S/MIME support

S/MIME support

[Jameson Graef Rollins]

Hey, folks.  This patch adds S/MIME support to notmuch-show.  It's
pretty simple, now that the crypto rework [0] is complete.

I was going to wait to submit this patch until we had a test suite
(ehem, dkg!), but seeing as there has been some other interest
expressed in seeing this feature I'm going to go ahead and send it to
the list in the hopes that it might spur development of the needed
tests.

jamie.

[0] id:"1338057946-29209-2-git-send-email-jrollins@finestructure.net"

[PATCH 1/2] cli: S/MIME verification/decryption support

[Jameson Graef Rollins]

The notmuch-show flags --decrypt and --verify will now also process
S/MIME multiparts if encountered.  Requires gmime-2.6 and gpgsm.
---
 crypto.c         |   21 +++++++++++++++++++++
 notmuch-client.h |    5 +++--
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/crypto.c b/crypto.c
index fbe5aeb..551ffc5 100644
--- a/crypto.c
+++ b/crypto.c
@@ -52,6 +52,22 @@ notmuch_crypto_get_context (notmuch_crypto_t *crypto, const char *protocol)
 	}
 	cryptoctx = crypto->gpgctx;
 
+#ifdef GMIME_ATLEAST_26
+    } else if ((strcasecmp (protocol, "application/pkcs7-signature") == 0)
+	       || (strcasecmp (protocol, "application/x-pkcs7-signature") == 0)
+	       || (strcasecmp (protocol, "application/pkcs7-encrypted") == 0)) {
+	if (!crypto->pkcs7ctx) {
+	    /* TODO: GMimePasswordRequestFunc */
+	    crypto->pkcs7ctx = g_mime_pkcs7_context_new (NULL);
+	    if (crypto->pkcs7ctx) {
+		g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context*) crypto->pkcs7ctx, FALSE);
+	    } else {
+		fprintf (stderr, "Failed to construct pkcs7 context.\n");
+	    }
+	}
+	cryptoctx = crypto->pkcs7ctx;
+
+#endif
     } else {
 	fprintf (stderr, "Unknown or unsupported cryptographic protocol.\n");
     }
@@ -67,5 +83,10 @@ notmuch_crypto_cleanup (notmuch_crypto_t *crypto)
 	crypto->gpgctx = NULL;
     }
 
+    if (crypto->pkcs7ctx) {
+	g_object_unref (crypto->pkcs7ctx);
+	crypto->pkcs7ctx = NULL;
+    }
+
     return 0;
 }
diff --git a/notmuch-client.h b/notmuch-client.h
index 9b63eae..72edd50 100644
--- a/notmuch-client.h
+++ b/notmuch-client.h
@@ -79,6 +79,7 @@ typedef struct notmuch_show_format {
 
 typedef struct notmuch_crypto {
     notmuch_crypto_context_t* gpgctx;
+    notmuch_crypto_context_t* pkcs7ctx;
     notmuch_bool_t verify;
     notmuch_bool_t decrypt;
 } notmuch_crypto_t;
@@ -353,8 +354,8 @@ struct mime_node {
 /* Construct a new MIME node pointing to the root message part of
  * message. If crypto->verify is true, signed child parts will be
  * verified. If crypto->decrypt is true, encrypted child parts will be
- * decrypted.  If crypto->gpgctx is NULL, it will be lazily
- * initialized.
+ * decrypted.  If the crypto contexts (crypto->gpgctx or
+ * crypto->pkcs7) are NULL, they will be lazily initialized.
  *
  * Return value:
  *
-- 
1.7.10

[PATCH 2/2] debian: Recommend gpgsm for S/MIME support

[Jameson Graef Rollins]

---
 debian/control |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/control b/debian/control
index 812430f..c3ed09c 100644
--- a/debian/control
+++ b/debian/control
@@ -26,7 +26,7 @@ Dm-Upload-Allowed: yes
 Package: notmuch
 Architecture: any
 Depends: libnotmuch3 (= ${binary:Version}), ${shlibs:Depends}, ${misc:Depends}
-Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt,  gnupg-agent
+Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt,  gnupg-agent, gpgsm
 Description: thread-based email index, search and tagging
  Notmuch is a system for indexing, searching, reading, and tagging
  large collections of email messages in maildir or mh format. It uses
-- 
1.7.10

RE: S/MIME support

[Bryant, Daniel B.]

Jamie,

I was able to get signature verification working with your patchset (with a caveat) but not decryption.

Signature Verification
----------------------

The caveat is that GMime is still borked with handling signatures with content type application/x-pkcs7-signature (vs. application/pkcs7-signature, which works fine). This is upstream GNOME bug #674032 that was supposed to have been fixed in GMime 2.6.9, but that original fix is also broken.

One possible workaround is to twiddle the content-type of the signature part (and the corresponding protocol in the multipart/signed part). I implemented this by looping over each message part in mime_node_open() and modifying as necessary using the following logic:


    GMimeContentType *content_type = g_mime_object_get_content_type (part);

    const char *subtype = g_mime_content_type_get_media_subtype (content_type);
    const char *protocol = g_mime_content_type_get_parameter (content_type, "protocol");

    if (!strcmp(subtype, "x-pkcs7-signature")) {
        g_mime_content_type_set_media_subtype (content_type, "pkcs7-signature");
    }

    if (protocol && !strcmp(protocol, "application/x-pkcs7-signature")) {
        g_mime_content_type_set_parameter (content_type, "protocol","application/pkcs7-signature");
    }    


Decryption
----------

All of my S/MIME encrypted mail consists of single part messages with content-type "application/x-pkcs7-mime". These conform to RFC3851, section 3.3/3.4. (sample messages are included in the RFC as well). This fails to be decrypted by notmuch because the mime node traversal code assumes that every encrypted message is multipart/encrypted, which appears to only be true for PGP/MIME.


Dan



-----Original Message-----
From: notmuch-bounces@notmuchmail.org [mailto:notmuch-bounces@notmuchmail.org] On Behalf Of Jameson Graef Rollins
Sent: Friday, June 29, 2012 2:38 PM
To: Notmuch Mail
Subject: S/MIME support

Hey, folks.  This patch adds S/MIME support to notmuch-show.  It's
pretty simple, now that the crypto rework [0] is complete.

I was going to wait to submit this patch until we had a test suite
(ehem, dkg!), but seeing as there has been some other interest
expressed in seeing this feature I'm going to go ahead and send it to
the list in the hopes that it might spur development of the needed
tests.

jamie.

[0] id:"1338057946-29209-2-git-send-email-jrollins@finestructure.net"

_______________________________________________
notmuch mailing list
notmuch@notmuchmail.org
http://notmuchmail.org/mailman/listinfo/notmuch

RE: S/MIME support

[Jameson Graef Rollins]

[-- Attachment #1: Type: text/plain, Size: 2421 bytes --]

On Mon, Jul 09 2012, "Bryant, Daniel B." <Dan.Bryant@jhuapl.edu> wrote:
> I was able to get signature verification working with your patchset
> (with a caveat) but not decryption.

Hi, Daniel.  I guess I'm only partially happy to hear that!  I
definitely do appreciate the feedback, though.

> The caveat is that GMime is still borked with handling signatures with
> content type application/x-pkcs7-signature
> (vs. application/pkcs7-signature, which works fine). This is upstream
> GNOME bug #674032 that was supposed to have been fixed in GMime 2.6.9,
> but that original fix is also broken.

Ah, I didn't notice that:

https://bugzilla.gnome.org/show_bug.cgi?id=674032

Encouragingly, it sounds like Jeffery is working on it.

> One possible workaround is to twiddle the content-type of the
> signature part (and the corresponding protocol in the multipart/signed
> part). I implemented this by looping over each message part in
> mime_node_open() and modifying as necessary using the following logic:
>
>
>     GMimeContentType *content_type = g_mime_object_get_content_type (part);
>
>     const char *subtype = g_mime_content_type_get_media_subtype (content_type);
>     const char *protocol = g_mime_content_type_get_parameter (content_type, "protocol");
>
>     if (!strcmp(subtype, "x-pkcs7-signature")) {
>         g_mime_content_type_set_media_subtype (content_type, "pkcs7-signature");
>     }
>
>     if (protocol && !strcmp(protocol, "application/x-pkcs7-signature")) {
>         g_mime_content_type_set_parameter (content_type, "protocol","application/pkcs7-signature");
>     }    

We could do this, but I would certainly prefer that we fix gmime to
handle both types properly.

