Exception handling in _copy_data is too broad

[johnnicely-cl]

Describe the bug
We inadvertently passed the wrong data type into the encrypt_file method. While the error was logged, it does not result in an exception that we can catch, which caused the task encrypting data to be marked as successful even though it had failed. The error message was:

[2025-05-21T18:59:50.163+0000] {gnupg.py:167} ERROR - Error sending data
Traceback (most recent call last):
  File "/usr/local/airflow/.local/lib/python3.11/site-packages/gnupg.py", line 161, in _copy_data
    outstream.write(data)
TypeError: a bytes-like object is required, not 'str'

This exception is not passed up the stack because it is swallowed at line 167.

To Reproduce
Steps to reproduce the behavior:

1. Call encrypt_file with a string instead of a bytes-like object.

Expected behavior
The TypeError should be thrown up the stack.

Screenshots
N/A

Environment

• OS: Linux
• Version of this library: 0.5.4
• Version of GnuPG: 2.3.7

Additional information
N/A

[vsajip]

Can you please clarify exactly the call you made? encrypt_file is meant to be called with a stream, not a string (nor bytes). I tried calling it with an io.StringIO instance, but no error was raised in _copy_data in that case.

[vsajip]

OK, I see it now. Please try with the latest repo version (6ca3eb5 or later) and report back if it solves the problem.

[johnnicely-cl]

Sorry for the delayed response here, I went to try to reproduce this with my own instructions and realized a) I gave bad steps to reproduce and b) I had the wrong idea about what was happening and then spent the whole day "exploring". 😅 We weren't passing a string, we were using io.StringIO, just like you did. And that actually seems to be the underlying issue - the stdin created in _handle_io is an io.BufferedWriter, and it wants to receive an io.BytesIO, not io.StringIO. So switching to io.BytesIO will fix the immediate issue.

I wrote a little test script that demonstrates this. Change the variables at the top to have the path to your GPG private key and the passphrase, then run and you'll see output like this:

$ python gnupg-255.py
encrypt with <class 'str'>: encrypted ok=True, status=encryption ok, data=886
encrypt with <class 'str'>: decrypted ok=True, status=decryption ok, data=b'This is a test string' (21)
encrypt_file with <class '_io.BytesIO'>: encrypted ok=True, status=encryption ok, data=886
encrypt_file with <class '_io.BytesIO'>: decrypted ok=True, status=decryption ok, data=b'This is a test string' (21)
Error sending data
Traceback (most recent call last):
  File "~/.pyenv/versions/3.12.4/lib/python3.12/site-packages/gnupg.py", line 161, in _copy_data
    outstream.write(data)
TypeError: a bytes-like object is required, not 'str'
encrypt_file with <class '_io.StringIO'>: encrypted ok=True, status=encryption ok, data=858
encrypt_file with <class '_io.StringIO'>: decrypted ok=True, status=decryption ok, data=b'' (0)

The last check is the one we're talking about here. Notice that encrypted.ok and encrypted.status indicate the encryption was successful, and encrypted.data even has a non-empty value... But when you decrypt it, it's an empty string. 😄

As for the exception, I tried running this with the commit you linked to and no dice - still just outputs the exception, but it doesn't get thrown up the stack to anywhere I can catch it (I tested with the gist linked above - you'll see the TypeError doesn't get caught if you run). I missed the complexity of what is going on there with the subprocess on the first pass - that's gnarly!

[vsajip]

As for the exception, I tried running this with the commit you linked to and no dice

That's curious. I added a test for this specific thing, and that seems to pass:

    def test_exception_propagation(self):
        if sys.version_info[0] < 3:
            raise unittest.SkipTest('python 2 is too loose with Unicode')
        key = self.generate_key('Andrew', 'Able', 'alpha.com', passphrase='andy')
        self.assertEqual(0, key.returncode, 'Non-zero return code')
        andrew = key.fingerprint
        stream = io.StringIO(u'Hello, world!')  # make the wrong type of stream
        self.assertRaises(TypeError, self.gpg.encrypt_file, stream, [andrew], armor=False)

Does this test fail on your system?

[johnnicely-cl]

@vsajip The test did fail - I was using an older version of the code and forgot to swap it out. 🤦‍♂ After updating the code I was using to test, I do see it. Sorry about that!

[vsajip]

OK, so I assume I can mark this issue as completed.

[johnnicely-cl]

Yes, thank you!