* S/MIME support
@ 2012-06-29 18:38 Jameson Graef Rollins
2012-06-29 18:38 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins
` (2 more replies)
0 siblings, 3 replies; 22+ messages in thread
From: Jameson Graef Rollins @ 2012-06-29 18:38 UTC (permalink / raw)
To: Notmuch Mail
Hey, folks. This patch adds S/MIME support to notmuch-show. It's
pretty simple, now that the crypto rework [0] is complete.
I was going to wait to submit this patch until we had a test suite
(ehem, dkg!), but seeing as there has been some other interest
expressed in seeing this feature I'm going to go ahead and send it to
the list in the hopes that it might spur development of the needed
tests.
jamie.
[0] id:"1338057946-29209-2-git-send-email-jrollins@finestructure.net"
^ permalink raw reply [flat|nested] 22+ messages in thread* [PATCH 1/2] cli: S/MIME verification/decryption support 2012-06-29 18:38 S/MIME support Jameson Graef Rollins @ 2012-06-29 18:38 ` Jameson Graef Rollins 2012-06-29 18:38 ` [PATCH 2/2] debian: Recommend gpgsm for S/MIME support Jameson Graef Rollins 2012-07-09 18:33 ` Bryant, Daniel B. 2014-03-17 4:52 ` S/MIME support, rebased Jameson Graef Rollins 2 siblings, 1 reply; 22+ messages in thread From: Jameson Graef Rollins @ 2012-06-29 18:38 UTC (permalink / raw) To: Notmuch Mail The notmuch-show flags --decrypt and --verify will now also process S/MIME multiparts if encountered. Requires gmime-2.6 and gpgsm. --- crypto.c | 21 +++++++++++++++++++++ notmuch-client.h | 5 +++-- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/crypto.c b/crypto.c index fbe5aeb..551ffc5 100644 --- a/crypto.c +++ b/crypto.c @@ -52,6 +52,22 @@ notmuch_crypto_get_context (notmuch_crypto_t *crypto, const char *protocol) } cryptoctx = crypto->gpgctx; +#ifdef GMIME_ATLEAST_26 + } else if ((strcasecmp (protocol, "application/pkcs7-signature") == 0) + || (strcasecmp (protocol, "application/x-pkcs7-signature") == 0) + || (strcasecmp (protocol, "application/pkcs7-encrypted") == 0)) { + if (!crypto->pkcs7ctx) { + /* TODO: GMimePasswordRequestFunc */ + crypto->pkcs7ctx = g_mime_pkcs7_context_new (NULL); + if (crypto->pkcs7ctx) { + g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context*) crypto->pkcs7ctx, FALSE); + } else { + fprintf (stderr, "Failed to construct pkcs7 context.\n"); + } + } + cryptoctx = crypto->pkcs7ctx; + +#endif } else { fprintf (stderr, "Unknown or unsupported cryptographic protocol.\n"); } @@ -67,5 +83,10 @@ notmuch_crypto_cleanup (notmuch_crypto_t *crypto) crypto->gpgctx = NULL; } + if (crypto->pkcs7ctx) { + g_object_unref (crypto->pkcs7ctx); + crypto->pkcs7ctx = NULL; + } + return 0; } diff --git a/notmuch-client.h b/notmuch-client.h index 9b63eae..72edd50 100644 --- a/notmuch-client.h +++ b/notmuch-client.h @@ -79,6 +79,7 @@ typedef struct notmuch_show_format { typedef struct notmuch_crypto { notmuch_crypto_context_t* gpgctx; + notmuch_crypto_context_t* pkcs7ctx; notmuch_bool_t verify; notmuch_bool_t decrypt; } notmuch_crypto_t; @@ -353,8 +354,8 @@ struct mime_node { /* Construct a new MIME node pointing to the root message part of * message. If crypto->verify is true, signed child parts will be * verified. If crypto->decrypt is true, encrypted child parts will be - * decrypted. If crypto->gpgctx is NULL, it will be lazily - * initialized. + * decrypted. If the crypto contexts (crypto->gpgctx or + * crypto->pkcs7) are NULL, they will be lazily initialized. * * Return value: * -- 1.7.10 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH 2/2] debian: Recommend gpgsm for S/MIME support 2012-06-29 18:38 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins @ 2012-06-29 18:38 ` Jameson Graef Rollins 0 siblings, 0 replies; 22+ messages in thread From: Jameson Graef Rollins @ 2012-06-29 18:38 UTC (permalink / raw) To: Notmuch Mail --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 812430f..c3ed09c 100644 --- a/debian/control +++ b/debian/control @@ -26,7 +26,7 @@ Dm-Upload-Allowed: yes Package: notmuch Architecture: any Depends: libnotmuch3 (= ${binary:Version}), ${shlibs:Depends}, ${misc:Depends} -Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt, gnupg-agent +Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt, gnupg-agent, gpgsm Description: thread-based email index, search and tagging Notmuch is a system for indexing, searching, reading, and tagging large collections of email messages in maildir or mh format. It uses -- 1.7.10 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* RE: S/MIME support 2012-06-29 18:38 S/MIME support Jameson Graef Rollins 2012-06-29 18:38 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins @ 2012-07-09 18:33 ` Bryant, Daniel B. 2012-07-10 7:40 ` Jameson Graef Rollins 2014-03-17 4:52 ` S/MIME support, rebased Jameson Graef Rollins 2 siblings, 1 reply; 22+ messages in thread From: Bryant, Daniel B. @ 2012-07-09 18:33 UTC (permalink / raw) To: 'Jameson Graef Rollins', Notmuch Mail Jamie, I was able to get signature verification working with your patchset (with a caveat) but not decryption. Signature Verification ---------------------- The caveat is that GMime is still borked with handling signatures with content type application/x-pkcs7-signature (vs. application/pkcs7-signature, which works fine). This is upstream GNOME bug #674032 that was supposed to have been fixed in GMime 2.6.9, but that original fix is also broken. One possible workaround is to twiddle the content-type of the signature part (and the corresponding protocol in the multipart/signed part). I implemented this by looping over each message part in mime_node_open() and modifying as necessary using the following logic: GMimeContentType *content_type = g_mime_object_get_content_type (part); const char *subtype = g_mime_content_type_get_media_subtype (content_type); const char *protocol = g_mime_content_type_get_parameter (content_type, "protocol"); if (!strcmp(subtype, "x-pkcs7-signature")) { g_mime_content_type_set_media_subtype (content_type, "pkcs7-signature"); } if (protocol && !strcmp(protocol, "application/x-pkcs7-signature")) { g_mime_content_type_set_parameter (content_type, "protocol","application/pkcs7-signature"); } Decryption ---------- All of my S/MIME encrypted mail consists of single part messages with content-type "application/x-pkcs7-mime". These conform to RFC3851, section 3.3/3.4. (sample messages are included in the RFC as well). This fails to be decrypted by notmuch because the mime node traversal code assumes that every encrypted message is multipart/encrypted, which appears to only be true for PGP/MIME. Dan -----Original Message----- From: notmuch-bounces@notmuchmail.org [mailto:notmuch-bounces@notmuchmail.org] On Behalf Of Jameson Graef Rollins Sent: Friday, June 29, 2012 2:38 PM To: Notmuch Mail Subject: S/MIME support Hey, folks. This patch adds S/MIME support to notmuch-show. It's pretty simple, now that the crypto rework [0] is complete. I was going to wait to submit this patch until we had a test suite (ehem, dkg!), but seeing as there has been some other interest expressed in seeing this feature I'm going to go ahead and send it to the list in the hopes that it might spur development of the needed tests. jamie. [0] id:"1338057946-29209-2-git-send-email-jrollins@finestructure.net" _______________________________________________ notmuch mailing list notmuch@notmuchmail.org http://notmuchmail.org/mailman/listinfo/notmuch ^ permalink raw reply [flat|nested] 22+ messages in thread