> All of my S/MIME encrypted mail consists of single part messages with
> content-type "application/x-pkcs7-mime". These conform to RFC3851,
> section 3.3/3.4. (sample messages are included in the RFC as
> well). This fails to be decrypted by notmuch because the mime node
> traversal code assumes that every encrypted message is
> multipart/encrypted, which appears to only be true for PGP/MIME.

Thanks for the great example of why we need tests!

Would you (or anyone) be willing to start putting together some tests
that include messages encrypted according to this RFC?  I think adding
some tests to the test/crypto script would be a great place to start.

jamie.

[-- Attachment #2: Type: application/pgp-signature, Size: 835 bytes --]

RE: S/MIME support

[David Bremner]

Jameson Graef Rollins <jrollins@finestructure.net> writes:
>
> Ah, I didn't notice that:
>
> https://bugzilla.gnome.org/show_bug.cgi?id=674032
>
> Encouragingly, it sounds like Jeffery is working on it.

FYI it's marked fixed in upstream git now. 

d

S/MIME support, rebased

[Jameson Graef Rollins]

Rebased against the current master.  Still needs tests.

jamie.

[PATCH 1/2] cli: S/MIME verification/decryption support

[Jameson Graef Rollins]

The notmuch-show flags --decrypt and --verify will now also process
S/MIME multiparts if encountered.  Requires gmime-2.6 and gpgsm.
---
 crypto.c         | 20 ++++++++++++++++++++
 notmuch-client.h |  5 +++--
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/crypto.c b/crypto.c
index 6f4a6db..d66aa66 100644
--- a/crypto.c
+++ b/crypto.c
@@ -88,6 +88,21 @@ notmuch_crypto_get_context (notmuch_crypto_t *crypto, const char *protocol)
 		fprintf (stderr, "Failed to construct gpg context.\n");
 	}
 	cryptoctx = crypto->gpgctx;
+#ifdef GMIME_ATLEAST_26
+    } else if ((strcasecmp (protocol, "application/pkcs7-signature") == 0)
+	       || (strcasecmp (protocol, "application/x-pkcs7-signature") == 0)
+	       || (strcasecmp (protocol, "application/pkcs7-encrypted") == 0)) {
+	if (! crypto->pkcs7ctx) {
+	    /* TODO: GMimePasswordRequestFunc */
+	    crypto->pkcs7ctx = g_mime_pkcs7_context_new (NULL);
+	    if (crypto->pkcs7ctx) {
+		g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context*) crypto->pkcs7ctx, FALSE);
+	    } else {
+		fprintf (stderr, "Failed to construct pkcs7 context.\n");
+	    }
+	}
+	cryptoctx = crypto->pkcs7ctx;
+#endif
     } else {
 	fprintf (stderr, "Unknown or unsupported cryptographic protocol.\n");
     }
@@ -103,5 +118,10 @@ notmuch_crypto_cleanup (notmuch_crypto_t *crypto)
 	crypto->gpgctx = NULL;
     }
 
+    if (crypto->pkcs7ctx) {
+	g_object_unref (crypto->pkcs7ctx);
+	crypto->pkcs7ctx = NULL;
+    }
+
     return 0;
 }
diff --git a/notmuch-client.h b/notmuch-client.h
index 278b498..9b80107 100644
--- a/notmuch-client.h
+++ b/notmuch-client.h
@@ -78,6 +78,7 @@ typedef struct notmuch_show_format {
 
 typedef struct notmuch_crypto {
     notmuch_crypto_context_t* gpgctx;
+    notmuch_crypto_context_t* pkcs7ctx;
     notmuch_bool_t verify;
     notmuch_bool_t decrypt;
 } notmuch_crypto_t;
@@ -411,8 +412,8 @@ struct mime_node {
 /* Construct a new MIME node pointing to the root message part of
  * message. If crypto->verify is true, signed child parts will be
  * verified. If crypto->decrypt is true, encrypted child parts will be
- * decrypted.  If crypto->gpgctx is NULL, it will be lazily
- * initialized.
+ * decrypted.  If the crypto contexts (crypto->gpgctx or
+ * crypto->pkcs7) are NULL, they will be lazily initialized.
  *
  * Return value:
  *
-- 
1.9.0

[PATCH 2/2] debian: Recommend gpgsm for S/MIME support

[Jameson Graef Rollins]

---
 debian/control | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/control b/debian/control
index 8d8e938..5002d78 100644
--- a/debian/control
+++ b/debian/control
@@ -30,7 +30,7 @@ Vcs-Browser: http://git.notmuchmail.org/git/notmuch
 Package: notmuch
 Architecture: any
 Depends: libnotmuch3 (= ${binary:Version}), ${shlibs:Depends}, ${misc:Depends}
-Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt | alot,  gnupg-agent
+Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt | alot,  gnupg-agent, gpgsm
 Description: thread-based email index, search and tagging
  Notmuch is a system for indexing, searching, reading, and tagging
  large collections of email messages in maildir or mh format. It uses
-- 
1.9.0

Re: [PATCH 1/2] cli: S/MIME verification/decryption support

[David Bremner]

[-- Attachment #1: Type: text/plain, Size: 535 bytes --]

Jameson Graef Rollins <jrollins@finestructure.net> writes:

> The notmuch-show flags --decrypt and --verify will now also process
> S/MIME multiparts if encountered.  Requires gmime-2.6 and gpgsm.

I was trying to figure out how to test this. I tried a few couple signed
messages, but I got "bad" signature status in both cases.

An example message is attached.

   http://mid.gmane.org/4F1423A1.90909@cms.hu-berlin.de

Are we missing the signature between bad and untrusted signatures, or
does that distinction not exist for S/MIME?


[-- Attachment #2: 1326721985.H673045P22490.tesseract.cs.unb.ca:2,S --]
[-- Type: application/octet-stream, Size: 13941 bytes --]

