From b25c147579eda99f2eebde03c5c1274033898e3c Mon Sep 17 00:00:00 2001
From: Joshua Lock <jlock@vmware.com>
Date: Thu, 6 Feb 2020 11:42:03 +0000
Subject: [PATCH 1/5] Add HAVE_GPG constant to indicate if gpg binary is
 available

securesystemslib.gpg.constants checks for the presence of a gpg
binary at import time, save the result of this search in a constant
HAVE_GPG so that we can use it later to present meaningful error
messages when a function requiring gpg is called and the command
isn't available.

Signed-off-by: Joshua Lock <jlock@vmware.com>
---
 securesystemslib/gpg/constants.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/securesystemslib/gpg/constants.py b/securesystemslib/gpg/constants.py
index 3b9d975e..21a87b81 100644
--- a/securesystemslib/gpg/constants.py
+++ b/securesystemslib/gpg/constants.py
@@ -31,6 +31,10 @@
 GPG_VERSION_COMMAND = GPG_COMMAND + " --version"
 FULLY_SUPPORTED_MIN_VERSION = "2.1.0"
 
+HAVE_GPG = True
+NO_GPG_MSG = "GPG support requires a GPG command, {} version {} or newer is" \
+  " fully supported.".format(GPG_COMMAND, FULLY_SUPPORTED_MIN_VERSION)
+
 try:
   proc = process.run(GPG_VERSION_COMMAND, stdout=process.PIPE,
     stderr=process.PIPE)
@@ -39,6 +43,13 @@
   GPG_COMMAND = "gpg"
   GPG_VERSION_COMMAND = GPG_COMMAND + " --version"
 
+  try:
+    proc = process.run(GPG_VERSION_COMMAND, stdout=process.PIPE,
+      stderr=process.PIPE)
+
+  except OSError:
+    HAVE_GPG = False
+
 GPG_SIGN_COMMAND = GPG_COMMAND + \
                    " --detach-sign --digest-algo SHA256 {keyarg} {homearg}"
 GPG_EXPORT_PUBKEY_COMMAND = GPG_COMMAND + " {homearg} --export {keyid}"

From 1439826a79fef97cb33a76b9271da396b64822cf Mon Sep 17 00:00:00 2001
From: Joshua Lock <jlock@vmware.com>
Date: Thu, 6 Feb 2020 12:03:56 +0000
Subject: [PATCH 2/5] Handle missing gpg command in functions which call it

Raise an UnsupportedLibraryError exception when functions that rely on
invoking the gpg command are called on a system where gpg is unavailable.

Signed-off-by: Joshua Lock <jlock@vmware.com>
---
 securesystemslib/gpg/functions.py | 22 +++++++++++++++++++++-
 securesystemslib/gpg/util.py      |  9 +++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/securesystemslib/gpg/functions.py b/securesystemslib/gpg/functions.py
index e102b9fb..af5659a3 100644
--- a/securesystemslib/gpg/functions.py
+++ b/securesystemslib/gpg/functions.py
@@ -18,10 +18,12 @@
 import logging
 import time
 
+import securesystemslib.exceptions
 import securesystemslib.gpg.common
 import securesystemslib.gpg.exceptions
 from securesystemslib.gpg.constants import (GPG_EXPORT_PUBKEY_COMMAND,
-    GPG_SIGN_COMMAND, SIGNATURE_HANDLERS, FULLY_SUPPORTED_MIN_VERSION, SHA256)
+    GPG_SIGN_COMMAND, SIGNATURE_HANDLERS, FULLY_SUPPORTED_MIN_VERSION, SHA256,
+    HAVE_GPG, NO_GPG_MSG)
 
 import securesystemslib.process
 import securesystemslib.formats
@@ -66,6 +68,9 @@ def create_signature(content, keyid=None, homedir=None):
     OSError:
             If the gpg command is not present or non-executable.
 