* RE: S/MIME support 2012-07-09 18:33 ` Bryant, Daniel B. @ 2012-07-10 7:40 ` Jameson Graef Rollins 2012-08-31 19:50 ` David Bremner 0 siblings, 1 reply; 22+ messages in thread From: Jameson Graef Rollins @ 2012-07-10 7:40 UTC (permalink / raw) To: Bryant, Daniel B., Notmuch Mail [-- Attachment #1: Type: text/plain, Size: 2421 bytes --] On Mon, Jul 09 2012, "Bryant, Daniel B." <Dan.Bryant@jhuapl.edu> wrote: > I was able to get signature verification working with your patchset > (with a caveat) but not decryption. Hi, Daniel. I guess I'm only partially happy to hear that! I definitely do appreciate the feedback, though. > The caveat is that GMime is still borked with handling signatures with > content type application/x-pkcs7-signature > (vs. application/pkcs7-signature, which works fine). This is upstream > GNOME bug #674032 that was supposed to have been fixed in GMime 2.6.9, > but that original fix is also broken. Ah, I didn't notice that: https://bugzilla.gnome.org/show_bug.cgi?id=674032 Encouragingly, it sounds like Jeffery is working on it. > One possible workaround is to twiddle the content-type of the > signature part (and the corresponding protocol in the multipart/signed > part). I implemented this by looping over each message part in > mime_node_open() and modifying as necessary using the following logic: > > > GMimeContentType *content_type = g_mime_object_get_content_type (part); > > const char *subtype = g_mime_content_type_get_media_subtype (content_type); > const char *protocol = g_mime_content_type_get_parameter (content_type, "protocol"); > > if (!strcmp(subtype, "x-pkcs7-signature")) { > g_mime_content_type_set_media_subtype (content_type, "pkcs7-signature"); > } > > if (protocol && !strcmp(protocol, "application/x-pkcs7-signature")) { > g_mime_content_type_set_parameter (content_type, "protocol","application/pkcs7-signature"); > } We could do this, but I would certainly prefer that we fix gmime to handle both types properly. > All of my S/MIME encrypted mail consists of single part messages with > content-type "application/x-pkcs7-mime". These conform to RFC3851, > section 3.3/3.4. (sample messages are included in the RFC as > well). This fails to be decrypted by notmuch because the mime node > traversal code assumes that every encrypted message is > multipart/encrypted, which appears to only be true for PGP/MIME. Thanks for the great example of why we need tests! Would you (or anyone) be willing to start putting together some tests that include messages encrypted according to this RFC? I think adding some tests to the test/crypto script would be a great place to start. jamie. [-- Attachment #2: Type: application/pgp-signature, Size: 835 bytes --] ^ permalink raw reply [flat|nested] 22+ messages in thread
* RE: S/MIME support 2012-07-10 7:40 ` Jameson Graef Rollins @ 2012-08-31 19:50 ` David Bremner 0 siblings, 0 replies; 22+ messages in thread From: David Bremner @ 2012-08-31 19:50 UTC (permalink / raw) To: Jameson Graef Rollins, Bryant, Daniel B., Notmuch Mail Jameson Graef Rollins <jrollins@finestructure.net> writes: > > Ah, I didn't notice that: > > https://bugzilla.gnome.org/show_bug.cgi?id=674032 > > Encouragingly, it sounds like Jeffery is working on it. FYI it's marked fixed in upstream git now. d ^ permalink raw reply [flat|nested] 22+ messages in thread
* S/MIME support, rebased 2012-06-29 18:38 S/MIME support Jameson Graef Rollins 2012-06-29 18:38 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins 2012-07-09 18:33 ` Bryant, Daniel B. @ 2014-03-17 4:52 ` Jameson Graef Rollins 2014-03-17 4:52 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins 2015-01-17 10:51 ` SMIME patches v3, with some tests David Bremner 2 siblings, 2 replies; 22+ messages in thread From: Jameson Graef Rollins @ 2014-03-17 4:52 UTC (permalink / raw) To: Notmuch Mail Rebased against the current master. Still needs tests. jamie. ^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH 1/2] cli: S/MIME verification/decryption support 2014-03-17 4:52 ` S/MIME support, rebased Jameson Graef Rollins @ 2014-03-17 4:52 ` Jameson Graef Rollins 2014-03-17 4:52 ` [PATCH 2/2] debian: Recommend gpgsm for S/MIME support Jameson Graef Rollins 2014-07-01 10:55 ` [PATCH 1/2] cli: S/MIME verification/decryption support David Bremner 2015-01-17 10:51 ` SMIME patches v3, with some tests David Bremner 1 sibling, 2 replies; 22+ messages in thread From: Jameson Graef Rollins @ 2014-03-17 4:52 UTC (permalink / raw) To: Notmuch Mail The notmuch-show flags --decrypt and --verify will now also process S/MIME multiparts if encountered. Requires gmime-2.6 and gpgsm. --- crypto.c | 20 ++++++++++++++++++++ notmuch-client.h | 5 +++-- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/crypto.c b/crypto.c index 6f4a6db..d66aa66 100644 --- a/crypto.c +++ b/crypto.c @@ -88,6 +88,21 @@ notmuch_crypto_get_context (notmuch_crypto_t *crypto, const char *protocol) fprintf (stderr, "Failed to construct gpg context.\n"); } cryptoctx = crypto->gpgctx; +#ifdef GMIME_ATLEAST_26 + } else if ((strcasecmp (protocol, "application/pkcs7-signature") == 0) + || (strcasecmp (protocol, "application/x-pkcs7-signature") == 0) + || (strcasecmp (protocol, "application/pkcs7-encrypted") == 0)) { + if (! crypto->pkcs7ctx) { + /* TODO: GMimePasswordRequestFunc */ + crypto->pkcs7ctx = g_mime_pkcs7_context_new (NULL); + if (crypto->pkcs7ctx) { + g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context*) crypto->pkcs7ctx, FALSE); + } else { + fprintf (stderr, "Failed to construct pkcs7 context.\n"); + } + } + cryptoctx = crypto->pkcs7ctx; +#endif } else { fprintf (stderr, "Unknown or unsupported cryptographic protocol.\n"); } @@ -103,5 +118,10 @@ notmuch_crypto_cleanup (notmuch_crypto_t *crypto) crypto->gpgctx = NULL; } + if (crypto->pkcs7ctx) { + g_object_unref (crypto->pkcs7ctx); + crypto->pkcs7ctx = NULL; + } + return 0; } diff --git a/notmuch-client.h b/notmuch-client.h index 278b498..9b80107 100644 --- a/notmuch-client.h +++ b/notmuch-client.h @@ -78,6 +78,7 @@ typedef struct notmuch_show_format { typedef struct notmuch_crypto { notmuch_crypto_context_t* gpgctx; + notmuch_crypto_context_t* pkcs7ctx; notmuch_bool_t verify; notmuch_bool_t decrypt; } notmuch_crypto_t; @@ -411,8 +412,8 @@ struct mime_node { /* Construct a new MIME node pointing to the root message part of * message. If crypto->verify is true, signed child parts will be * verified. If crypto->decrypt is true, encrypted child parts will be - * decrypted. If crypto->gpgctx is NULL, it will be lazily - * initialized. + * decrypted. If the crypto contexts (crypto->gpgctx or + * crypto->pkcs7) are NULL, they will be lazily initialized. * * Return value: * -- 1.9.0 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH 2/2] debian: Recommend gpgsm for S/MIME support 2014-03-17 4:52 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins @ 2014-03-17 4:52 ` Jameson Graef Rollins 2014-07-01 10:55 ` [PATCH 1/2] cli: S/MIME verification/decryption support David Bremner 1 sibling, 0 replies; 22+ messages in thread From: Jameson Graef Rollins @ 2014-03-17 4:52 UTC (permalink / raw) To: Notmuch Mail --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 8d8e938..5002d78 100644 --- a/debian/control +++ b/debian/control @@ -30,7 +30,7 @@ Vcs-Browser: http://git.notmuchmail.org/git/notmuch Package: notmuch Architecture: any Depends: libnotmuch3 (= ${binary:Version}), ${shlibs:Depends}, ${misc:Depends} -Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt | alot, gnupg-agent +Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt | alot, gnupg-agent, gpgsm Description: thread-based email index, search and tagging Notmuch is a system for indexing, searching, reading, and tagging large collections of email messages