Return-path: <opensync-users-bounces@lists.sourceforge.net>
Envelope-to: bremner@tesseract.cs.unb.ca
Delivery-date: Mon, 16 Jan 2012 09:53:05 -0400
Received: from fiero.its.unb.ca ([131.202.1.10])
	by tesseract.cs.unb.ca with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
	(Exim 4.72)
	(envelope-from <opensync-users-bounces@lists.sourceforge.net>)
	id 1Rmmze-0005qg-Cz
	for bremner@tesseract.cs.unb.ca; Mon, 16 Jan 2012 09:53:05 -0400
Received: from mx2.nbpei-ecn.ca (mx2.nbpei-ecn.ca [198.164.163.195])
	by fiero.its.unb.ca (8.13.8/8.13.8) with ESMTP id q0GDqucW026706
	for <bremner@unb.ca>; Mon, 16 Jan 2012 09:52:56 -0400
Received: from mx2.nbpei-ecn.ca (localhost.localdomain [127.0.0.1])
	by localhost (Postfix) with SMTP id D288A5343A7
	for <bremner@unb.ca>; Mon, 16 Jan 2012 09:52:56 -0400 (AST)
Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88])
	by mx2.nbpei-ecn.ca (Postfix) with ESMTP id 504F45343B0
	for <bremner@unb.ca>; Mon, 16 Jan 2012 09:52:56 -0400 (AST)
Received: from localhost ([127.0.0.1] helo=sfs-ml-4.v29.ch3.sourceforge.com)
	by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
	(envelope-from <opensync-users-bounces@lists.sourceforge.net>)
	id 1RmmzX-0000tI-5D; Mon, 16 Jan 2012 13:52:55 +0000
Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193]
	helo=mx.sourceforge.net)
	by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
	(envelope-from <michael.bell@cms.hu-berlin.de>) id 1RmmzW-0000tC-M3
	for opensync-users@lists.sourceforge.net;
	Mon, 16 Jan 2012 13:52:54 +0000
X-ACL-Warn: 
Received: from ir1.cms.hu-berlin.de ([141.20.1.146])
	by sog-mx-3.v43.ch3.sourceforge.com with esmtp (Exim 4.76)
	id 1RmmzQ-0004lw-4m for opensync-users@lists.sourceforge.net;
	Mon, 16 Jan 2012 13:52:54 +0000
X-IronPort-AV: E=Sophos;i="4.71,518,1320620400"; 
	d="p7s'?scan'208";a="87263631"
Received: from bellus.cms.hu-berlin.de (HELO [141.20.3.34]) ([141.20.3.34])
	by ir1-relay.cms.hu-berlin.de with ESMTP/TLS/DHE-RSA-CAMELLIA256-SHA;
	16 Jan 2012 14:18:26 +0100
Message-ID: <4F1423A1.90909@cms.hu-berlin.de>
Date: Mon, 16 Jan 2012 14:18:25 +0100
From: Michael Bell <michael.bell@cms.hu-berlin.de>
User-Agent: Mozilla/5.0 (X11; Linux i686;
	rv:9.0) Gecko/20111222 Thunderbird/9.0.1
MIME-Version: 1.0
To: opensync-users@lists.sourceforge.net
References: <loom.20120116T115752-913@post.gmane.org>
In-Reply-To: <loom.20120116T115752-913@post.gmane.org>
X-Enigmail-Version: 1.3.4
X-Spam-Score: -0.0 (/)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
	See http://spamassassin.org/tag/ for more details.
	-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
	domain
X-Headers-End: 1RmmzQ-0004lw-4m
Subject: Re: [Opensync-users] Trouble with libwbxml installation
X-BeenThere: opensync-users@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <opensync-users.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/opensync-users>, 
	<mailto:opensync-users-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=opensync-users>
List-Post: <mailto:opensync-users@lists.sourceforge.net>
List-Help: <mailto:opensync-users-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/opensync-users>, 
	<mailto:opensync-users-request@lists.sourceforge.net?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============0939083224693629589=="
Errors-To: opensync-users-bounces@lists.sourceforge.net
X-PMX-Version: 5.6.1.2065439, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2012.1.16.134214
X-PerlMx-Spam: Gauge=X, Probability=10%, Report='
 TO_IN_SUBJECT 0.5, BODYTEXTP_SIZE_3000_LESS 0, __ANY_URI 0, __BOUNCE_CHALLENGE_SUBJ 0, __BOUNCE_NDR_SUBJ_EXEMPT 0, __CP_URI_IN_BODY 0, __CT 0, __CTYPE_HAS_BOUNDARY 0, __CTYPE_MULTIPART 0, __CTYPE_MULTIPART_MIXED 0, __HAS_LIST_HEADER 0, __HAS_LIST_HELP 0, __HAS_LIST_SUBSCRIBE 0, __HAS_LIST_UNSUBSCRIBE 0, __HAS_MSGID 0, __INT_PROD_COMP 0, __LINES_OF_YELLING 0, __MIME_VERSION 0, __MOZILLA_MSGID 0, __OEM_PRICE 0, __SANE_MSGID 0, __STOCK_PHRASE_7 0, __TO_MALFORMED_2 0, __TO_NO_NAME 0, __URI_NO_WWW 0, __URI_NS , __USER_AGENT 0'
X-Spam-Score: -1.6
X-Spam_bar: -

Dies ist eine kryptografisch unterzeichnete Nachricht im MIME-Format.

--===============0939083224693629589==
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
	micalg=sha1; boundary="------------ms030508040105000407050008"

Dies ist eine kryptografisch unterzeichnete Nachricht im MIME-Format.

--------------ms030508040105000407050008
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi,

can you please send the complete output including the command line input
which you used to start cmake?

BTW did you install libexpat1-dev? (I use Debian sid.)

Best regards

Michael

Am 01/16/12 12:08, schrieb Nikitah Bobhate:
> Hello
>=20
> I am trying to install libwbxml in Ubuntu 11.10 with cmake. I have=20
> installed cmake and expat. However when I run the commands in the=20
> Install text file, I get the following error:
>=20
> **********
>=20
> CMake Error: The following variables are used in this project, but=20
> they are set to NOTFOUND.
> Please set them or make sure they are set and tested correctly in=20
> the CMake files:
> EXPAT_INCLUDE_DIRS (ADVANCED)
>     used as include directory in directory /home/---/libwbxml-0.11.0/sr=
c
>     used as include directory in directory /home/---/libwbxml-0.11.0/to=
ols
> EXPAT_LIBRARIES (ADVANCED)
>     linked by target "wbxml2" in directory /home/---/libwbxml-0.11.0/sr=
c
>=20
> -- Configuration incomplete, errors occured!
>=20
> **********
>=20
> I would appreciate any help troubleshooting this!
> Thanks!
>=20
>=20
> -----------------------------------------------------------------------=
-------
> RSA(R) Conference 2012
> Mar 27 - Feb 2
> Save $400 by Jan. 27
> Register now!
> http://p.sf.net/sfu/rsa-sfdev2dev2
> _______________________________________________
> Opensync-users mailing list
> Opensync-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/opensync-users


--=20
___________________________________________________________________

Michael Bell                        Humboldt-Universitaet zu Berlin

Tel.: +49 (0)30-2093 70143          ZE Computer- und Medienservice
Fax:  +49 (0)30-2093 70135          Unter den Linden 6
michael.bell@cms.hu-berlin.de       D-10099 Berlin
___________________________________________________________________

PGP Fingerprint: 09E4 3D29 4156 2774 0F2C  C643 D8BD 1918 2030 5AAB


--------------ms030508040105000407050008
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Kryptografische Unterschrift