+    securesystemslib.exceptions.UnsupportedLibraryError:
+            If the gpg command is not available
+
     securesystemslib.gpg.exceptions.CommandError:
             If the gpg command returned a non-zero exit code
 
@@ -81,6 +86,9 @@ def create_signature(content, keyid=None, homedir=None):
     securesystemslib.formats.GPG_SIGNATURE_SCHEMA.
 
   """
+  if not HAVE_GPG: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_GPG_MSG)
+
   keyarg = ""
   if keyid:
     securesystemslib.formats.KEYID_SCHEMA.check_match(keyid)
@@ -177,6 +185,9 @@ def verify_signature(signature_object, pubkey_info, content):
     securesystemslib.gpg.exceptions.KeyExpirationError:
             if the passed public key has expired
 
+    securesystemslib.exceptions.UnsupportedLibraryError:
+            If the gpg command is not available
+
   <Side Effects>
     None.
 
@@ -184,6 +195,9 @@ def verify_signature(signature_object, pubkey_info, content):
     True if signature verification passes, False otherwise.
 
   """
+  if not HAVE_GPG: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_GPG_MSG)
+
   securesystemslib.formats.GPG_PUBKEY_SCHEMA.check_match(pubkey_info)
   securesystemslib.formats.GPG_SIGNATURE_SCHEMA.check_match(signature_object)
 
@@ -233,6 +247,9 @@ def export_pubkey(keyid, homedir=None):
     ValueError:
             if the keyid does not match the required format.
 
+    securesystemslib.exceptions.UnsupportedLibraryError:
+            If the gpg command is not available.
+
     securesystemslib.gpg.execeptions.KeyNotFoundError:
             if no key or subkey was found for that keyid.
 
@@ -245,6 +262,9 @@ def export_pubkey(keyid, homedir=None):
     securesystemslib.formats.GPG_PUBKEY_SCHEMA.
 
   """
+  if not HAVE_GPG: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_GPG_MSG)
+
   if not securesystemslib.formats.KEYID_SCHEMA.matches(keyid):
     # FIXME: probably needs smarter parsing of what a valid keyid is so as to
     # not export more than one pubkey packet.
diff --git a/securesystemslib/gpg/util.py b/securesystemslib/gpg/util.py
index e1407007..566b6dce 100644
--- a/securesystemslib/gpg/util.py
+++ b/securesystemslib/gpg/util.py
@@ -24,6 +24,7 @@
 import cryptography.hazmat.backends as backends
 import cryptography.hazmat.primitives.hashes as hashing
 
+import securesystemslib.exceptions
 import securesystemslib.gpg.exceptions
 import securesystemslib.process
 import securesystemslib.gpg.constants
@@ -294,10 +295,18 @@ def get_version():
 
     The executed base command is defined in constants.GPG_VERSION_COMMAND.
 
+  <Exceptions>
+    securesystemslib.exceptions.UnsupportedLibraryError:
+            If the gpg command is not available
+
   <Returns>
     Version number string, e.g. "2.1.22"
 
   """
+  if not securesystemslib.gpg.constants.HAVE_GPG: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(
+        securesystemslib.gpg.constants.NO_GPG_MSG)
+
   command = securesystemslib.gpg.constants.GPG_VERSION_COMMAND
   process = securesystemslib.process.run(command,
       stdout=securesystemslib.process.PIPE,

From 51ae7f0512e40f454503906b03592c6ee5ba9c32 Mon Sep 17 00:00:00 2001
From: Joshua Lock <jlock@vmware.com>
Date: Thu, 6 Feb 2020 21:26:01 +0000
Subject: [PATCH 3/5] Handle missing imports in gpg modules

Raise UnsupportedLibraryError from each function in the gpg modules
when the native libraries needed by that function aren't available.