in maildir or mh format. It uses -- 1.9.0 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [PATCH 1/2] cli: S/MIME verification/decryption support 2014-03-17 4:52 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins 2014-03-17 4:52 ` [PATCH 2/2] debian: Recommend gpgsm for S/MIME support Jameson Graef Rollins @ 2014-07-01 10:55 ` David Bremner 2014-07-06 17:36 ` Jameson Graef Rollins 1 sibling, 1 reply; 22+ messages in thread From: David Bremner @ 2014-07-01 10:55 UTC (permalink / raw) To: Jameson Graef Rollins, Notmuch Mail [-- Attachment #1: Type: text/plain, Size: 535 bytes --] Jameson Graef Rollins <jrollins@finestructure.net> writes: > The notmuch-show flags --decrypt and --verify will now also process > S/MIME multiparts if encountered. Requires gmime-2.6 and gpgsm. I was trying to figure out how to test this. I tried a few couple signed messages, but I got "bad" signature status in both cases. An example message is attached. http://mid.gmane.org/4F1423A1.90909@cms.hu-berlin.de Are we missing the signature between bad and untrusted signatures, or does that distinction not exist for S/MIME? [-- Attachment #2: 1326721985.H673045P22490.tesseract.cs.unb.ca:2,S --] [-- Type: application/octet-stream, Size: 13941 bytes --] Return-path: <opensync-users-bounces@lists.sourceforge.net> Envelope-to: bremner@tesseract.cs.unb.ca Delivery-date: Mon, 16 Jan 2012 09:53:05 -0400 Received: from fiero.its.unb.ca ([131.202.1.10]) by tesseract.cs.unb.ca with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.72) (envelope-from <opensync-users-bounces@lists.sourceforge.net>) id 1Rmmze-0005qg-Cz for bremner@tesseract.cs.unb.ca; Mon, 16 Jan 2012 09:53:05 -0400 Received: from mx2.nbpei-ecn.ca (mx2.nbpei-ecn.ca [198.164.163.195]) by fiero.its.unb.ca (8.13.8/8.13.8) with ESMTP id q0GDqucW026706 for <bremner@unb.ca>; Mon, 16 Jan 2012 09:52:56 -0400 Received: from mx2.nbpei-ecn.ca (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id D288A5343A7 for <bremner@unb.ca>; Mon, 16 Jan 2012 09:52:56 -0400 (AST) Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) by mx2.nbpei-ecn.ca (Postfix) with ESMTP id 504F45343B0 for <bremner@unb.ca>; Mon, 16 Jan 2012 09:52:56 -0400 (AST) Received: from localhost ([127.0.0.1] helo=sfs-ml-4.v29.ch3.sourceforge.com) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from <opensync-users-bounces@lists.sourceforge.net>) id 1RmmzX-0000tI-5D; Mon, 16 Jan 2012 13:52:55 +0000 Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193] helo=mx.sourceforge.net) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from <michael.bell@cms.hu-berlin.de>) id 1RmmzW-0000tC-M3 for opensync-users@lists.sourceforge.net; Mon, 16 Jan 2012 13:52:54 +0000 X-ACL-Warn: Received: from ir1.cms.hu-berlin.de ([141.20.1.146]) by sog-mx-3.v43.ch3.sourceforge.com with esmtp (Exim 4.76) id 1RmmzQ-0004lw-4m for opensync-users@lists.sourceforge.net; Mon, 16 Jan 2012 13:52:54 +0000 X-IronPort-AV: E=Sophos;i="4.71,518,1320620400"; d="p7s'?scan'208";a="87263631" Received: from bellus.cms.hu-berlin.de (HELO [141.20.3.34]) ([141.20.3.34]) by ir1-relay.cms.hu-berlin.de with ESMTP/TLS/DHE-RSA-CAMELLIA256-SHA; 16 Jan 2012 14:18:26 +0100 Message-ID: <4F1423A1.90909@cms.hu-berlin.de> Date: Mon, 16 Jan 2012 14:18:25 +0100 From: Michael Bell <michael.bell@cms.hu-berlin.de> User-Agent: Mozilla/5.0 (X11; Linux i686; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 MIME-Version: 1.0 To: opensync-users@lists.sourceforge.net References: <loom.20120116T115752-913@post.gmane.org> In-Reply-To: <loom.20120116T115752-913@post.gmane.org> X-Enigmail-Version: 1.3.4 X-Spam-Score: -0.0 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain X-Headers-End: 1RmmzQ-0004lw-4m Subject: Re: [Opensync-users] Trouble with libwbxml installation X-BeenThere: opensync-users@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: <opensync-users.lists.sourceforge.net> List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/opensync-users>, <mailto:opensync-users-request@lists.sourceforge.net?subject=unsubscribe> List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=opensync-users> List-Post: <mailto:opensync-users@lists.sourceforge.net> List-Help: <mailto:opensync-users-request@lists.sourceforge.net?subject=help> List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/opensync-users>, <mailto:opensync-users-request@lists.sourceforge.net?subject=subscribe> Content-Type: multipart/mixed; boundary="===============0939083224693629589==" Errors-To: opensync-users-bounces@lists.sourceforge.net X-PMX-Version: 5.6.1.2065439, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2012.1.16.134214 X-PerlMx-Spam: Gauge=X, Probability=10%, Report=' TO_IN_SUBJECT 0.5, BODYTEXTP_SIZE_3000_LESS 0, __ANY_URI 0, __BOUNCE_CHALLENGE_SUBJ 0, __BOUNCE_NDR_SUBJ_EXEMPT 0, __CP_URI_IN_BODY 0, __CT 0, __CTYPE_HAS_BOUNDARY 0, __CTYPE_MULTIPART 0, __CTYPE_MULTIPART_MIXED 0, __HAS_LIST_HEADER 0, __HAS_LIST_HELP 0, __HAS_LIST_SUBSCRIBE 0, __HAS_LIST_UNSUBSCRIBE 0, __HAS_MSGID 0, __INT_PROD_COMP 0, __LINES_OF_YELLING 0, __MIME_VERSION 0, __MOZILLA_MSGID 0, __OEM_PRICE 0, __SANE_MSGID 0, __STOCK_PHRASE_7 0, __TO_MALFORMED_2 0, __TO_NO_NAME 0, __URI_NO_WWW 0, __URI_NS , __USER_AGENT 0' X-Spam-Score: -1.6 X-Spam_bar: - Dies ist eine kryptografisch unterzeichnete Nachricht im MIME-Format. --===============0939083224693629589== Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms030508040105000407050008" Dies ist eine kryptografisch unterzeichnete Nachricht im MIME-Format. --------------ms030508040105000407050008 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi, can you please send the complete output including the command line input which you used to start cmake? BTW did you install libexpat1-dev? (I use Debian sid.) Best regards Michael Am 01/16/12 12:08, schrieb Nikitah Bobhate: > Hello >=20 > I am trying to install libwbxml in Ubuntu 11.10 with cmake. I have=20 > installed cmake and expat. However when I run the commands in the=20 > Install text file, I get the following error: >=20 > ********** >=20 > CMake Error: The following variables are used in this project, but=20 > they are set to NOTFOUND. > Please set them or make sure they are set and tested correctly in=20 > the CMake files: > EXPAT_INCLUDE_DIRS (ADVANCED) > used as include directory in directory /home/---/libwbxml-0.11.0/sr= c > used as include directory in directory /home/---/libwbxml-0.11.0/to= ols > EXPAT_LIBRARIES (ADVANCED) > linked by target "wbxml2" in directory /home/---/libwbxml-0.11.0/sr= c >=20 > -- Configuration incomplete, errors occured! >=20 > ********** >=20 > I would appreciate any help troubleshooting this! > Thanks! >=20 >=20 > -----------------------------------------------------------------------= ------- > RSA(R) Conference 2012 > Mar 27 - Feb 2 > Save $400 by Jan. 27 > Register now! > http://p.sf.net/sfu/rsa-sfdev2dev2 > _______________________________________________ > Opensync-users mailing list > Opensync-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/opensync-users --=20 ___________________________________________________________________ Michael Bell Humboldt-Universitaet zu Berlin Tel.: +49 (0)30-2093 70143 ZE Computer- und Medienservice Fax: +49 (0)30-2093 70135 Unter den Linden 6 michael.bell@cms.hu-berlin.de D-10099 Berlin ___________________________________________________________________ PGP Fingerprint: 09E4 3D29 4156 2774 0F2C C643 D8BD 1918 2030 5AAB --------------ms030508040105000407050008 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Kryptografische Unterschrift MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIOgzCC BCEwggMJoAMCAQICAgDHMA0GCSqGSIb3DQEBBQUAMHExCzAJBgNVBAYTAkRFMRwwGgYDVQQK ExNEZXV0c2NoZSBUZWxla29tIEFHMR8wHQYDVQQLExZULVRlbGVTZWMgVHJ1c3QgQ2VudGVy MSMwIQYDVQQDExpEZXV0c2NoZSBUZWxla29tIFJvb3QgQ0EgMjAeFw0wNjEyMTkxMDI5MDBa Fw0xOTA2MzAyMzU5MDBaMFoxCzAJBgNVBAYTAkRFMRMwEQYDVQQKEwpERk4tVmVyZWluMRAw DgYDVQQLEwdERk4tUEtJMSQwIgYDVQQDExtERk4tVmVyZWluIFBDQSBHbG9iYWwgLSBHMDEw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDpm8NnhfkNrvWNVMOWUDU9YuluTO2U 1wBblSJ01CDrNI/W7MAxBAuZgeKmFNJSoCgjhIt0iQReW+DieMF4yxbLKDU5ey2QRdDtoAB6 fL9KDhsAw4bpXCsxEXsM84IkQ4wcOItqaACa7txPeKvSxhObdq3u3ibo7wGvdA/BCaL2a869 080UME/15eOkyGKbghoDJzANAmVgTe3RCSMqljVYJ9N2xnG2kB3E7f81hn1vM7PbD8URwoqD oZRdQWvY0hD1TP3KUazZve+Sg7va64sWVlZDz+HVEz2mHycwzUlU28kTNJpxdcVs6qcLmPkh nSevPqM5OUhqjK3JmfvDEvK9AgMBAAGjgdkwgdYwcAYDVR0fBGkwZzBloGOgYYZfaHR0cDov L3BraS50ZWxlc2VjLmRlL2NnaS1iaW4vc2VydmljZS9hZl9Eb3dubG9hZEFSTC5jcmw/LWNy bF9mb3JtYXQ9WF81MDkmLWlzc3Vlcj1EVF9ST09UX0NBXzIwHQYDVR0OBBYEFEm3xs/oPR9/ 6kR7Eyn38QpwPt5kMB8GA1UdIwQYMBaAFDHDeRu69VPXF+CJei0XbAqzK50zMA4GA1UdDwEB /wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgECMA0GCSqGSIb3DQEBBQUAA4IBAQA74Vp3wEgX 3KkY7IGvWonwvSiSpspZGBJw7Cjy565/lizn8l0ZMfYTK3S9vYCyufdnyTmieTvhERHua3iR M347XyYndVNljjNj7s9zw7CSI0khUHUjoR8Y4pSFPT8z6XcgjaK95qGFKUD2P3MyWA0Ja6ba hWzAP7uNZmRWJE6uDT8yNQFb6YyC2XJZT7GGhfF0hVblw/hc843uR7NTBXDn5U2KaYMo4RMJ hp5eyOpYHgwf+aTUWgRo/Sg+iwK2WLX2oSw3VwBnqyNojWOl75lrXP1LVvarQIc01BGSbOyH xQoLBzNytG8MHVQs2FHHzL8w00Ny8TK/jM5JY6gA9/IcMIIE9DCCA9ygAwIBAgIEC2I0jzAN BgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJERTETMBEGA1UEChMKREZOLVZlcmVpbjEQMA4G A1UECxMHREZOLVBLSTEkMCIGA1UEAxMbREZOLVZlcmVpbiBQQ0EgR2xvYmFsIC0gRzAxMB4X DTA3MTEyMDEwMjkyMVoXDTE5MDYzMDAwMDAwMFowaDELMAkGA1UEBhMCREUxKDAmBgNVBAoT H0h1bWJvbGR0LVVuaXZlcnNpdGFldCB6dSBCZXJsaW4xDjAMBgNVBAMTBUhVLUNBMR8wHQYJ KoZIhvcNAQkBFhBwa2lAaHUtYmVybGluLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEA6wxB17AojABvR7rEkR8v3wfquJ1RAGBx9Bhv0pQis98kCJaaYYO1cspc0znfEAOc Bk9lBhb/sWfV13KFKDcib7WlY1sFBHCJAbGkpcNTfqp/enTtDZOzXFUzXOj5+lcaHwn6qt2H Q7oafm8wfPp9efd3ykRzCWhbZ7K3o/kCCMHw5Dxe9na4OdQCXqwp6Hhpmx9CGHq2SPWxrRZq dZJzmfhmDV3yVYghIuyHN/jDTorshki3pWF3OFHpok1w09LKPDUZRdHZzUt7ZIZYEwdvjVAK JAsHyKjzrASRfHJgXvJQLENcBJwPGXfJGMSXj3AcS9CjwQdtMlyDsU4D5RV4BQIDAQABo4IB sjCCAa4wEgYDVR0TAQH/BAgwBgEB/wIBATALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFB/1LD73 QKsukKBq0+J5XvJ2zYN0MB8GA1UdIwQYMBaAFEm3xs/oPR9/6kR7Eyn38QpwPt5kMBsGA1Ud EQQUMBKBEHBraUBodS1iZXJsaW4uZGUwgYgGA1UdHwSBgDB+MD2gO6A5hjdodHRwOi8vY2Rw MS5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1Yi9jcmwvY2FjcmwuY3JsMD2gO6A5hjdo dHRwOi8vY2RwMi5wY2EuZGZuLmRlL2dsb2JhbC1yb290LWNhL3B1Yi9jcmwvY2FjcmwuY3Js MIGiBggrBgEFBQcBAQSBlTCBkjBHBggrBgEFBQcwAoY7aHR0cDovL2NkcDEucGNhLmRmbi5k ZS9nbG9iYWwtcm9vdC1jYS9wdWIvY2FjZXJ0L2NhY2VydC5jcnQwRwYIKwYBBQUHMAKGO2h0 dHA6Ly9jZHAyLnBjYS5kZm4uZGUvZ2xvYmFsLXJvb3QtY2EvcHViL2NhY2VydC9jYWNlcnQu Y3J0MA0GCSqGSIb3DQEBBQUAA4IBAQBO3AOzYN+zVEPJLJHP12+Oa7wzhC2aji1SGLkPHqYn l27d2+FxXgOo24p+rC7vS53tLGjE41EfkwEgO+cy4J9mUptTlDqa3gvzkR8C95Yl43fmYd5H JrZ+WqQTVddwhxnOBCY0f+oW+RmeybR6TYDAQ+ByK6ru6DFPBRQpIejuny75jjm0EZzcPwZZ J+gxObQ67RtMxiFk6Io6jWRdpy40mDJ39NF1tJqAFxo+3hSKVRTVs1l/ML12lLmTq+tgri9b LBEQLwNoaCjGhn2aOMYJB0Rd5a31pbiXEZLV4IBylWd5/y3Nfb9q3x+i1lXI05u+oJ3q9ox4 PbuuKU3VWIngMIIFYjCCBEqgAwIBAgIEDytOrDANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQG EwJERTEoMCYGA1UEChMfSHVtYm9sZHQtVW5pdmVyc2l0YWV0IHp1IEJlcmxpbjEOMAwGA1UE AxMFSFUtQ0ExHzAdBgkqhkiG9w0BCQEWEHBraUBodS1iZXJsaW4uZGUwHhcNMDkxMTI0MTIy NzA5WhcNMTIxMTIzMTIyNzA5WjCBoTELMAkGA1UEBhMCREUxKDAmBgNVBAoTH0h1bWJvbGR0 LVVuaXZlcnNpdGFldCB6dSBCZXJsaW4xNzA1BgNVBAsTLlplbnRyYWxlaW5yaWNodHVuZyBD b21wdXRlci0gdW5kIE1lZGllbnNlcnZpY2UxGDAWBgoJkiaJk/IsZAEBEwhiZWxsbWljaDEV MBMGA1UEAxMMTWljaGFlbCBCZWxsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA x7eDOYMCbwzKrnoDyCB9vHzX9mQH0n0In6mIxZbLL7w+a7wEsawK6W5QH2YDIJO+sENZuV8V xfP60Q/M4lTDNtUtjA7MxAZHm32lDqGiikJq3D9dQ1Z3bACyX2UZVAPWZDNOwQ/9o3eRsoPE 3PVLtQwy1LjeMUhL4MAF/A01loaJvjUl2LkPbyo/MMpqvf3JNZVpsr6YTAkUWPVph//YamZn tPKeE/b5zBuEU61M0M3ohDb7VXn1dz4vkkB0V6Fb5bhIa5u0srubgVS5ple6Tl1EBNBmCgoX RAEpl12oCgMeC38iGGi7CdDBvChH6toKW+9f7YpdfL85o/nLA/5nzQIDAQABo4IB2DCCAdQw CQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwKQYDVR0lBCIwIAYIKwYBBQUHAwIGCCsGAQUFBwME BgorBgEEAYI3FAICMB0GA1UdDgQWBBS2ujFtnzcaoFrD1Jrf3eGuHYM+DzAfBgNVHSMEGDAW gBQf9Sw+90CrLpCgatPieV7yds2DdDAoBgNVHREEITAfgR1taWNoYWVsLmJlbGxAY21zLmh1 LWJlcmxpbi5kZTCBgwYDVR0fBHwwejA7oDmgN4Y1aHR0cDovL2NkcDEucGNhLmRmbi5kZS9o dS1iZXJsaW4tY2EvcHViL2NybC9jYWNybC5jcmwwO6A5oDeGNWh0dHA6Ly9jZHAyLnBjYS5k Zm4uZGUvaHUtYmVybGluLWNhL3B1Yi9jcmwvY2FjcmwuY3JsMIGeBggrBgEFBQcBAQSBkTCB jjBFBggrBgEFBQcwAoY5aHR0cDovL2NkcDEucGNhLmRmbi5kZS9odS1iZXJsaW4tY2EvcHVi L2NhY2VydC9jYWNlcnQuY3J0MEUGCCsGAQUFBzAChjlodHRwOi8vY2RwMi5wY2EuZGZuLmRl L2h1LWJlcmxpbi1jYS9wdWIvY2FjZXJ0L2NhY2VydC5jcnQwDQYJKoZIhvcNAQEFBQADggEB AAN9XKHSnqJjnZRFe7LR2GZYkfFkRWoEoRRBTW1oQMeKaFmFpmvqt4VJynxO+3s6Z+Gv+Luy vCkYX58c+HM8ivFhRafTNTOtxJTBP/OjiygwmmeAryqVmfxkZM9I2eyhdE0WdRb/fWkKJsH4 JoV6gWAOzVyJf8pfbHbgT4BUEEdkB42my+W69r3YJ33Wv5FGM0elnuS90vT3bTvbMAzJG9XQ suiMLZ3EjKHDXwCsCQDBSOZakmAN6MvaCyj1BCNHb/irSaicY/VnGtAYt2SG27+BEcjQxLgo LXRrRceQwoYLeb8zp813pyXkfajYnxWHAAItMVVDPoYlC6JqJh1QvXQxggNeMIIDWgIBATBw MGgxCzAJBgNVBAYTAkRFMSgwJgYDVQQKEx9IdW1ib2xkdC1Vbml2ZXJzaXRhZXQgenUgQmVy bGluMQ4wDAYDVQQDEwVIVS1DQTEfMB0GCSqGSIb3DQEJARYQcGtpQGh1LWJlcmxpbi5kZQIE DytOrDAJBgUrDgMCGgUAoIIBwzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3 DQEJBTEPFw0xMjAxMTYxMzE4MjVaMCMGCSqGSIb3DQEJBDEWBBR2ay+Www6STB4F0jxoPA9t 5jvlVDBfBgkqhkiG9w0BCQ8xUjBQMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG 9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwfwYJKwYB BAGCNxAEMXIwcDBoMQswCQYDVQQGEwJERTEoMCYGA1UEChMfSHVtYm9sZHQtVW5pdmVyc2l0 YWV0IHp1IEJlcmxpbjEOMAwGA1UEAxMFSFUtQ0ExHzAdBgkqhkiG9w0BCQEWEHBraUBodS1i ZXJsaW4uZGUCBA8rTqwwgYEGCyqGSIb3DQEJEAILMXKgcDBoMQswCQYDVQQGEwJERTEoMCYG A1UEChMfSHVtYm9sZHQtVW5pdmVyc2l0YWV0IHp1IEJlcmxpbjEOMAwGA1UEAxMFSFUtQ0Ex HzAdBgkqhkiG9w0BCQEWEHBraUBodS1iZXJsaW4uZGUCBA8rTqwwDQYJKoZIhvcNAQEBBQAE ggEAqRLLEU/G9D2ZvxtZUgBSRyUPJPiGNhKRSfQquTuc93Hbg//Y8g4mPv+PdSKtHX84Dxxe uFY1CReVpRzALkwDR1kSkECksnl2H8jWQsQdo/8o+7BLWqeB43MYyBbnEJfXAp9ZNkuLihUN gLDjNPPt0YO5o+RGVzNwcQujMMsRlI0qvC9xFs6rYnIaQo8cLxjoFu6Edr3Ko4jSUfXLP4O5 7SZb5ZHBM9UR3N2udQ9Dku8d1IKQBNsqmX3Ubfh6e/oDKG0s6VePU9Q/4yzE61dxBh1wyEG5 JxGNP4SYfgy9GS5IdxjifYyZTnmuRr4l25Ym7twtCev5Ik9SEmhBLQQ2UAAAAAAAAA== --------------ms030508040105000407050008-- --===============0939083224693629589== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ RSA(R) Conference 2012 Mar 27 - Feb 2 Save $400 by Jan. 27 Register now! http://p.sf.net/sfu/rsa-sfdev2dev2 --===============0939083224693629589== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Opensync-users mailing list Opensync-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/opensync-users --===============0939083224693629589==-- ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH 1/2] cli: S/MIME verification/decryption support 2014-07-01 10:55 ` [PATCH 1/2] cli: S/MIME verification/decryption support David Bremner @ 2014-07-06 17:36 ` Jameson Graef Rollins 2014-07-06 18:18 ` David Bremner 0 siblings, 1 reply; 22+ messages in thread From: Jameson Graef Rollins @ 2014-07-06 17:36 UTC (permalink / raw) To: David Bremner, Notmuch Mail [-- Attachment #1: Type: text/plain, Size: 752 bytes --] On Tue, Jul 01 2014, David Bremner <david@tethera.net> wrote: > Jameson Graef Rollins <jrollins@finestructure.net> writes: > >> The notmuch-show flags --decrypt and --verify will now also process >> S/MIME multiparts if encountered. Requires gmime-2.6 and gpgsm. > > I was trying to