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIOgzCC
BCEwggMJoAMCAQICAgDHMA0GCSqGSIb3DQEBBQUAMHExCzAJBgNVBAYTAkRFMRwwGgYDVQQK
ExNEZXV0c2NoZSBUZWxla29tIEFHMR8wHQYDVQQLExZULVRlbGVTZWMgVHJ1c3QgQ2VudGVy
MSMwIQYDVQQDExpEZXV0c2NoZSBUZWxla29tIFJvb3QgQ0EgMjAeFw0wNjEyMTkxMDI5MDBa
Fw0xOTA2MzAyMzU5MDBaMFoxCzAJBgNVBAYTAkRFMRMwEQYDVQQKEwpERk4tVmVyZWluMRAw
DgYDVQQLEwdERk4tUEtJMSQwIgYDVQQDExtERk4tVmVyZWluIFBDQSBHbG9iYWwgLSBHMDEw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDpm8NnhfkNrvWNVMOWUDU9YuluTO2U
1wBblSJ01CDrNI/W7MAxBAuZgeKmFNJSoCgjhIt0iQReW+DieMF4yxbLKDU5ey2QRdDtoAB6
fL9KDhsAw4bpXCsxEXsM84IkQ4wcOItqaACa7txPeKvSxhObdq3u3ibo7wGvdA/BCaL2a869
080UME/15eOkyGKbghoDJzANAmVgTe3RCSMqljVYJ9N2xnG2kB3E7f81hn1vM7PbD8URwoqD
oZRdQWvY0hD1TP3KUazZve+Sg7va64sWVlZDz+HVEz2mHycwzUlU28kTNJpxdcVs6qcLmPkh
nSevPqM5OUhqjK3JmfvDEvK9AgMBAAGjgdkwgdYwcAYDVR0fBGkwZzBloGOgYYZfaHR0cDov
L3BraS50ZWxlc2VjLmRlL2NnaS1iaW4vc2VydmljZS9hZl9Eb3dubG9hZEFSTC5jcmw/LWNy
bF9mb3JtYXQ9WF81MDkmLWlzc3Vlcj1EVF9ST09UX0NBXzIwHQYDVR0OBBYEFEm3xs/oPR9/
6kR7Eyn38QpwPt5kMB8GA1UdIwQYMBaAFDHDeRu69VPXF+CJei0XbAqzK50zMA4GA1UdDwEB
/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgECMA0GCSqGSIb3DQEBBQUAA4IBAQA74Vp3wEgX
3KkY7IGvWonwvSiSpspZGBJw7Cjy565/lizn8l0ZMfYTK3S9vYCyufdnyTmieTvhERHua3iR
M347XyYndVNljjNj7s9zw7CSI0khUHUjoR8Y4pSFPT8z6XcgjaK95qGFKUD2P3MyWA0Ja6ba
hWzAP7uNZmRWJE6uDT8yNQFb6YyC2XJZT7GGhfF0hVblw/hc843uR7NTBXDn5U2KaYMo4RMJ
hp5eyOpYHgwf+aTUWgRo/Sg+iwK2WLX2oSw3VwBnqyNojWOl75lrXP1LVvarQIc01BGSbOyH
xQoLBzNytG8MHVQs2FHHzL8w00Ny8TK/jM5JY6gA9/IcMIIE9DCCA9ygAwIBAgIEC2I0jzAN
BgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJERTETMBEGA1UEChMKREZOLVZlcmVpbjEQMA4G
A1UECxMHREZOLVBLSTEkMCIGA1UEAxMbREZOLVZlcmVpbiBQQ0EgR2xvYmFsIC0gRzAxMB4X
DTA3MTEyMDEwMjkyMVoXDTE5MDYzMDAwMDAwMFowaDELMAkGA1UEBhMCREUxKDAmBgNVBAoT
H0h1bWJvbGR0LVVuaXZlcnNpdGFldCB6dSBCZXJsaW4xDjAMBgNVBAMTBUhVLUNBMR8wHQYJ
KoZIhvcNAQkBFhBwa2lAaHUtYmVybGluLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA6wxB17AojABvR7rEkR8v3wfquJ1RAGBx9Bhv0pQis98kCJaaYYO1cspc0znfEAOc
Bk9lBhb/sWfV13KFKDcib7WlY1sFBHCJAbGkpcNTfqp/enTtDZOzXFUzXOj5+lcaHwn6qt2H
Q7oafm8wfPp9efd3ykRzCWhbZ7K3o/kCCMHw5Dxe9na4OdQCXqwp6Hhpmx9CGHq2SPWxrRZq
dZJzmfhmDV3yVYghIuyHN/jDTorshki3pWF3OFHpok1w09LKPDUZRdHZzUt7ZIZYEwdvjVAK
JAsHyKjzrASRfHJgXvJQLENcBJwPGXfJGMSXj3AcS9CjwQdtMlyDsU4D5RV4BQIDAQABo4IB
sjCCAa4wEgYDVR0TAQH/BAgwBgEB/wIBATALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFB/1LD73
QKsukKBq0+J5XvJ2zYN0MB8GA1UdIwQYMBaAFEm3xs/oPR9/6kR7Eyn38QpwPt5kMBsGA1Ud
EQQUMBKBEHBraUBodS1iZXJsaW4uZGUwgYgGA1UdHwSBgDB+MD2gO6A5hjdodHRwOi8vY2Rw
MS5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1Yi9jcmwvY2FjcmwuY3JsMD2gO6A5hjdo
dHRwOi8vY2RwMi5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1Yi9jcmwvY2FjcmwuY3Js
MIGiBggrBgEFBQcBAQSBlTCBkjBHBggrBgEFBQcwAoY7aHR0cDovL2NkcDEucGNhLmRmbi5k
ZS9nbG9iYWwtcm9vdC1jYS9wdWIvY2FjZXJ0L2NhY2VydC5jcnQwRwYIKwYBBQUHMAKGO2h0
dHA6Ly9jZHAyLnBjYS5kZm4uZGUvZ2xvYmFsLXJvb3QtY2EvcHViL2NhY2VydC9jYWNlcnQu
Y3J0MA0GCSqGSIb3DQEBBQUAA4IBAQBO3AOzYN+zVEPJLJHP12+Oa7wzhC2aji1SGLkPHqYn
l27d2+FxXgOo24p+rC7vS53tLGjE41EfkwEgO+cy4J9mUptTlDqa3gvzkR8C95Yl43fmYd5H
JrZ+WqQTVddwhxnOBCY0f+oW+RmeybR6TYDAQ+ByK6ru6DFPBRQpIejuny75jjm0EZzcPwZZ
J+gxObQ67RtMxiFk6Io6jWRdpy40mDJ39NF1tJqAFxo+3hSKVRTVs1l/ML12lLmTq+tgri9b
LBEQLwNoaCjGhn2aOMYJB0Rd5a31pbiXEZLV4IBylWd5/y3Nfb9q3x+i1lXI05u+oJ3q9ox4
PbuuKU3VWIngMIIFYjCCBEqgAwIBAgIEDytOrDANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQG
EwJERTEoMCYGA1UEChMfSHVtYm9sZHQtVW5pdmVyc2l0YWV0IHp1IEJlcmxpbjEOMAwGA1UE
AxMFSFUtQ0ExHzAdBgkqhkiG9w0BCQEWEHBraUBodS1iZXJsaW4uZGUwHhcNMDkxMTI0MTIy
NzA5WhcNMTIxMTIzMTIyNzA5WjCBoTELMAkGA1UEBhMCREUxKDAmBgNVBAoTH0h1bWJvbGR0
LVVuaXZlcnNpdGFldCB6dSBCZXJsaW4xNzA1BgNVBAsTLlplbnRyYWxlaW5yaWNodHVuZyBD
b21wdXRlci0gdW5kIE1lZGllbnNlcnZpY2UxGDAWBgoJkiaJk/IsZAEBEwhiZWxsbWljaDEV
MBMGA1UEAxMMTWljaGFlbCBCZWxsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
x7eDOYMCbwzKrnoDyCB9vHzX9mQH0n0In6mIxZbLL7w+a7wEsawK6W5QH2YDIJO+sENZuV8V
xfP60Q/M4lTDNtUtjA7MxAZHm32lDqGiikJq3D9dQ1Z3bACyX2UZVAPWZDNOwQ/9o3eRsoPE
3PVLtQwy1LjeMUhL4MAF/A01loaJvjUl2LkPbyo/MMpqvf3JNZVpsr6YTAkUWPVph//YamZn
tPKeE/b5zBuEU61M0M3ohDb7VXn1dz4vkkB0V6Fb5bhIa5u0srubgVS5ple6Tl1EBNBmCgoX
RAEpl12oCgMeC38iGGi7CdDBvChH6toKW+9f7YpdfL85o/nLA/5nzQIDAQABo4IB2DCCAdQw
CQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwKQYDVR0lBCIwIAYIKwYBBQUHAwIGCCsGAQUFBwME
BgorBgEEAYI3FAICMB0GA1UdDgQWBBS2ujFtnzcaoFrD1Jrf3eGuHYM+DzAfBgNVHSMEGDAW
gBQf9Sw+90CrLpCgatPieV7yds2DdDAoBgNVHREEITAfgR1taWNoYWVsLmJlbGxAY21zLmh1
LWJlcmxpbi5kZTCBgwYDVR0fBHwwejA7oDmgN4Y1aHR0cDovL2NkcDEucGNhLmRmbi5kZS9o
dS1iZXJsaW4tY2EvcHViL2NybC9jYWNybC5jcmwwO6A5oDeGNWh0dHA6Ly9jZHAyLnBjYS5k
Zm4uZGUvaHUtYmVybGluLWNhL3B1Yi9jcmwvY2FjcmwuY3JsMIGeBggrBgEFBQcBAQSBkTCB
jjBFBggrBgEFBQcwAoY5aHR0cDovL2NkcDEucGNhLmRmbi5kZS9odS1iZXJsaW4tY2EvcHVi
L2NhY2VydC9jYWNlcnQuY3J0MEUGCCsGAQUFBzAChjlodHRwOi8vY2RwMi5wY2EuZGZuLmRl
L2h1LWJlcmxpbi1jYS9wdWIvY2FjZXJ0L2NhY2VydC5jcnQwDQYJKoZIhvcNAQEFBQADggEB
AAN9XKHSnqJjnZRFe7LR2GZYkfFkRWoEoRRBTW1oQMeKaFmFpmvqt4VJynxO+3s6Z+Gv+Luy
vCkYX58c+HM8ivFhRafTNTOtxJTBP/OjiygwmmeAryqVmfxkZM9I2eyhdE0WdRb/fWkKJsH4
JoV6gWAOzVyJf8pfbHbgT4BUEEdkB42my+W69r3YJ33Wv5FGM0elnuS90vT3bTvbMAzJG9XQ
suiMLZ3EjKHDXwCsCQDBSOZakmAN6MvaCyj1BCNHb/irSaicY/VnGtAYt2SG27+BEcjQxLgo
LXRrRceQwoYLeb8zp813pyXkfajYnxWHAAItMVVDPoYlC6JqJh1QvXQxggNeMIIDWgIBATBw
MGgxCzAJBgNVBAYTAkRFMSgwJgYDVQQKEx9IdW1ib2xkdC1Vbml2ZXJzaXRhZXQgenUgQmVy
bGluMQ4wDAYDVQQDEwVIVS1DQTEfMB0GCSqGSIb3DQEJARYQcGtpQGh1LWJlcmxpbi5kZQIE
DytOrDAJBgUrDgMCGgUAoIIBwzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3
DQEJBTEPFw0xMjAxMTYxMzE4MjVaMCMGCSqGSIb3DQEJBDEWBBR2ay+Www6STB4F0jxoPA9t
5jvlVDBfBgkqhkiG9w0BCQ8xUjBQMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG
9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwfwYJKwYB
BAGCNxAEMXIwcDBoMQswCQYDVQQGEwJERTEoMCYGA1UEChMfSHVtYm9sZHQtVW5pdmVyc2l0
YWV0IHp1IEJlcmxpbjEOMAwGA1UEAxMFSFUtQ0ExHzAdBgkqhkiG9w0BCQEWEHBraUBodS1i
ZXJsaW4uZGUCBA8rTqwwgYEGCyqGSIb3DQEJEAILMXKgcDBoMQswCQYDVQQGEwJERTEoMCYG
A1UEChMfSHVtYm9sZHQtVW5pdmVyc2l0YWV0IHp1IEJlcmxpbjEOMAwGA1UEAxMFSFUtQ0Ex
HzAdBgkqhkiG9w0BCQEWEHBraUBodS1iZXJsaW4uZGUCBA8rTqwwDQYJKoZIhvcNAQEBBQAE
ggEAqRLLEU/G9D2ZvxtZUgBSRyUPJPiGNhKRSfQquTuc93Hbg//Y8g4mPv+PdSKtHX84Dxxe
uFY1CReVpRzALkwDR1kSkECksnl2H8jWQsQdo/8o+7BLWqeB43MYyBbnEJfXAp9ZNkuLihUN
gLDjNPPt0YO5o+RGVzNwcQujMMsRlI0qvC9xFs6rYnIaQo8cLxjoFu6Edr3Ko4jSUfXLP4O5
7SZb5ZHBM9UR3N2udQ9Dku8d1IKQBNsqmX3Ubfh6e/oDKG0s6VePU9Q/4yzE61dxBh1wyEG5
JxGNP4SYfgy9GS5IdxjifYyZTnmuRr4l25Ym7twtCev5Ik9SEmhBLQQ2UAAAAAAAAA==
--------------ms030508040105000407050008--