Signed-off-by: Joshua Lock <jlock@vmware.com>
---
 securesystemslib/gpg/dsa.py   | 34 +++++++++++++++++++++++++++++-----
 securesystemslib/gpg/eddsa.py | 29 ++++++++++++++++++++++++-----
 securesystemslib/gpg/rsa.py   | 28 +++++++++++++++++++++++-----
 securesystemslib/gpg/util.py  | 22 ++++++++++++++++++----
 4 files changed, 94 insertions(+), 19 deletions(-)

diff --git a/securesystemslib/gpg/dsa.py b/securesystemslib/gpg/dsa.py
index 790e3704..f0ad45a1 100644
--- a/securesystemslib/gpg/dsa.py
+++ b/securesystemslib/gpg/dsa.py
@@ -16,16 +16,22 @@
 """
 import binascii
 
-import cryptography.hazmat.primitives.asymmetric.dsa as dsa
-import cryptography.hazmat.backends as backends
-import cryptography.hazmat.primitives.asymmetric.utils as dsautils
-import cryptography.exceptions
+CRYPTO = True
+NO_CRYPTO_MSG = 'DSA key support for GPG requires the cryptography library'
+try:
+  import cryptography.hazmat.primitives.asymmetric.dsa as dsa
+  import cryptography.hazmat.backends as backends
+  import cryptography.hazmat.primitives.asymmetric.utils as dsautils
+  import cryptography.exceptions
+except ImportError:
+  CRYPTO = False
 
 import securesystemslib.gpg.util
 import securesystemslib.gpg.exceptions
-
+import securesystemslib.exceptions
 import securesystemslib.formats
 
+
 def create_pubkey(pubkey_info):
   """
   <Purpose>
@@ -41,11 +47,17 @@ def create_pubkey(pubkey_info):
     securesystemslib.exceptions.FormatError if
       pubkey_info does not match securesystemslib.formats.GPG_DSA_PUBKEY_SCHEMA
 
+    securesystemslib.exceptions.UnsupportedLibraryError if
+      the cryptography module is not available
+
   <Returns>
     A cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey based on the
     passed pubkey_info.
 
   """
+  if not CRYPTO: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
+
   securesystemslib.formats.GPG_DSA_PUBKEY_SCHEMA.check_match(pubkey_info)
 
   y = int(pubkey_info['keyval']['public']['y'], 16)
@@ -138,12 +150,18 @@ def get_signature_params(data):
     securesystemslib.gpg.exceptions.PacketParsingError:
            if the public key parameters are malformed
 
+    securesystemslib.exceptions.UnsupportedLibraryError:
+           if the cryptography module is not available
+
   <Side Effects>
     None.
 
   <Returns>
     The decoded signature buffer
   """
+  if not CRYPTO: # pragma: no cover
+    return securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
+
   ptr = 0
   r_length = securesystemslib.gpg.util.get_mpi_length(data[ptr:ptr+2])
   ptr += 2
@@ -198,6 +216,9 @@ def verify_signature(signature_object, pubkey_info, content,
       signature_object does not match securesystemslib.formats.GPG_SIGNATURE_SCHEMA
       pubkey_info does not match securesystemslib.formats.GPG_DSA_PUBKEY_SCHEMA
 
+    securesystemslib.exceptions.UnsupportedLibraryError if:
+      the cryptography module is not available
+
     ValueError:
       if the passed hash_algorithm_id is not supported (see
       securesystemslib.gpg.util.get_hashing_class)
@@ -206,6 +227,9 @@ def verify_signature(signature_object, pubkey_info, content,
     True if signature verification passes and False otherwise
 
   """
+  if not CRYPTO: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
+
   securesystemslib.formats.GPG_SIGNATURE_SCHEMA.check_match(signature_object)
   securesystemslib.formats.GPG_DSA_PUBKEY_SCHEMA.check_match(pubkey_info)
 