figure out how to test this. I tried a few couple signed > messages, but I got "bad" signature status in both cases. > > An example message is attached. > > http://mid.gmane.org/4F1423A1.90909@cms.hu-berlin.de > > Are we missing the signature between bad and untrusted signatures, or > does that distinction not exist for S/MIME? Hey, David. How did you generate the signatures? I would love to see a script that generates a signature on a test message. jamie. [-- Attachment #2: Type: application/pgp-signature, Size: 818 bytes --] ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH 1/2] cli: S/MIME verification/decryption support 2014-07-06 17:36 ` Jameson Graef Rollins @ 2014-07-06 18:18 ` David Bremner 0 siblings, 0 replies; 22+ messages in thread From: David Bremner @ 2014-07-06 18:18 UTC (permalink / raw) To: Jameson Graef Rollins, Notmuch Mail Jameson Graef Rollins <jrollins@finestructure.net> writes: >> >> Are we missing the signature between bad and untrusted signatures, or >> does that distinction not exist for S/MIME? > > Hey, David. How did you generate the signatures? I would love to see a > script that generates a signature on a test message. I just grepped over my mail store for S/MIME signed messages. So it's possible they're all bad, but it seems a bit unlikely. I guess emacs+message-mode should be able to generate a signed message message, I just don't know about the cert management. d ^ permalink raw reply [flat|nested] 22+ messages in thread
* SMIME patches v3, with some tests 2014-03-17 4:52 ` S/MIME support, rebased Jameson Graef Rollins 2014-03-17 4:52 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins @ 2015-01-17 10:51 ` David Bremner 2015-01-17 10:51 ` [PATCH 1/4] test: initial tests for smime David Bremner ` (4 more replies) 1 sibling, 5 replies; 22+ messages in thread From: David Bremner @ 2015-01-17 10:51 UTC (permalink / raw) To: Jameson Graef Rollins, Notmuch Mail Generating the certs was very much trial and error. The net of a thousand lies may have led me astray a bit in that it may be possible to do this all with gpgsm and avoid the dependency on openssl. On the other hand, some tests is better than no tests. ^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH 1/4] test: initial tests for smime 2015-01-17 10:51 ` SMIME patches v3, with some tests David Bremner @ 2015-01-17 10:51 ` David Bremner 2015-01-17 10:51 ` [PATCH 2/4] cli: S/MIME verification/decryption support David Bremner ` (3 subsequent siblings) 4 siblings, 0 replies; 22+ messages in thread From: David Bremner @ 2015-01-17 10:51 UTC (permalink / raw) To: Jameson Graef Rollins, Notmuch Mail Test the ability of notmuch-mua-mail to send smime signed messages; this really relies on existing functionality in message-mode. The dependency on openssl to generate keys seems acceptable since that's the method I got to work for smime signing in emacs. --- test/T355-smime.sh | 41 +++++++++++++++++++++++++++++++++++++++++ test/smime/openssl-ca-req.conf | 13 +++++++++++++ test/smime/openssl-req.conf | 13 +++++++++++++ test/test-lib.el | 10 ++++++++++ test/test-lib.sh | 1 + 5 files changed, 78 insertions(+) create mode 100755 test/T355-smime.sh create mode 100644 test/smime/openssl-ca-req.conf create mode 100644 test/smime/openssl-req.conf diff --git a/test/T355-smime.sh b/test/T355-smime.sh new file mode 100755 index 0000000..01f6ecd --- /dev/null +++ b/test/T355-smime.sh @@ -0,0 +1,41 @@ +#!/usr/bin/env bash + +test_description='S/MIME signature verification and decryption' +. ./test-lib.sh + +test_require_external_prereq openssl + +test_begin_subtest "Generate CA Cert" +openssl genpkey -algorithm RSA -out ca.key -pass pass:test -des3 1024 +openssl req -new -x509 -key ca.key -passin pass:test \ + -config $TEST_DIRECTORY/smime/openssl-ca-req.conf -out ca.crt +test_expect_equal "$(openssl verify ca.crt | tail -1)" "OK" + +test_begin_subtest "Generate User Cert" +openssl genpkey -algorithm RSA -out smime.key 1024 +openssl req -config $TEST_DIRECTORY/smime/openssl-req.conf \ + -new -key smime.key -passin pass:test -nodes \ + -out smime.csr +openssl x509 -req -in smime.csr -passin pass:test -CA ca.crt -CAkey ca.key -set_serial 1 -out test_suite.crt -setalias "Self Signed SMIME" -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout +# we need one file with the cert and private key +cat test_suite.crt smime.key > test_suite.pem +test_expect_equal "$(openssl verify -purpose smimesign -CAfile ca.crt test_suite.pem)" "test_suite.pem: OK" + +test_expect_success 'emacs delivery of S/MIME signed message' \ + 'emacs_fcc_message \ + "test signed message 001" \ + "This is a test signed message." \ + "(mml-secure-message-sign \"smime\")"' + +test_begin_subtest "Signature verification (openssl)" +notmuch show --format=raw subject:"test signed message 001" |\ + openssl smime -verify -CAfile ca.crt >& OUTPUT +cat <<EOF > EXPECTED +Verification successful +Content-Type: text/plain + +This is a test signed message. +EOF +test_expect_equal_file OUTPUT EXPECTED + +test_done diff --git a/test/smime/openssl-ca-req.conf b/test/smime/openssl-ca-req.conf new file mode 100644 index 0000000..49572ee --- /dev/null +++ b/test/smime/openssl-ca-req.conf @@ -0,0 +1,13 @@ + [ req ] + distinguished_name = req_distinguished_name + prompt = no + + + [ req_distinguished_name ] + C = OZ + ST = Munchkinlandia + L = Emerald City + O = Organization Name + OU = Dept. of Fake Certs + CN = Fast Eddies Certs and Chips + emailAddress = fake-ca@example.com diff --git a/test/smime/openssl-req.conf b/test/smime/openssl-req.conf new file mode 100644 index 0000000..c6b9de7 --- /dev/null +++ b/test/smime/openssl-req.conf @@ -0,0 +1,13 @@ + [ req ] + distinguished_name = req_distinguished_name + prompt = no + + + [ req_distinguished_name ] + C = OZ + ST = Munchkinlandia + L = Emerald City + O = Not much organization + OU = Dept. of Testing + CN = Notmuch Test Suite + emailAddress = test_suite@notmuchmail.org diff --git a/test/test-lib.el b/test/test-lib.el index 04c8d63..596a705 100644 --- a/test/test-lib.el +++ b/test/test-lib.el @@ -188,3 +188,13 @@ nothing." ;; environments (setq mm-text-html-renderer 'html2text) + +;; Set some variables for S/MIME tests. + +(setq smime-keys '(("" "test_suite.pem" nil))) + +(setq mml-smime-use 'openssl) + +;; all test keys are without passphrase +(eval-after-load 'smime + '(defun smime-ask-passphrase (cache) nil)) diff --git a/test/test-lib.sh b/test/test-lib.sh index 53db9ca..a5428bb 100644 --- a/test/test-lib.sh +++ b/test/test-lib.sh @@ -1302,3 +1302,4 @@ test_declare_external_prereq gdb test_declare_external_prereq gpg test_declare_external_prereq python test_declare_external_prereq python2 +test_declare_external_prereq openssl -- 2.1.4 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH 2/4] cli: S/MIME verification/decryption support 2015-01-17 10:51 ` SMIME patches v3, with some tests David Bremner 2015-01-17 10:51 ` [PATCH 1/4] test: initial tests for smime David Bremner @ 2015-01-17 10:51 ` David Bremner 2015-01-17 10:51 ` [PATCH 3/4] test: add S/MIME signature verification test for notmuch CLI David Bremner ` (2 subsequent siblings) 4 siblings, 0 replies; 22+ messages in thread From: David Bremner @ 2015-01-17 10:51 UTC (permalink / raw) To: Jameson Graef Rollins, Notmuch Mail From: Jameson Graef Rollins <jrollins@finestructure.net> The notmuch-show flags --decrypt and --verify will now also process S/MIME multiparts if encountered. Requires gmime-2.6 and gpgsm. --- crypto.c | 20 ++++++++++++++++++++ notmuch-client.h | 5 +++-- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/crypto.c b/crypto.c index 6f4a6db..d66aa66 100644 --- a/crypto.c +++ b/crypto.c @@ -88,6 +88,21 @@ notmuch_crypto_get_context (notmuch_crypto_t *crypto, const char *protocol) fprintf (stderr, "Failed to construct gpg context.