--===============0939083224693629589==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2
--===============0939083224693629589==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Opensync-users mailing list
Opensync-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/opensync-users

--===============0939083224693629589==--

Re: [PATCH 1/2] cli: S/MIME verification/decryption support

[Jameson Graef Rollins]

[-- Attachment #1: Type: text/plain, Size: 752 bytes --]

On Tue, Jul 01 2014, David Bremner <david@tethera.net> wrote:
> Jameson Graef Rollins <jrollins@finestructure.net> writes:
>
>> The notmuch-show flags --decrypt and --verify will now also process
>> S/MIME multiparts if encountered.  Requires gmime-2.6 and gpgsm.
>
> I was trying to figure out how to test this. I tried a few couple signed
> messages, but I got "bad" signature status in both cases.
>
> An example message is attached.
>
>    http://mid.gmane.org/4F1423A1.90909@cms.hu-berlin.de
>
> Are we missing the signature between bad and untrusted signatures, or
> does that distinction not exist for S/MIME?

Hey, David.  How did you generate the signatures?  I would love to see a
script that generates a signature on a test message.

jamie.

[-- Attachment #2: Type: application/pgp-signature, Size: 818 bytes --]

Re: [PATCH 1/2] cli: S/MIME verification/decryption support

[David Bremner]

Jameson Graef Rollins <jrollins@finestructure.net> writes:

>>
>> Are we missing the signature between bad and untrusted signatures, or
>> does that distinction not exist for S/MIME?
>
> Hey, David.  How did you generate the signatures?  I would love to see a
> script that generates a signature on a test message.

I just grepped over my mail store for S/MIME signed messages. So it's
possible they're all bad, but it seems a bit unlikely.

I guess emacs+message-mode should be able to generate a signed message
message, I just don't know about the cert management.

d

SMIME patches v3, with some tests

[David Bremner]

Generating the certs was very much trial and error.  The net of
a thousand lies may have led me astray a bit in that it may be
possible to do this all with gpgsm and avoid the dependency on
openssl. On the other hand, some tests is better than no tests.

[PATCH 1/4] test: initial tests for smime

[David Bremner]

Test the ability of notmuch-mua-mail to send smime signed messages;
this really relies on existing functionality in message-mode.

The dependency on openssl to generate keys seems acceptable since
that's the method I got to work for smime signing in emacs.
---
 test/T355-smime.sh             | 41 +++++++++++++++++++++++++++++++++++++++++
 test/smime/openssl-ca-req.conf | 13 +++++++++++++
 test/smime/openssl-req.conf    | 13 +++++++++++++
 test/test-lib.el               | 10 ++++++++++
 test/test-lib.sh               |  1 +
 5 files changed, 78 insertions(+)
 create mode 100755 test/T355-smime.sh
 create mode 100644 test/smime/openssl-ca-req.conf
 create mode 100644 test/smime/openssl-req.conf

diff --git a/test/T355-smime.sh b/test/T355-smime.sh
new file mode 100755
index 0000000..01f6ecd
--- /dev/null
+++ b/test/T355-smime.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+test_description='S/MIME signature verification and decryption'
+. ./test-lib.sh
+
+test_require_external_prereq openssl
+
+test_begin_subtest "Generate CA Cert"
+openssl genpkey -algorithm RSA -out ca.key -pass pass:test -des3 1024
+openssl req -new -x509 -key ca.key -passin pass:test \
+	-config $TEST_DIRECTORY/smime/openssl-ca-req.conf -out ca.crt
+test_expect_equal "$(openssl verify ca.crt | tail -1)" "OK"
+
+test_begin_subtest "Generate User Cert"
+openssl genpkey -algorithm RSA  -out smime.key 1024
+openssl req -config $TEST_DIRECTORY/smime/openssl-req.conf \
+	-new -key smime.key -passin pass:test -nodes \
+	-out smime.csr
+openssl x509 -req -in smime.csr -passin pass:test -CA ca.crt -CAkey ca.key -set_serial 1 -out test_suite.crt -setalias "Self Signed SMIME" -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout
+# we need one file with the cert and private key
+cat test_suite.crt smime.key > test_suite.pem
+test_expect_equal "$(openssl verify -purpose smimesign -CAfile ca.crt test_suite.pem)" "test_suite.pem: OK"
+
+test_expect_success 'emacs delivery of S/MIME signed message' \
+     'emacs_fcc_message \
+     "test signed message 001" \
+     "This is a test signed message." \
+     "(mml-secure-message-sign \"smime\")"'
+
+test_begin_subtest "Signature verification (openssl)"
+notmuch show --format=raw subject:"test signed message 001" |\
+    openssl smime -verify -CAfile ca.crt >& OUTPUT
+cat <<EOF > EXPECTED
+Verification successful
+Content-Type: text/plain
+
+This is a test signed message.
+EOF
+test_expect_equal_file OUTPUT EXPECTED
+
+test_done
diff --git a/test/smime/openssl-ca-req.conf b/test/smime/openssl-ca-req.conf
new file mode 100644
index 0000000..49572ee
--- /dev/null
+++ b/test/smime/openssl-ca-req.conf
@@ -0,0 +1,13 @@
+ [ req ]
+ distinguished_name     = req_distinguished_name
+ prompt                 = no
+
+
+ [ req_distinguished_name ]
+ C                      = OZ
+ ST                     = Munchkinlandia
+ L                      = Emerald City
+ O                      = Organization Name
+ OU                     = Dept. of Fake Certs
+ CN                     = Fast Eddies Certs and Chips
+ emailAddress           = fake-ca@example.com
diff --git a/test/smime/openssl-req.conf b/test/smime/openssl-req.conf
new file mode 100644
index 0000000..c6b9de7
--- /dev/null
+++ b/test/smime/openssl-req.conf
@@ -0,0 +1,13 @@
+ [ req ]
+ distinguished_name     = req_distinguished_name
+ prompt                 = no
+
+
+ [ req_distinguished_name ]
+ C                      = OZ
+ ST                     = Munchkinlandia
+ L                      = Emerald City
+ O                      = Not much organization
+ OU                     = Dept. of Testing
+ CN                     = Notmuch Test Suite
+ emailAddress           = test_suite@notmuchmail.org
diff --git a/test/test-lib.el b/test/test-lib.el
index 04c8d63..596a705 100644
--- a/test/test-lib.el
+++ b/test/test-lib.el
@@ -188,3 +188,13 @@ nothing."
 ;; environments
 