diff --git a/securesystemslib/gpg/eddsa.py b/securesystemslib/gpg/eddsa.py
index f52ec589..cf716b3e 100644
--- a/securesystemslib/gpg/eddsa.py
+++ b/securesystemslib/gpg/eddsa.py
@@ -18,12 +18,19 @@
 """
 import binascii
 import struct
+import securesystemslib.exceptions
 import securesystemslib.gpg.util
-import cryptography.hazmat.primitives.asymmetric.utils as pyca_utils
-import cryptography.hazmat.primitives.asymmetric.ed25519 as pyca_ed25519
-import cryptography.hazmat.backends as pyca_backends
-import cryptography.hazmat.primitives.hashes as pyca_hashing
-import cryptography.exceptions
+
+CRYPTO = True
+NO_CRYPTO_MSG = 'EdDSA key support for GPG requires the cryptography library'
+try:
+  import cryptography.hazmat.primitives.asymmetric.utils as pyca_utils
+  import cryptography.hazmat.primitives.asymmetric.ed25519 as pyca_ed25519
+  import cryptography.hazmat.backends as pyca_backends
+  import cryptography.hazmat.primitives.hashes as pyca_hashing
+  import cryptography.exceptions
+except ImportError:
+  CRYPTO = False
 
 # ECC Curve OID (see RFC4880-bis8 9.2.)
 ED25519_PUBLIC_KEY_OID = bytearray.fromhex("2B 06 01 04 01 DA 47 0F 01")
@@ -153,11 +160,17 @@ def create_pubkey(pubkey_info):
     securesystemslib.exceptions.FormatError if
       pubkey_info does not match securesystemslib.formats.GPG_DSA_PUBKEY_SCHEMA
 
+    securesystemslib.exceptions.UnsupportedLibraryError if
+      the cryptography module is unavailable
+
   <Returns>
     A cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey based
     on the passed pubkey_info.
 
   """
+  if not CRYPTO: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
+
   securesystemslib.formats.GPG_ED25519_PUBKEY_SCHEMA.check_match(pubkey_info)
 
   public_bytes = binascii.unhexlify(pubkey_info["keyval"]["public"]["q"])
@@ -197,6 +210,9 @@ def verify_signature(signature_object, pubkey_info, content,
       signature_object does not match securesystemslib.formats.GPG_SIGNATURE_SCHEMA
       pubkey_info does not match securesystemslib.formats.GPG_ED25519_PUBKEY_SCHEMA
 
+    securesystemslib.exceptions.UnsupportedLibraryError if:
+      the cryptography module is unavailable
+
     ValueError:
       if the passed hash_algorithm_id is not supported (see
       securesystemslib.gpg.util.get_hashing_class)
@@ -205,6 +221,9 @@ def verify_signature(signature_object, pubkey_info, content,
     True if signature verification passes and False otherwise.
 
   """
+  if not CRYPTO: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
+
   securesystemslib.formats.GPG_SIGNATURE_SCHEMA.check_match(signature_object)
   securesystemslib.formats.GPG_ED25519_PUBKEY_SCHEMA.check_match(pubkey_info)
 
diff --git a/securesystemslib/gpg/rsa.py b/securesystemslib/gpg/rsa.py
index 1cbfb691..907ed03d 100644
--- a/securesystemslib/gpg/rsa.py
+++ b/securesystemslib/gpg/rsa.py
@@ -16,14 +16,20 @@
 """
 import binascii
 
-import cryptography.hazmat.primitives.asymmetric.rsa as rsa
-import cryptography.hazmat.backends as backends
-import cryptography.hazmat.primitives.asymmetric.padding as padding
-import cryptography.hazmat.primitives.asymmetric.utils as utils
-import cryptography.exceptions
+CRYPTO = True
+NO_CRYPTO_MSG = 'RSA key support for GPG requires the cryptography library'
+try:
+  import cryptography.hazmat.primitives.asymmetric.rsa as rsa
+  import cryptography.hazmat.backends as backends
+  import cryptography.hazmat.primitives.asymmetric.padding as padding
+  import cryptography.hazmat.primitives.asymmetric.utils as utils
+  import cryptography.exceptions
+except ImportError:
+  CRYPTO = False
 
 import securesystemslib.gpg.util
 import securesystemslib.gpg.exceptions
+import securesystemslib.exceptions
 import securesystemslib.formats
 
 
@@ -42,11 +48,17 @@ def create_pubkey(pubkey_info):
     securesystemslib.exceptions.FormatError if
       pubkey_info does not match securesystemslib.formats.GPG_RSA_PUBKEY_SCHEMA
 
+    securesystemslib.exceptions.UnsupportedLibraryError if
+      the cryptography module is unavailable
+
   <Returns>
     A cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey based on the
     passed pubkey_info.
 
