docs: def gpg_verify( path_to_verify, sigdata, sender_key_info, config_dir=None ):
      """
      Verify a file on disk was signed by the given sender.
      @sender_key_info should be a dict with
      {
          'key_id': ...
          'key_data': ...
          'app_name'; ...
      }
      Return {'status': True} on success
      Return {'error': ...} on error
      """
  
      if config_dir is None:
          config_dir = get_config_dir()
  
      # ingest keys 
      tmpdir = make_gpg_tmphome( prefix="verify", config_dir=config_dir )
      res = gpg_stash_key( "verify", sender_key_info['key_data'], config_dir=config_dir, gpghome=tmpdir )
      if res is None:
          shutil.rmtree(tmpdir)
          return {'error': 'Failed to stash key %s' % sender_key_info['key_id']}
  
      # stash detached signature 
      fd, path = tempfile.mkstemp( prefix=".sig-verify-" )
      f = os.fdopen(fd, "w")
      f.write( sigdata )
      f.flush()
      os.fsync(f.fileno())
      f.close()
  
      # verify 
      gpg = gnupg.GPG( homedir=tmpdir )
  
      with open(path, "r") as fd_in:
          res = gpg.verify_file( fd_in, data_filename=path_to_verify )
  
      shutil.rmtree(tmpdir)
      try:
          os.unlink(path)
      except:
          pass
  
      if not res:
          log.debug("verify_file error: %s" % res.__dict__)
          return {'error': 'Failed to decrypt data'}
  
      log.debug("verification succeeded from keys in %s" % config_dir)
      return {'status': True}