 (setq mm-text-html-renderer 'html2text)
+
+;; Set some variables for S/MIME tests.
+
+(setq smime-keys '(("" "test_suite.pem" nil)))
+
+(setq mml-smime-use 'openssl)
+
+;; all test keys are without passphrase
+(eval-after-load 'smime
+  '(defun smime-ask-passphrase (cache)  nil))
diff --git a/test/test-lib.sh b/test/test-lib.sh
index 53db9ca..a5428bb 100644
--- a/test/test-lib.sh
+++ b/test/test-lib.sh
@@ -1302,3 +1302,4 @@ test_declare_external_prereq gdb
 test_declare_external_prereq gpg
 test_declare_external_prereq python
 test_declare_external_prereq python2
+test_declare_external_prereq openssl
-- 
2.1.4

[PATCH 2/4] cli: S/MIME verification/decryption support

[David Bremner]

From: Jameson Graef Rollins <jrollins@finestructure.net>

The notmuch-show flags --decrypt and --verify will now also process
S/MIME multiparts if encountered.  Requires gmime-2.6 and gpgsm.
---
 crypto.c         | 20 ++++++++++++++++++++
 notmuch-client.h |  5 +++--
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/crypto.c b/crypto.c
index 6f4a6db..d66aa66 100644
--- a/crypto.c
+++ b/crypto.c
@@ -88,6 +88,21 @@ notmuch_crypto_get_context (notmuch_crypto_t *crypto, const char *protocol)
 		fprintf (stderr, "Failed to construct gpg context.\n");
 	}
 	cryptoctx = crypto->gpgctx;
+#ifdef GMIME_ATLEAST_26
+    } else if ((strcasecmp (protocol, "application/pkcs7-signature") == 0)
+	       || (strcasecmp (protocol, "application/x-pkcs7-signature") == 0)
+	       || (strcasecmp (protocol, "application/pkcs7-encrypted") == 0)) {
+	if (! crypto->pkcs7ctx) {
+	    /* TODO: GMimePasswordRequestFunc */
+	    crypto->pkcs7ctx = g_mime_pkcs7_context_new (NULL);
+	    if (crypto->pkcs7ctx) {
+		g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context*) crypto->pkcs7ctx, FALSE);
+	    } else {
+		fprintf (stderr, "Failed to construct pkcs7 context.\n");
+	    }
+	}
+	cryptoctx = crypto->pkcs7ctx;
+#endif
     } else {
 	fprintf (stderr, "Unknown or unsupported cryptographic protocol.\n");
     }
@@ -103,5 +118,10 @@ notmuch_crypto_cleanup (notmuch_crypto_t *crypto)
 	crypto->gpgctx = NULL;
     }
 
+    if (crypto->pkcs7ctx) {
+	g_object_unref (crypto->pkcs7ctx);
+	crypto->pkcs7ctx = NULL;
+    }
+
     return 0;
 }
diff --git a/notmuch-client.h b/notmuch-client.h
index 5e0d475..986f6cd 100644
--- a/notmuch-client.h
+++ b/notmuch-client.h
@@ -78,6 +78,7 @@ typedef struct notmuch_show_format {
 
 typedef struct notmuch_crypto {
     notmuch_crypto_context_t* gpgctx;
+    notmuch_crypto_context_t* pkcs7ctx;
     notmuch_bool_t verify;
     notmuch_bool_t decrypt;
 } notmuch_crypto_t;
@@ -414,8 +415,8 @@ struct mime_node {
 /* Construct a new MIME node pointing to the root message part of
  * message. If crypto->verify is true, signed child parts will be
  * verified. If crypto->decrypt is true, encrypted child parts will be
- * decrypted.  If crypto->gpgctx is NULL, it will be lazily
- * initialized.
+ * decrypted.  If the crypto contexts (crypto->gpgctx or
+ * crypto->pkcs7) are NULL, they will be lazily initialized.
  *
  * Return value:
  *
-- 
2.1.4

[PATCH 3/4] test: add S/MIME signature verification test for notmuch CLI

[David Bremner]

The test is pretty much cut and paste from the PGP/MIME version, with
obvious updates taken from notmuch output.  This also requires setting
up gpgsm infrastucture.
---
 test/T355-smime.sh | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 test/test-lib.sh   |  1 +
 2 files changed, 50 insertions(+)

diff --git a/test/T355-smime.sh b/test/T355-smime.sh
index 01f6ecd..fbcf323 100755
--- a/test/T355-smime.sh
+++ b/test/T355-smime.sh
@@ -3,7 +3,17 @@
 test_description='S/MIME signature verification and decryption'
 . ./test-lib.sh
 
+add_gpgsm_home ()
+{
+    local output
+    [ -d ${GNUPGHOME} ] && return
+    mkdir -m 0700 "$GNUPGHOME"
+    gpgsm --no-tty --import < test_suite.pem >"$GNUPGHOME"/import.log 2>&1
+    test_debug "cat $GNUPGHOME/import.log"
+}
+
 test_require_external_prereq openssl
+test_require_external_prereq gpgsm
 
 test_begin_subtest "Generate CA Cert"
 openssl genpkey -algorithm RSA -out ca.key -pass pass:test -des3 1024
@@ -21,6 +31,10 @@ openssl x509 -req -in smime.csr -passin pass:test -CA ca.crt -CAkey ca.key -set_
 cat test_suite.crt smime.key > test_suite.pem
 test_expect_equal "$(openssl verify -purpose smimesign -CAfile ca.crt test_suite.pem)" "test_suite.pem: OK"
 
+add_gpgsm_home
+
+FINGERPRINT=$(openssl x509 -fingerprint -in test_suite.crt -noout | sed -e 's/^.*=//' -e s/://g)
+
 test_expect_success 'emacs delivery of S/MIME signed message' \
      'emacs_fcc_message \
      "test signed message 001" \
@@ -38,4 +52,39 @@ This is a test signed message.
 EOF
 test_expect_equal_file OUTPUT EXPECTED
 