   """
+  if not CRYPTO: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
+
   securesystemslib.formats.GPG_RSA_PUBKEY_SCHEMA.check_match(pubkey_info)
 
   e = int(pubkey_info['keyval']['public']['e'], 16)
@@ -165,6 +177,9 @@ def verify_signature(signature_object, pubkey_info, content,
       securesystemslib.formats.GPG_SIGNATURE_SCHEMA,
       pubkey_info does not match securesystemslib.formats.GPG_RSA_PUBKEY_SCHEMA
 
+    securesystemslib.exceptions.UnsupportedLibraryError if:
+      the cryptography module is unavailable
+
     ValueError:
       if the passed hash_algorithm_id is not supported (see
       securesystemslib.gpg.util.get_hashing_class)
@@ -173,6 +188,9 @@ def verify_signature(signature_object, pubkey_info, content,
     True if signature verification passes and False otherwise
 
   """
+  if not CRYPTO: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
+
   securesystemslib.formats.GPG_SIGNATURE_SCHEMA.check_match(signature_object)
   securesystemslib.formats.GPG_RSA_PUBKEY_SCHEMA.check_match(pubkey_info)
 
diff --git a/securesystemslib/gpg/util.py b/securesystemslib/gpg/util.py
index 566b6dce..228335b7 100644
--- a/securesystemslib/gpg/util.py
+++ b/securesystemslib/gpg/util.py
@@ -21,8 +21,13 @@
 
 from distutils.version import StrictVersion # pylint: disable=no-name-in-module,import-error
 
-import cryptography.hazmat.backends as backends
-import cryptography.hazmat.primitives.hashes as hashing
+CRYPTO = True
+NO_CRYPTO_MSG = 'gpg.utils requires the cryptography library'
+try:
+  import cryptography.hazmat.backends as backends
+  import cryptography.hazmat.primitives.hashes as hashing
+except ImportError:
+  CRYPTO = False
 
 import securesystemslib.exceptions
 import securesystemslib.gpg.exceptions
@@ -74,7 +79,8 @@ def hash_object(headers, algorithm, content):
     content: the signed content
 
   <Exceptions>
-    None
+    securesystemslib.exceptions.UnsupportedLibraryError if:
+      the cryptography module is unavailable
 
   <Side Effects>
     None
@@ -82,6 +88,9 @@ def hash_object(headers, algorithm, content):
   <Returns>
     The RFC4880-compliant hashed buffer
   """
+  if not CRYPTO: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
+
   # As per RFC4880 Section 5.2.4., we need to hash the content,
   # signature headers and add a very opinionated trailing header
   hasher = hashing.Hash(algorithm, backend=backends.default_backend())
@@ -210,7 +219,8 @@ def compute_keyid(pubkey_packet_data):
     pubkey_packet_data: the public-key packet buffer
 
   <Exceptions>
-    None
+    securesystemslib.exceptions.UnsupportedLibraryError if:
+      the cryptography module is unavailable
 
   <Side Effects>
     None
@@ -218,12 +228,16 @@ def compute_keyid(pubkey_packet_data):
   <Returns>
     The RFC4880-compliant hashed buffer
   """
+  if not CRYPTO: # pragma: no cover
+    raise securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
+
   hasher = hashing.Hash(hashing.SHA1(), backend=backends.default_backend())
   hasher.update(b'\x99')
   hasher.update(struct.pack(">H", len(pubkey_packet_data)))
   hasher.update(bytes(pubkey_packet_data))
   return binascii.hexlify(hasher.finalize()).decode("ascii")
 