\n"); } cryptoctx = crypto->gpgctx; +#ifdef GMIME_ATLEAST_26 + } else if ((strcasecmp (protocol, "application/pkcs7-signature") == 0) + || (strcasecmp (protocol, "application/x-pkcs7-signature") == 0) + || (strcasecmp (protocol, "application/pkcs7-encrypted") == 0)) { + if (! crypto->pkcs7ctx) { + /* TODO: GMimePasswordRequestFunc */ + crypto->pkcs7ctx = g_mime_pkcs7_context_new (NULL); + if (crypto->pkcs7ctx) { + g_mime_pkcs7_context_set_always_trust ((GMimePkcs7Context*) crypto->pkcs7ctx, FALSE); + } else { + fprintf (stderr, "Failed to construct pkcs7 context.\n"); + } + } + cryptoctx = crypto->pkcs7ctx; +#endif } else { fprintf (stderr, "Unknown or unsupported cryptographic protocol.\n"); } @@ -103,5 +118,10 @@ notmuch_crypto_cleanup (notmuch_crypto_t *crypto) crypto->gpgctx = NULL; } + if (crypto->pkcs7ctx) { + g_object_unref (crypto->pkcs7ctx); + crypto->pkcs7ctx = NULL; + } + return 0; } diff --git a/notmuch-client.h b/notmuch-client.h index 5e0d475..986f6cd 100644 --- a/notmuch-client.h +++ b/notmuch-client.h @@ -78,6 +78,7 @@ typedef struct notmuch_show_format { typedef struct notmuch_crypto { notmuch_crypto_context_t* gpgctx; + notmuch_crypto_context_t* pkcs7ctx; notmuch_bool_t verify; notmuch_bool_t decrypt; } notmuch_crypto_t; @@ -414,8 +415,8 @@ struct mime_node { /* Construct a new MIME node pointing to the root message part of * message. If crypto->verify is true, signed child parts will be * verified. If crypto->decrypt is true, encrypted child parts will be - * decrypted. If crypto->gpgctx is NULL, it will be lazily - * initialized. + * decrypted. If the crypto contexts (crypto->gpgctx or + * crypto->pkcs7) are NULL, they will be lazily initialized. * * Return value: * -- 2.1.4 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH 3/4] test: add S/MIME signature verification test for notmuch CLI 2015-01-17 10:51 ` SMIME patches v3, with some tests David Bremner 2015-01-17 10:51 ` [PATCH 1/4] test: initial tests for smime David Bremner 2015-01-17 10:51 ` [PATCH 2/4] cli: S/MIME verification/decryption support David Bremner @ 2015-01-17 10:51 ` David Bremner 2015-01-17 10:51 ` [PATCH 4/4] debian: Recommend gpgsm for S/MIME support David Bremner 2015-01-17 20:07 ` SMIME patches v3, with some tests Jameson Graef Rollins 4 siblings, 0 replies; 22+ messages in thread From: David Bremner @ 2015-01-17 10:51 UTC (permalink / raw) To: Jameson Graef Rollins, Notmuch Mail The test is pretty much cut and paste from the PGP/MIME version, with obvious updates taken from notmuch output. This also requires setting up gpgsm infrastucture. --- test/T355-smime.sh | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ test/test-lib.sh | 1 + 2 files changed, 50 insertions(+) diff --git a/test/T355-smime.sh b/test/T355-smime.sh index 01f6ecd..fbcf323 100755 --- a/test/T355-smime.sh +++ b/test/T355-smime.sh @@ -3,7 +3,17 @@ test_description='S/MIME signature verification and decryption' . ./test-lib.sh +add_gpgsm_home () +{ + local output + [ -d ${GNUPGHOME} ] && return + mkdir -m 0700 "$GNUPGHOME" + gpgsm --no-tty --import < test_suite.pem >"$GNUPGHOME"/import.log 2>&1 + test_debug "cat $GNUPGHOME/import.log" +} + test_require_external_prereq openssl +test_require_external_prereq gpgsm test_begin_subtest "Generate CA Cert" openssl genpkey -algorithm RSA -out ca.key -pass pass:test -des3 1024 @@ -21,6 +31,10 @@ openssl x509 -req -in smime.csr -passin pass:test -CA ca.crt -CAkey ca.key -set_ cat test_suite.crt smime.key > test_suite.pem test_expect_equal "$(openssl verify -purpose smimesign -CAfile ca.crt test_suite.pem)" "test_suite.pem: OK" +add_gpgsm_home + +FINGERPRINT=$(openssl x509 -fingerprint -in test_suite.crt -noout | sed -e 's/^.*=//' -e s/://g) + test_expect_success 'emacs delivery of S/MIME signed message' \ 'emacs_fcc_message \ "test signed message 001" \ @@ -38,4 +52,39 @@ This is a test signed message. EOF test_expect_equal_file OUTPUT EXPECTED +test_begin_subtest "signature verification (notmuch CLI)" +output=$(notmuch show --format=json --verify subject:"test signed message 001" \ + | notmuch_json_show_sanitize \ + | sed -e 's|"created": [1234567890]*|"created": 946728000|' \ + -e 's|"expires": [1234567890]*|"expires": 424242424|' ) +expected='[[[{"id": "XXXXX", + "match": true, + "excluded": false, + "filename": "YYYYY", + "timestamp": 946728000, + "date_relative": "2000-01-01", + "tags": ["inbox","signed"], + "headers": {"Subject": "test signed message 001", + "From": "Notmuch Test Suite <test_suite@notmuchmail.org>", + "To": "test_suite@notmuchmail.org", + "Date": "Sat, 01 Jan 2000 12:00:00 +0000"}, + "body": [{"id": 1, + "sigstatus": [{"status": "good", + "fingerprint": "'$FINGERPRINT'", + "expires": 424242424, + "created": 946728000}], + "content-type": "multipart/signed", + "content": [{"id": 2, + "content-type": "text/plain", + "content": "This is a test signed message.\n"}, + {"id": 3, + "content-length": 1930, + "content-transfer-encoding": "base64", + "content-type": "application/x-pkcs7-signature", + "filename": "smime.p7s"}]}]}, + []]]]' +test_expect_equal_json \ + "$output" \ + "$expected" + test_done diff --git a/test/test-lib.sh b/test/test-lib.sh index a5428bb..98a5f54 100644 --- a/test/test-lib.sh +++ b/test/test-lib.sh @@ -1303,3 +1303,4 @@ test_declare_external_prereq gpg test_declare_external_prereq python test_declare_external_prereq python2 test_declare_external_prereq openssl +test_declare_external_prereq gpgsm -- 2.1.4 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH 4/4] debian: Recommend gpgsm for S/MIME support 2015-01-17 10:51 ` SMIME patches v3, with some tests David Bremner ` (2 preceding siblings ...) 2015-01-17 10:51 ` [PATCH 3/4] test: add S/MIME signature verification test for notmuch CLI David Bremner @ 2015-01-17 10:51 ` David Bremner 2015-01-17 20:07 ` SMIME patches v3, with some tests Jameson Graef Rollins 4 siblings, 0 replies; 22+ messages in thread From: David Bremner @ 2015-01-17 10:51 UTC (permalink / raw) To: Jameson Graef Rollins, Notmuch Mail From: Jameson Graef Rollins <jrollins@finestructure.net> --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 4bc4cd9..05cd04f 100644 --- a/debian/control +++ b/debian/control @@ -31,7 +31,7 @@ Vcs-Browser: http://git.notmuchmail.org/git/notmuch Package: notmuch Architecture: any Depends: libnotmuch4 (= ${binary:Version}), ${shlibs:Depends}, ${misc:Depends} -Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt | alot, gnupg-agent +Recommends: notmuch-emacs | notmuch-vim | notmuch-mutt | alot, gnupg-agent, gpgsm Description: thread-based email index, search and tagging Notmuch is a system for indexing, searching, reading, and tagging large collections of email messages in maildir or mh format. It uses -- 2.1.4 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: SMIME patches v3, with some tests 2015-01-17 10:51 ` SMIME patches v3, with some tests David Bremner ` (3 preceding siblings ...) 