+test_begin_subtest "signature verification (notmuch CLI)"
+output=$(notmuch show --format=json --verify subject:"test signed message 001" \
+    | notmuch_json_show_sanitize \
+    | sed -e 's|"created": [1234567890]*|"created": 946728000|' \
+	  -e 's|"expires": [1234567890]*|"expires": 424242424|' )
+expected='[[[{"id": "XXXXX",
+ "match": true,
+ "excluded": false,
+ "filename": "YYYYY",
+ "timestamp": 946728000,
+ "date_relative": "2000-01-01",
+ "tags": ["inbox","signed"],
+ "headers": {"Subject": "test signed message 001",
+ "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
+ "To": "test_suite@notmuchmail.org",
+ "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
+ "body": [{"id": 1,
+ "sigstatus": [{"status": "good",
+ "fingerprint": "'$FINGERPRINT'",
+ "expires": 424242424,
+ "created": 946728000}],
+ "content-type": "multipart/signed",
+ "content": [{"id": 2,
+ "content-type": "text/plain",
+ "content": "This is a test signed message.\n"},
+ {"id": 3,
+  "content-length": 1930,
+  "content-transfer-encoding": "base64",
+  "content-type": "application/x-pkcs7-signature",
+  "filename": "smime.p7s"}]}]},
+ []]]]'
+test_expect_equal_json \
+    "$output" \
+    "$expected"
+
 test_done
diff --git a/test/test-lib.sh b/test/test-lib.sh
index a5428bb..98a5f54 100644
--- a/test/test-lib.sh
+++ b/test/test-lib.sh
@@ -1303,3 +1303,4 @@ test_declare_external_prereq gpg
 test_declare_external_prereq python
 test_declare_external_prereq python2
 test_declare_external_prereq openssl
+test_declare_external_prereq gpgsm
-- 
2.1.4

[PATCH 4/4] debian: Recommend gpgsm for S/MIME support

[David Bremner]

From: Jameson Graef Rollins <jrollins@finestructure.net>

---
 debian/control | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/control b/debian/control
index 4bc4cd9..05cd04f 100644
--- a/debian/control
+++ b/debian/control
@@ -31,7 +31,7 @@ Vcs-Browser: http://git.notmuchmail.org/git/notmuch
 Package: notmuch
 Architecture: any
 Depends: libnotmuch4 (= ${binary:Version}), ${shlibs:Depends}, ${misc:Depends}
-Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt | alot,  gnupg-agent
+Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt | alot,  gnupg-agent, gpgsm
 Description: thread-based email index, search and tagging
  Notmuch is a system for indexing, searching, reading, and tagging
  large collections of email messages in maildir or mh format. It uses
-- 
2.1.4

Re: SMIME patches v3, with some tests

[Jameson Graef Rollins]

[-- Attachment #1: Type: text/plain, Size: 4259 bytes --]

On Sat, Jan 17 2015, David Bremner <david@tethera.net> wrote:
> Generating the certs was very much trial and error.  The net of
> a thousand lies may have led me astray a bit in that it may be
> possible to do this all with gpgsm and avoid the dependency on
> openssl. On the other hand, some tests is better than no tests.

Hey, David.  Thanks so much for covering our butts and finally putting
together these tests.

They look good to me.  Unfortunately, one of the tests is failing for
me, but I'm completely perplexed as to why:

T355-smime: Testing S/MIME signature verification and decryption
 PASS   Generate CA Cert
 PASS   Generate User Cert
 PASS   emacs delivery of S/MIME signed message
 FAIL   Signature verification (openssl)
	--- T355-smime.4.OUTPUT	2015-01-17 19:06:46.806054727 +0000
	+++ T355-smime.4.EXPECTED	2015-01-17 19:06:46.806054727 +0000
	@@ -1,4 +1,4 @@
	 Verification successful
	-Content-Type: text/plain
	-
	-This is a test signed message.
	+Content-Type: text/plain
	+
	+This is a test signed message.
 PASS   signature verification (notmuch CLI)

??  There's visually no difference between the supposedly diff'd text.
A hd of the output files being compared shows that openssl is using a
carriage return '0d' followed by line feed '0a' for every newline,
in place of a simple line feed '0a' in the original message file:

servo:~/src/notmuch/git [master*] 0$ hd test/tmp.T355-smime/T355-smime.4.EXPECTED 
00000000  43 6f 6e 74 65 6e 74 2d  54 79 70 65 3a 20 74 65  |Content-Type: te|
00000010  78 74 2f 70 6c 61 69 6e  0a 0a 54 68 69 73 20 69  |xt/plain..This i|
00000020  73 20 61 20 74 65 73 74  20 73 69 67 6e 65 64 20  |s a test signed |
00000030  6d 65 73 73 61 67 65 2e  0a 56 65 72 69 66 69 63  |message..Verific|
00000040  61 74 69 6f 6e 20 73 75  63 63 65 73 73 66 75 6c  |ation successful|
00000050  0a                                                |.|
00000051
servo:~/src/notmuch/git [master*] 0$ hd test/tmp.T355-smime/T355-smime.4.OUTPUT 
00000000  43 6f 6e 74 65 6e 74 2d  54 79 70 65 3a 20 74 65  |Content-Type: te|
00000010  78 74 2f 70 6c 61 69 6e  0d 0a 0d 0a 54 68 69 73  |xt/plain....This|
00000020  20 69 73 20 61 20 74 65  73 74 20 73 69 67 6e 65  | is a test signe|
00000030  64 20 6d 65 73 73 61 67  65 2e 0d 0a 56 65 72 69  |d message...Veri|
00000040  66 69 63 61 74 69 6f 6e  20 73 75 63 63 65 73 73  |fication success|
00000050  66 75 6c 0a                                       |ful.|
00000054
servo:~/src/notmuch/git [master*] 0$ 

Bad openssl.  (Daniel off stage screaming: "why aren't you using
certtool!")

I also noticed that the "Verification successful" string is not reliably
being printed to stderr before the message output.

Two possible patches to fix the problems are attached below.  The second
is maybe slightly preferred, since it eliminates any reliance on broken
openssl message output whatsoever.

Thanks again for working on this, David.

jamie.


diff --git a/test/T355-smime.sh b/test/T355-smime.sh
index 0e5fd4a..5e3ec72 100755
--- a/test/T355-smime.sh
+++ b/test/T355-smime.sh
@@ -43,7 +43,9 @@ test_expect_success 'emacs delivery of S/MIME signed mes
 
 test_begin_subtest "Signature verification (openssl)"
 notmuch show --format=raw subject:"test signed message 001" |\
-    openssl smime -verify -CAfile ca.crt >& OUTPUT
+    openssl smime -verify -CAfile ca.crt 2> OUTPUT
+notmuch show --format=raw subject:"test signed message 001" |\
+    openssl smime -verify -CAfile ca.crt | tr -d '\015' >> OUTPUT
 cat <<EOF > EXPECTED
 Verification successful
 Content-Type: text/plain


diff --git a/test/T355-smime.sh b/test/T355-smime.sh
index 0e5fd4a..cba23e0 100755
--- a/test/T355-smime.sh
+++ b/test/T355-smime.sh
@@ -43,12 +43,9 @@ test_expect_success 'emacs delivery of S/MIME signed me
 
 test_begin_subtest "Signature verification (openssl)"
 notmuch show --format=raw subject:"test signed message 001" |\
-    openssl smime -verify -CAfile ca.crt >& OUTPUT
+    openssl smime -verify -CAfile ca.crt 2> OUTPUT
 cat <<EOF > EXPECTED
 Verification successful
-Content-Type: text/plain
-
-This is a test signed message.
 EOF
 test_expect_equal_file OUTPUT EXPECTED
 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

[PATCH] test: initial tests for smime

[David Bremner]

Test the ability of notmuch-mua-mail to send smime signed messages;
this really relies on existing functionality in message-mode.

The dependency on openssl to generate keys seems acceptable since
that's the method I got to work for smime signing in emacs.
---

Hey Jamie;

It was kindof my fault: my original script add embedded ^M's in it, but
this "cleverness" was messed up somewhere in the patch process.