+
 def parse_subpacket_header(data):
   """ Parse out subpacket header as per RFC4880 5.2.3.1. Signature Subpacket
   Specification. """

From d4ef1f9dbfad663b3628e9c7d6ef4845b9e41cb5 Mon Sep 17 00:00:00 2001
From: Joshua Lock <jlock@vmware.com>
Date: Thu, 6 Feb 2020 17:13:13 +0000
Subject: [PATCH 4/5] Tests GPG interfaces when gpg command isn't installed

Signed-off-by: Joshua Lock <jlock@vmware.com>
---
 .travis.yml                      |  4 ++++
 tests/check_public_interfaces.py | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index ea00c336..cb2117b6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,6 +8,8 @@ matrix:
       env: TOXENV=py27
     - python: "2.7"
       env: TOXENV=purepy27
+      before_install:
+        - sudo apt-get remove -y --allow-remove-essential gnupg gnupg2
     - python: "3.5"
       env: TOXENV=py35
     - python: "3.6"
@@ -18,6 +20,8 @@ matrix:
       env: TOXENV=py38
     - python: "3.8"
       env: TOXENV=purepy38
+      before_install:
+        - sudo apt-get remove -y  --allow-remove-essential gnupg gnupg2
 
 install:
   - pip install -U tox coveralls
diff --git a/tests/check_public_interfaces.py b/tests/check_public_interfaces.py
index 970ec90c..bcfe78b7 100644
--- a/tests/check_public_interfaces.py
+++ b/tests/check_public_interfaces.py
@@ -43,6 +43,9 @@
 
 
 import securesystemslib.exceptions
+import securesystemslib.gpg.constants
+import securesystemslib.gpg.functions
+import securesystemslib.gpg.util
 import securesystemslib.interface
 import securesystemslib.keys
 
@@ -194,6 +197,21 @@ def test_purepy_ed25519(self):
         pub, 'ed25519', bsig, data)
     self.assertEqual(False, invalid)
 
+  def test_gpg_cmds(self):
+    """Ensure functions calling GPG commands throw an appropriate error"""
+
+    with self.assertRaises(securesystemslib.exceptions.UnsupportedLibraryError):
+      securesystemslib.gpg.functions.create_signature('bar')
+
+    with self.assertRaises(securesystemslib.exceptions.UnsupportedLibraryError):
+      securesystemslib.gpg.functions.verify_signature(None, 'f00', 'bar')
+
+    with self.assertRaises(securesystemslib.exceptions.UnsupportedLibraryError):
+      securesystemslib.gpg.functions.export_pubkey('f00')
+
+    with self.assertRaises(securesystemslib.exceptions.UnsupportedLibraryError):
+      securesystemslib.gpg.util.get_version()
+
 
 if __name__ == '__main__':
   suite = unittest.TestLoader().loadTestsFromTestCase(TestPublicInterfaces)

From d6c393343db1391fdc5fd6185d9bdad11d933791 Mon Sep 17 00:00:00 2001
From: Joshua Lock <jlock@vmware.com>
Date: Mon, 10 Feb 2020 10:40:37 +0000
Subject: [PATCH 5/5] Tidy up GPG related tests to use HAVE_GPG constant

We don't need to detect the presence of the GPG command and set
environment variables, instead we can use the HAVE_GPG constant which
indicated whether a usable GPG command is present on the system.

