(PacketPile.from_bytes(bytes(cert)))[0]
assert packet.tag == Tag.PublicKey
assert len(packet.body) > 0

ASCII armor

The armor function wraps raw binary data in ASCII armor, adding the appropriate header, base64 encoding, and CRC24 checksum:

from pysequoia import armor, ArmorKind

cert = Tsk.generate("Test <test@example.com>").extract_certificate()
armored = armor(bytes(cert), ArmorKind.PublicKey)  # same as: str(cert)
assert "-----BEGIN PGP PUBLIC KEY BLOCK-----" in armored
assert "-----END PGP PUBLIC KEY BLOCK-----" in armored

Other armor kinds are available for different data types:

from pysequoia import armor, ArmorKind

armored_msg = armor(b"dummy data", ArmorKind.Message)
assert "BEGIN PGP MESSAGE" in armored_msg

armored_sig = armor(b"dummy data", ArmorKind.Signature)
assert "BEGIN PGP SIGNATURE" in armored_sig

Note that both Cert and Sig when converted to strings (str(...)) will produce correct ASCII-armored representation.

License

This project is licensed under Apache License, Version 2.0.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the package by you shall be under the terms and conditions of this license, without any additional terms or conditions.