I'm building an application in CFMX 6.1 (on Windows 2000
Server) that needs to take a file or files encrypted with our GPG
public key and decrypt them to produce XML files. I'm using GnuPG,
and have worked out all the encrypt/decrypt stuff on the command
line of the server. I then was using the cfGnuPG CFC with the
gpg.jar Java wrapper to encrypt and decrypt data streams, which
worked great, but the gpgDecrypt function in that CFC doesn't seem
to handle full files, and if I read the file contents into a
variable and then try to decrypt it, it fails.
So what I'm now back to trying is to use CFEXECUTE to call
the decryption function. This command works from the command prompt
on the server:
I put my passphrase in a text file and pass it into the
passphrase-fd parameter as suggested, and the file designated is
decrypted and saved as the new filename.
However, executing this command from CFEXECUTE just hangs--I
see a new gpg.exe process spawn on the server, but no output is
returned (see attached code). The outputfile is created, but
remains empty, and the CF page times out after the 120 seconds. I
can do a simple CFEXECUTE of gpg.exe with the "--list-keys"
argument, and it returns the correct output. So what's different
about this decrypt command? If the command were producing a
response prompt, shouldn't that write to the outputfile?
I gather that the CFEXEXCUTE process runs GPG under the
"Default User" profile, since when I used it to create keys, that's
where they went. Is that correct?
If anybody has any ideas, or a better way to do this, please
let me know.
kylemurphy2009, Feb 8, 2010 9:52 AM
Most likely this is a account/user profile issue. If I
remember correctly, the current profile is the profile of currently
logged-in interactive user, which may or may not be "default
profile". Also, to access other user profile the account must have
a permission, which is not the case for the SYSTEM account.
Therefore, even a necessary profile is loaded, the CF might not be
able to access it.
If you set CF service to run under the same interactive
account under which the command line works, and after that
CFEXECUTE works - this is it. You also can try to enable "Allow
service to interact with desktop" for debugging purposes. So, you
would actually see that DOS window that might contain error message
and/or prompt for something.
You also may try
this tag that
allows some of the above, if you cannot change settings on the
I found my own solution. I think Mr Black is probably right
about the user profile deal with CFEXECUTE, but it just seemed like
a kludgey solution anyway. What the cfGnuPG CFC/wrapper was missing
was a way to invoke GPG to decrypt a FILE, rather than a data
stream. So I added a new method to the gnuPG.class file originally
provided by Wayne Graham in his CFDJ article to do
"decryptFile"--basically, you just pass it a filename instead of a
data stream and it works the same way. I also added an optional
parameter to it for the output file (GPG option -o), since I found
that decrypting the file to output the results was inconsistent
(sometimes it would work, other times it would hang). By telling
GPG to write the decrypted content to a file, it worked perfect
If anyone would like the revised gpg.jar file with the
additional method, feel free to email me.