2015-01-17 10:51 ` [PATCH 4/4] debian: Recommend gpgsm for S/MIME support David Bremner @ 2015-01-17 20:07 ` Jameson Graef Rollins 2015-01-17 21:38 ` [PATCH] test: initial tests for smime David Bremner 4 siblings, 1 reply; 22+ messages in thread From: Jameson Graef Rollins @ 2015-01-17 20:07 UTC (permalink / raw) To: David Bremner, Notmuch Mail [-- Attachment #1: Type: text/plain, Size: 4259 bytes --] On Sat, Jan 17 2015, David Bremner <david@tethera.net> wrote: > Generating the certs was very much trial and error. The net of > a thousand lies may have led me astray a bit in that it may be > possible to do this all with gpgsm and avoid the dependency on > openssl. On the other hand, some tests is better than no tests. Hey, David. Thanks so much for covering our butts and finally putting together these tests. They look good to me. Unfortunately, one of the tests is failing for me, but I'm completely perplexed as to why: T355-smime: Testing S/MIME signature verification and decryption PASS Generate CA Cert PASS Generate User Cert PASS emacs delivery of S/MIME signed message FAIL Signature verification (openssl) --- T355-smime.4.OUTPUT 2015-01-17 19:06:46.806054727 +0000 +++ T355-smime.4.EXPECTED 2015-01-17 19:06:46.806054727 +0000 @@ -1,4 +1,4 @@ Verification successful -Content-Type: text/plain - -This is a test signed message. +Content-Type: text/plain + +This is a test signed message. PASS signature verification (notmuch CLI) ?? There's visually no difference between the supposedly diff'd text. A hd of the output files being compared shows that openssl is using a carriage return '0d' followed by line feed '0a' for every newline, in place of a simple line feed '0a' in the original message file: servo:~/src/notmuch/git [master*] 0$ hd test/tmp.T355-smime/T355-smime.4.EXPECTED 00000000 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 |Content-Type: te| 00000010 78 74 2f 70 6c 61 69 6e 0a 0a 54 68 69 73 20 69 |xt/plain..This i| 00000020 73 20 61 20 74 65 73 74 20 73 69 67 6e 65 64 20 |s a test signed | 00000030 6d 65 73 73 61 67 65 2e 0a 56 65 72 69 66 69 63 |message..Verific| 00000040 61 74 69 6f 6e 20 73 75 63 63 65 73 73 66 75 6c |ation successful| 00000050 0a |.| 00000051 servo:~/src/notmuch/git [master*] 0$ hd test/tmp.T355-smime/T355-smime.4.OUTPUT 00000000 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 |Content-Type: te| 00000010 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 54 68 69 73 |xt/plain....This| 00000020 20 69 73 20 61 20 74 65 73 74 20 73 69 67 6e 65 | is a test signe| 00000030 64 20 6d 65 73 73 61 67 65 2e 0d 0a 56 65 72 69 |d message...Veri| 00000040 66 69 63 61 74 69 6f 6e 20 73 75 63 63 65 73 73 |fication success| 00000050 66 75 6c 0a |ful.| 00000054 servo:~/src/notmuch/git [master*] 0$ Bad openssl. (Daniel off stage screaming: "why aren't you using certtool!") I also noticed that the "Verification successful" string is not reliably being printed to stderr before the message output. Two possible patches to fix the problems are attached below. The second is maybe slightly preferred, since it eliminates any reliance on broken openssl message output whatsoever. Thanks again for working on this, David. jamie. diff --git a/test/T355-smime.sh b/test/T355-smime.sh index 0e5fd4a..5e3ec72 100755 --- a/test/T355-smime.sh +++ b/test/T355-smime.sh @@ -43,7 +43,9 @@ test_expect_success 'emacs delivery of S/MIME signed mes test_begin_subtest "Signature verification (openssl)" notmuch show --format=raw subject:"test signed message 001" |\ - openssl smime -verify -CAfile ca.crt >& OUTPUT + openssl smime -verify -CAfile ca.crt 2> OUTPUT +notmuch show --format=raw subject:"test signed message 001" |\ + openssl smime -verify -CAfile ca.crt | tr -d '\015' >> OUTPUT cat <<EOF > EXPECTED Verification successful Content-Type: text/plain diff --git a/test/T355-smime.sh b/test/T355-smime.sh index 0e5fd4a..cba23e0 100755 --- a/test/T355-smime.sh +++ b/test/T355-smime.sh @@ -43,12 +43,9 @@ test_expect_success 'emacs delivery of S/MIME signed me test_begin_subtest "Signature verification (openssl)" notmuch show --format=raw subject:"test signed message 001" |\ - openssl smime -verify -CAfile ca.crt >& OUTPUT + openssl smime -verify -CAfile ca.crt 2> OUTPUT cat <<EOF > EXPECTED Verification successful -Content-Type: text/plain - -This is a test signed message. EOF test_expect_equal_file OUTPUT EXPECTED [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 818 bytes --] ^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH] test: initial tests for smime 2015-01-17 20:07 ` SMIME patches v3, with some tests Jameson Graef Rollins @ 2015-01-17 21:38 ` David Bremner 2015-01-17 21:59 ` Jameson Graef Rollins 0 siblings, 1 reply; 22+ messages in thread From: David Bremner @ 2015-01-17 21:38 UTC (permalink / raw) To: Jameson Graef Rollins, David Bremner, Notmuch Mail Test the ability of notmuch-mua-mail to send smime signed messages; this really relies on existing functionality in message-mode. The dependency on openssl to generate keys seems acceptable since that's the method I got to work for smime signing in emacs. --- Hey Jamie; It was kindof my fault: my original script add embedded ^M's in it, but this "cleverness" was messed up somewhere in the patch process. Does this version work for you? test/T355-smime.sh | 42 ++++++++++++++++++++++++++++++++++++++++++ test/smime/openssl-ca-req.conf | 13 +++++++++++++ test/smime/openssl-req.conf | 13 +++++++++++++ test/test-lib.el | 10 ++++++++++ test/test-lib.sh | 1 + 5 files changed, 79 insertions(+) create mode 100755 test/T355-smime.sh create mode 100644 test/smime/openssl-ca-req.conf create mode 100644 test/smime/openssl-req.conf diff --git a/test/T355-smime.sh b/test/T355-smime.sh new file mode 100755 index 0000000..1789a8b --- /dev/null +++ b/test/T355-smime.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash + +test_description='S/MIME signature verification and decryption' +. ./test-lib.sh + +test_require_external_prereq openssl + +test_begin_subtest "Generate CA Cert" +openssl genpkey -algorithm RSA -out ca.key -pass pass:test -des3 1024 +openssl req -new -x509 -key ca.key -passin pass:test \ + -config $TEST_DIRECTORY/smime/openssl-ca-req.conf -out ca.crt +test_expect_equal "$(openssl verify ca.crt | tail -1)" "OK" + +test_begin_subtest "Generate User Cert" +openssl genpkey -algorithm RSA -out smime.key 1024 +openssl req -config $TEST_DIRECTORY/smime/openssl-req.conf \ + -new -key smime.key -passin pass:test -nodes \ + -out smime.csr +openssl x509 -req -in smime.csr -passin pass:test -CA ca.crt -CAkey ca.key -set_serial 1 -out test_suite.crt -setalias "Self Signed SMIME" -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout +# we need one file with the cert and private key +cat test_suite.crt smime.key > test_suite.pem +test_expect_equal "$(openssl verify -purpose smimesign -CAfile ca.crt test_suite.pem)" "test_suite.pem: OK" + +test_expect_success 'emacs delivery of S/MIME signed message' \ + 'emacs_fcc_message \ + "test signed message 001" \ + "This is a test signed message." \ + "(mml-secure-message-sign \"smime\")"' + +test_begin_subtest "Signature verification (openssl)" +notmuch show --format=raw subject:"test signed message 001" |\ + openssl smime -verify -CAfile ca.crt 1>STDOUT 2>STDERR +cat <<EOF > EXPECTED +Verification successful +Content-Type: text/plain + +This is a test signed message. +EOF +tr -d '\015' < STDOUT | cat STDERR - > OUTPUT +test_expect_equal_file OUTPUT EXPECTED + +test_done diff --git a/test/smime/openssl-ca-req.conf b/test/smime/openssl-ca-req.conf new file mode 100644 index 0000000..49572ee --- /dev/null +++ b/test/smime/openssl-ca-req.conf @@ -0,0 +1,13 @@ + [ req ] + distinguished_name = req_distinguished_name + prompt = no + + + [ req_distinguished_name ] + C = OZ + ST = Munchkinlandia + L = Emerald City + O = Organization Name + OU = Dept. of Fake Certs + CN = Fast Eddies Certs and Chips + emailAddress = fake-ca@example.com diff --git a/test/smime/openssl-req.conf b/test/smime/openssl-req.conf new file mode 100644 index 