Might I suggest a library that doesn't call out to system binaries and wouldn't be subject to shell injection by design?
https://github.com/SecurityInnovation/PGPy
Python-GnuPG
11–16 of 16 posts
Re: Python-GnuPG
#12It is really unfortunate that a library is licensed under the GPL. It means any released software that uses this also has be GPL, which restricts the freedom of the downstream developer from making their own software be licensed under their preferred license. This library calls out to the gpg binary, so there is no reason it has to be GPL.
License choice is about the goals of the author. It can be complex, but as a simplification:
* Goal: Maximise software using my component: one of the BSD's. Rationale: anyone can build on it or fork it.
* Goal: Maximise contribution to the component OR total amount of Free Software: Choose one of the GPLs. Rationale: everyone has to share the same responsibilities to go with the rights.
As someone else pointed out - LGPL for libraries is a middle choice.
Ultimately, only the creator chooses the goal.
Re: Python-GnuPG
#13Re: Python-GnuPG
#14Earlier quoted context omitted.
For a library LGPL would be a better choice than GPL.
Evidently not, as the author of the library chose GPL.
Any time someone makes a choice, that is automatically the correct choice.
It never happens that someone makes a choice, like what license to use, because they are only familiar with a subset of all choices, or because they have been misinformed or have misunderstood something.
Right?
Re: Python-GnuPG
#15Re: Python-GnuPG
#16Earlier quoted context omitted.
Evidently not, as the author of the library chose GPL.
Any time someone makes a choice, that is automatically the correct choice. It never happens that someone makes a choice, like what license to use, because they are only familiar with a subset of all choices, or because they have been misinformed or have misunderstood something. Right?
Right, it is better to speculate without evidence that the author made a mistake rather than rest on the default position that what they did is what they knowingly intended.