Does this version work for you?

test/T355-smime.sh             | 42 ++++++++++++++++++++++++++++++++++++++++++
 test/smime/openssl-ca-req.conf | 13 +++++++++++++
 test/smime/openssl-req.conf    | 13 +++++++++++++
 test/test-lib.el               | 10 ++++++++++
 test/test-lib.sh               |  1 +
 5 files changed, 79 insertions(+)
 create mode 100755 test/T355-smime.sh
 create mode 100644 test/smime/openssl-ca-req.conf
 create mode 100644 test/smime/openssl-req.conf

diff --git a/test/T355-smime.sh b/test/T355-smime.sh
new file mode 100755
index 0000000..1789a8b
--- /dev/null
+++ b/test/T355-smime.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+test_description='S/MIME signature verification and decryption'
+. ./test-lib.sh
+
+test_require_external_prereq openssl
+
+test_begin_subtest "Generate CA Cert"
+openssl genpkey -algorithm RSA -out ca.key -pass pass:test -des3 1024
+openssl req -new -x509 -key ca.key -passin pass:test \
+	-config $TEST_DIRECTORY/smime/openssl-ca-req.conf -out ca.crt
+test_expect_equal "$(openssl verify ca.crt | tail -1)" "OK"
+
+test_begin_subtest "Generate User Cert"
+openssl genpkey -algorithm RSA  -out smime.key 1024
+openssl req -config $TEST_DIRECTORY/smime/openssl-req.conf \
+	-new -key smime.key -passin pass:test -nodes \
+	-out smime.csr
+openssl x509 -req -in smime.csr -passin pass:test -CA ca.crt -CAkey ca.key -set_serial 1 -out test_suite.crt -setalias "Self Signed SMIME" -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout
+# we need one file with the cert and private key
+cat test_suite.crt smime.key > test_suite.pem
+test_expect_equal "$(openssl verify -purpose smimesign -CAfile ca.crt test_suite.pem)" "test_suite.pem: OK"
+
+test_expect_success 'emacs delivery of S/MIME signed message' \
+     'emacs_fcc_message \
+     "test signed message 001" \
+     "This is a test signed message." \
+     "(mml-secure-message-sign \"smime\")"'
+
+test_begin_subtest "Signature verification (openssl)"
+notmuch show --format=raw subject:"test signed message 001" |\
+    openssl smime -verify -CAfile ca.crt 1>STDOUT 2>STDERR
+cat <<EOF > EXPECTED
+Verification successful
+Content-Type: text/plain
+
+This is a test signed message.
+EOF
+tr -d '\015' < STDOUT | cat STDERR - > OUTPUT
+test_expect_equal_file OUTPUT EXPECTED
+
+test_done
diff --git a/test/smime/openssl-ca-req.conf b/test/smime/openssl-ca-req.conf
new file mode 100644
index 0000000..49572ee
--- /dev/null
+++ b/test/smime/openssl-ca-req.conf
@@ -0,0 +1,13 @@
+ [ req ]
+ distinguished_name     = req_distinguished_name
+ prompt                 = no
+
+
+ [ req_distinguished_name ]
+ C                      = OZ
+ ST                     = Munchkinlandia
+ L                      = Emerald City
+ O                      = Organization Name
+ OU                     = Dept. of Fake Certs
+ CN                     = Fast Eddies Certs and Chips
+ emailAddress           = fake-ca@example.com
diff --git a/test/smime/openssl-req.conf b/test/smime/openssl-req.conf
new file mode 100644
index 0000000..c6b9de7
--- /dev/null
+++ b/test/smime/openssl-req.conf
@@ -0,0 +1,13 @@
+ [ req ]
+ distinguished_name     = req_distinguished_name
+ prompt                 = no
+
+
+ [ req_distinguished_name ]
+ C                      = OZ
+ ST                     = Munchkinlandia
+ L                      = Emerald City
+ O                      = Not much organization
+ OU                     = Dept. of Testing
+ CN                     = Notmuch Test Suite
+ emailAddress           = test_suite@notmuchmail.org
diff --git a/test/test-lib.el b/test/test-lib.el
index 04c8d63..596a705 100644
--- a/test/test-lib.el
+++ b/test/test-lib.el
@@ -188,3 +188,13 @@ nothing."
 ;; environments
 
 (setq mm-text-html-renderer 'html2text)
+
+;; Set some variables for S/MIME tests.
+
+(setq smime-keys '(("" "test_suite.pem" nil)))
+
+(setq mml-smime-use 'openssl)
+
+;; all test keys are without passphrase
+(eval-after-load 'smime
+  '(defun smime-ask-passphrase (cache)  nil))
diff --git a/test/test-lib.sh b/test/test-lib.sh
index 6057238..00612d9 100644
--- a/test/test-lib.sh
+++ b/test/test-lib.sh
@@ -1304,3 +1304,4 @@ test_declare_external_prereq gdb
 test_declare_external_prereq gpg
 test_declare_external_prereq python
 test_declare_external_prereq python2
+test_declare_external_prereq openssl
-- 
2.1.4

Re: [PATCH] test: initial tests for smime

[Jameson Graef Rollins]

[-- Attachment #1: Type: text/plain, Size: 643 bytes --]

On Sat, Jan 17 2015, David Bremner <david@tethera.net> wrote:
> It was kindof my fault: my original script add embedded ^M's in it, but
> this "cleverness" was messed up somewhere in the patch process.
>
> Does this version work for you?

For some reason PATCH 3/4 no longer applies after substituting in this
patch as PATCH 1/4.

But do we really need to test the message output of openssl?  It seems
like it's broken, and if it ever gets fixed we'll need to change this
test.  But all we really care about is that openssl is properly
verifying the message, yes?  Why not just test that and forget about the
rest of openssl's output?

jamie.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

Re: [PATCH] test: initial tests for smime

[David Bremner]

Jameson Graef Rollins <jrollins@finestructure.net> writes:

> For some reason PATCH 3/4 no longer applies after substituting in this
> patch as PATCH 1/4.

Ah, I guess I need to send the whole series again.

>
> But do we really need to test the message output of openssl?  It seems
> like it's broken, and if it ever gets fixed we'll need to change this
> test.

I think it's not so much broken as "canonical". There is some discussion
in the openssl-smime man page that pointed me to RFC5751
para 3.1.1

   MIME entities of major type "text" MUST have both their line endings
   and character set canonicalized.  The line ending MUST be the pair of
   characters <CR><LF>

> But all we really care about is that openssl is properly verifying the
> message, yes?  Why not just test that and forget about the rest of
> openssl's output?

Maybe it doesn't add too much as long as the message is using the "clear
signed" multipart/signed format. On the other hand there is an opaque
signed format (application/pkcs7-mime with Signeddata) too, where it
would be interesting to check for mangling of the text. Similarly, when
we add a similar test for encryption, I think we do want to check the
content, so we'll have to figure this out at some point.

Cheers,

d

Re: [PATCH] test: initial tests for smime

[Jameson Graef Rollins]

[-- Attachment #1: Type: text/plain, Size: 1516 bytes --]

On Sat, Jan 17 2015, David Bremner <david@tethera.net> wrote:
>> But do we really need to test the message output of openssl?  It seems
>> like it's broken, and if it ever gets fixed we'll need to change this
>> test.
>
> I think it's not so much broken as "canonical". There is some discussion
> in the openssl-smime man page that pointed me to RFC5751
> para 3.1.1
>
>    MIME entities of major type "text" MUST have both their line endings
>    and character set canonicalized.  The line ending MUST be the pair of
>    characters <CR><LF>

Interesting, and oh well.  Not going to fall down that rabbit hole!

>> But all we really care about is that openssl is properly verifying the
>> message, yes?  Why not just test that and forget about the rest of
>> openssl's output?
>
> Maybe it doesn't add too much as long as the message is using the "clear
> signed" multipart/signed format. On the other hand there is an opaque
> signed format (application/pkcs7-mime with Signeddata) too, where it
> would be interesting to check for mangling of the text. Similarly, when
> we add a similar test for encryption, I think we do want to check the
> content, so we'll have to figure this out at some point.

But at any point are we using the output of the message piped through
openssl?  Does gmime (possibly via gpgsm) actually pipe the message
through openssl before further parsing it?  If so, then I guess we do
care about what openssl does to the original message.  If not, then I'm
still not sure we care.

jamie.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]