[PATCH 1/2] cli: S/MIME verification/decryption support

[Jameson Graef Rollins <jrollins@finestructure.net>]

The notmuch-show flags --decrypt and --verify will now also process
S/MIME multiparts if encountered.  Requires gmime-2.6 and gpgsm.
---
 crypto.c         |   21 +++++++++++++++++++++
 notmuch-client.h |    5 +++--
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/crypto.c b/crypto.c
index fbe5aeb..551ffc5 100644
--- a/crypto.c
+++ b/crypto.c
@@ -52,6 +52,22 @@ notmuch_crypto_get_context (notmuch_crypto_t *crypto, const char *protocol)
 	}
 	cryptoctx = crypto->gpgctx;
 
+#ifdef GMIME_ATLEAST_26
+    } else if ((strcasecmp (protocol, "application/pkcs7-signature") == 0)
+	       || (strcasecmp (protocol, "application/x-pkcs7-signature") == 0)
+	       || (strcasecmp (protocol, "application/pkcs7-encrypted") == 0)) {
+	if (!crypto->pkcs7ctx) {
+	    /* TODO: GMimePasswordRequestFunc */
+	    crypto->pkcs7ctx = g_mime_pkcs7_context_new (NULL);
+	    if (crypto->pkcs7ctx) {
+		g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context*) crypto->pkcs7ctx, FALSE);
+	    } else {
+		fprintf (stderr, "Failed to construct pkcs7 context.\n");
+	    }
+	}
+	cryptoctx = crypto->pkcs7ctx;
+
+#endif
     } else {
 	fprintf (stderr, "Unknown or unsupported cryptographic protocol.\n");
     }
@@ -67,5 +83,10 @@ notmuch_crypto_cleanup (notmuch_crypto_t *crypto)
 	crypto->gpgctx = NULL;
     }
 
+    if (crypto->pkcs7ctx) {
+	g_object_unref (crypto->pkcs7ctx);
+	crypto->pkcs7ctx = NULL;
+    }
+
     return 0;
 }
diff --git a/notmuch-client.h b/notmuch-client.h
index 9b63eae..72edd50 100644
--- a/notmuch-client.h
+++ b/notmuch-client.h
@@ -79,6 +79,7 @@ typedef struct notmuch_show_format {
 
 typedef struct notmuch_crypto {
     notmuch_crypto_context_t* gpgctx;
+    notmuch_crypto_context_t* pkcs7ctx;
     notmuch_bool_t verify;
     notmuch_bool_t decrypt;
 } notmuch_crypto_t;
@@ -353,8 +354,8 @@ struct mime_node {
 /* Construct a new MIME node pointing to the root message part of
  * message. If crypto->verify is true, signed child parts will be
  * verified. If crypto->decrypt is true, encrypted child parts will be
- * decrypted.  If crypto->gpgctx is NULL, it will be lazily
- * initialized.
+ * decrypted.  If the crypto contexts (crypto->gpgctx or
+ * crypto->pkcs7) are NULL, they will be lazily initialized.
  *
  * Return value:
  *
-- 
1.7.10