Signed-off-by: Joshua Lock <jlock@vmware.com>
---
 tests/aggregate_tests.py | 20 --------------------
 tests/test_gpg.py        | 12 ++++++------
 2 files changed, 6 insertions(+), 26 deletions(-)

diff --git a/tests/aggregate_tests.py b/tests/aggregate_tests.py
index a1b23e85..a5f49096 100755
--- a/tests/aggregate_tests.py
+++ b/tests/aggregate_tests.py
@@ -31,30 +31,10 @@
 from __future__ import division
 from __future__ import unicode_literals
 
-import os
 import sys
 import unittest
-import subprocess
-
-def check_usable_gpg():
-  """Set `TEST_SKIP_GPG` environment variable if neither gpg2 nor gpg is
-  available. """
-  os.environ["TEST_SKIP_GPG"] = "1"
-  for gpg in ["gpg2", "gpg"]:
-    try:
-      subprocess.check_call([gpg, "--version"])
-
-    except OSError:
-      pass
-
-    else:
-      # If one of the two exists, we can unset the skip envvar and ...
-      os.environ.pop("TEST_SKIP_GPG", None)
-      # ... abort the availability check.:
-      break
 
 if __name__ == '__main__':
-  check_usable_gpg()
   suite = unittest.TestLoader().discover("tests", top_level_dir=".")
   all_tests_passed = unittest.TextTestRunner(
       verbosity=1, buffer=True).run(suite).wasSuccessful()
diff --git a/tests/test_gpg.py b/tests/test_gpg.py
index 4b00e57b..85ed757d 100644
--- a/tests/test_gpg.py
+++ b/tests/test_gpg.py
@@ -51,14 +51,14 @@
     _get_verified_subkeys, parse_signature_packet)
 from securesystemslib.gpg.constants import (SHA1, SHA256, SHA512,
     GPG_EXPORT_PUBKEY_COMMAND, PACKET_TYPE_PRIMARY_KEY, PACKET_TYPE_USER_ID,
-    PACKET_TYPE_USER_ATTR, PACKET_TYPE_SUB_KEY)
+    PACKET_TYPE_USER_ATTR, PACKET_TYPE_SUB_KEY, HAVE_GPG)
 from securesystemslib.gpg.exceptions import (PacketParsingError,
     PacketVersionNotSupportedError, SignatureAlgorithmNotSupportedError,
     KeyNotFoundError, CommandError, KeyExpirationError)
 from securesystemslib.formats import GPG_PUBKEY_SCHEMA
 
 
-@unittest.skipIf(os.getenv("TEST_SKIP_GPG"), "gpg not found")
+@unittest.skipIf(not HAVE_GPG, "gpg not found")
 class TestUtil(unittest.TestCase):
   """Test util functions. """
   def test_version_utils_return_types(self):
@@ -171,7 +171,7 @@ def test_parse_subpacket_header(self):
       self.assertEqual(result, expected[idx])
 
 
-@unittest.skipIf(os.getenv("TEST_SKIP_GPG"), "gpg not found")
+@unittest.skipIf(not HAVE_GPG, "gpg not found")
 class TestCommon(unittest.TestCase):
   """Test common functions of the securesystemslib.gpg module. """
   @classmethod
@@ -471,7 +471,7 @@ def test_parse_signature_packet_errors(self):
           "'{}' not in '{}'".format(expected_error_str, str(ctx.exception)))
 
 
-@unittest.skipIf(os.getenv("TEST_SKIP_GPG"), "gpg not found")
+@unittest.skipIf(not HAVE_GPG, "gpg not found")
 class TestGPGRSA(unittest.TestCase):
   """Test signature creation, verification and key export from the gpg
   module"""
@@ -625,7 +625,7 @@ def test_verify_signature_with_expired_key(self):
         "\ngot:      {}".format(expected, ctx.exception))
 
 
-@unittest.skipIf(os.getenv("TEST_SKIP_GPG"), "gpg not found")
+@unittest.skipIf(not HAVE_GPG, "gpg not found")
 class TestGPGDSA(unittest.TestCase):
   """ Test signature creation, verification and key export from the gpg
   module """
@@ -710,7 +710,7 @@ def test_gpg_sign_and_verify_object(self):
 
 
 
-@unittest.skipIf(os.getenv("TEST_SKIP_GPG"), "gpg not found")
+@unittest.skipIf(not HAVE_GPG, "gpg not found")
 class TestGPGEdDSA(unittest.TestCase):
   """ Test signature creation, verification and key export from the gpg
   module """