0000000..c6b9de7 --- /dev/null +++ b/test/smime/openssl-req.conf @@ -0,0 +1,13 @@ + [ req ] + distinguished_name = req_distinguished_name + prompt = no + + + [ req_distinguished_name ] + C = OZ + ST = Munchkinlandia + L = Emerald City + O = Not much organization + OU = Dept. of Testing + CN = Notmuch Test Suite + emailAddress = test_suite@notmuchmail.org diff --git a/test/test-lib.el b/test/test-lib.el index 04c8d63..596a705 100644 --- a/test/test-lib.el +++ b/test/test-lib.el @@ -188,3 +188,13 @@ nothing." ;; environments (setq mm-text-html-renderer 'html2text) + +;; Set some variables for S/MIME tests. + +(setq smime-keys '(("" "test_suite.pem" nil))) + +(setq mml-smime-use 'openssl) + +;; all test keys are without passphrase +(eval-after-load 'smime + '(defun smime-ask-passphrase (cache) nil)) diff --git a/test/test-lib.sh b/test/test-lib.sh index 6057238..00612d9 100644 --- a/test/test-lib.sh +++ b/test/test-lib.sh @@ -1304,3 +1304,4 @@ test_declare_external_prereq gdb test_declare_external_prereq gpg test_declare_external_prereq python test_declare_external_prereq python2 +test_declare_external_prereq openssl -- 2.1.4 ^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [PATCH] test: initial tests for smime 2015-01-17 21:38 ` [PATCH] test: initial tests for smime David Bremner @ 2015-01-17 21:59 ` Jameson Graef Rollins 2015-01-17 22:29 ` David Bremner 0 siblings, 1 reply; 22+ messages in thread From: Jameson Graef Rollins @ 2015-01-17 21:59 UTC (permalink / raw) To: David Bremner, David Bremner, Notmuch Mail [-- Attachment #1: Type: text/plain, Size: 643 bytes --] On Sat, Jan 17 2015, David Bremner <david@tethera.net> wrote: > It was kindof my fault: my original script add embedded ^M's in it, but > this "cleverness" was messed up somewhere in the patch process. > > Does this version work for you? For some reason PATCH 3/4 no longer applies after substituting in this patch as PATCH 1/4. But do we really need to test the message output of openssl? It seems like it's broken, and if it ever gets fixed we'll need to change this test. But all we really care about is that openssl is properly verifying the message, yes? Why not just test that and forget about the rest of openssl's output? jamie. [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 818 bytes --] ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH] test: initial tests for smime 2015-01-17 21:59 ` Jameson Graef Rollins @ 2015-01-17 22:29 ` David Bremner 2015-01-17 22:54 ` Jameson Graef Rollins 0 siblings, 1 reply; 22+ messages in thread From: David Bremner @ 2015-01-17 22:29 UTC (permalink / raw) To: Jameson Graef Rollins, Notmuch Mail Jameson Graef Rollins <jrollins@finestructure.net> writes: > For some reason PATCH 3/4 no longer applies after substituting in this > patch as PATCH 1/4. Ah, I guess I need to send the whole series again. > > But do we really need to test the message output of openssl? It seems > like it's broken, and if it ever gets fixed we'll need to change this > test. I think it's not so much broken as "canonical". There is some discussion in the openssl-smime man page that pointed me to RFC5751 para 3.1.1 MIME entities of major type "text" MUST have both their line endings and character set canonicalized. The line ending MUST be the pair of characters <CR><LF> > But all we really care about is that openssl is properly verifying the > message, yes? Why not just test that and forget about the rest of > openssl's output? Maybe it doesn't add too much as long as the message is using the "clear signed" multipart/signed format. On the other hand there is an opaque signed format (application/pkcs7-mime with Signeddata) too, where it would be interesting to check for mangling of the text. Similarly, when we add a similar test for encryption, I think we do want to check the content, so we'll have to figure this out at some point. Cheers, d ^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH] test: initial tests for smime 2015-01-17 22:29 ` David Bremner @ 2015-01-17 22:54 ` Jameson Graef Rollins 0 siblings, 0 replies; 22+ messages in thread From: Jameson Graef Rollins @ 2015-01-17 22:54 UTC (permalink / raw) To: David Bremner, Notmuch Mail [-- Attachment #1: Type: text/plain, Size: 1516 bytes --] On Sat, Jan 17 2015, David Bremner <david@tethera.net> wrote: >> But do we really need to test the message output of openssl? It seems >> like it's broken, and if it ever gets fixed we'll need to change this >> test. > > I think it's not so much broken as "canonical". There is some discussion > in the openssl-smime man page that pointed me to RFC5751 > para 3.1.1 > > MIME entities of major type "text" MUST have both their line endings > and character set canonicalized. The line ending MUST be the pair of > characters <CR><LF> Interesting, and oh well. Not going to fall down that rabbit hole! >> But all we really care about is that openssl is properly verifying the >> message, yes? Why not just test that and forget about the rest of >> openssl's output? > > Maybe it doesn't add too much as long as the message is using the "clear > signed" multipart/signed format. On the other hand there is an opaque > signed format (application/pkcs7-mime with Signeddata) too, where it > would be interesting to check for mangling of the text. Similarly, when > we add a similar test for encryption, I think we do want to check the > content, so we'll have to figure this out at some point. But at any point are we using the output of the message piped through openssl? Does gmime (possibly via gpgsm) actually pipe the message through openssl before further parsing it? If so, then I guess we do care about what openssl does to the original message. If not, then I'm still not sure we care. jamie. [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 818 bytes --] ^ permalink raw reply [flat|nested] 22+ messages in thread
end of thread, other threads:[~2015-01-17 22:55 UTC | newest] Thread overview: 22+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-06-29 18:38 S/MIME support Jameson Graef Rollins 2012-06-29 18:38 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins 2012-06-29 18:38 ` [PATCH 2/2] debian: Recommend gpgsm for S/MIME support Jameson Graef Rollins 2012-07-09 18:33 ` Bryant, Daniel B. 2012-07-10 7:40 ` Jameson Graef Rollins 2012-08-31 19:50 ` David Bremner 2014-03-17 4:52 ` S/MIME support, rebased Jameson Graef Rollins 2014-03-17 4:52 ` [PATCH 1/2] cli: S/MIME verification/decryption support Jameson Graef Rollins 2014-03-17 4:52 ` [PATCH 2/2] debian: Recommend gpgsm for S/MIME support Jameson Graef Rollins 2014-07-01 10:55 ` [PATCH 1/2] cli: S/MIME verification/decryption support David Bremner 2014-07-06 17:36 ` Jameson Graef Rollins 2014-07-06 18:18 ` David Bremner 2015-01-17 10:51 ` SMIME patches v3, with some tests David Bremner 2015-01-17 10:51 ` [PATCH 1/4] test: initial tests for smime David Bremner 2015-01-17 10:51 ` [PATCH 2/4] cli: S/MIME verification/decryption support David Bremner 2015-01-17 10:51 ` [PATCH 3/4] test: add S/MIME signature verification test for notmuch CLI David Bremner 2015-01-17 10:51 ` [PATCH 4/4] debian: Recommend gpgsm for S/MIME support David Bremner 2015-01-17 20:07 ` SMIME patches v3, with some tests Jameson Graef Rollins 2015-01-17 21:38 ` [PATCH] test: initial tests for smime David Bremner 2015-01-17 21:59 ` Jameson Graef Rollins 2015-01-17 22:29 ` David Bremner 2015-01-17 22:54 ` Jameson Graef Rollins
Code repositories for project(s) associated with this public inbox https://yhetil.org/notmuch.git/ This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).