unofficial mirror of notmuch@notmuchmail.org
 help / color / mirror / code / Atom feed
* notmuch-show: Verification via epa-verify-region affected by formatting hooks
@ 2019-04-04 15:19 Rainer Gemulla
  2019-04-05 15:11 ` David Bremner
  0 siblings, 1 reply; 3+ messages in thread
From: Rainer Gemulla @ 2019-04-04 15:19 UTC (permalink / raw)
  To: notmuch

[-- Attachment #1: Type: text/plain, Size: 964 bytes --]

Hi all,

when a message contains an text/plain part that is signed via inline pgp and shown in notmuch-show-mode, verification of that part's signature via epa-mail-verify or epa-verify-region fails. 

The reason is that the hooks in notmuch-show-insert-text/plain-hook modify the text (and thus the signature becomes invalid). Calling notmuch-show-pipe-part with "gpg --verify" works as expected and verifies the correctness of the signature.

Not sure what to do about this, but I find the current behavior confusing. The notmuch emacstips documentation also (implicitly) states that verification of inline pgp can be done via the epa-* functions. 

One option may be to document this behavior. Another one to add a function like notmuch-crypto-verify-part (which is what I currently do). And/or one may be verify each inline pgp signature part by default (when crypto processing is enabled) and add a "crypto button".

Best & thanks,
Rainer Gemulla

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: notmuch-show: Verification via epa-verify-region affected by formatting hooks
  2019-04-04 15:19 notmuch-show: Verification via epa-verify-region affected by formatting hooks Rainer Gemulla
@ 2019-04-05 15:11 ` David Bremner
  2019-04-09 17:50   ` Rainer Gemulla
  0 siblings, 1 reply; 3+ messages in thread
From: David Bremner @ 2019-04-05 15:11 UTC (permalink / raw)
  To: Rainer Gemulla, notmuch; +Cc: Daniel Kahn Gillmor

Rainer Gemulla <rgemulla@gmx.de> writes:

> Hi all,
>
> when a message contains an text/plain part that is signed via inline pgp and shown in notmuch-show-mode, verification of that part's signature via epa-mail-verify or epa-verify-region fails. 
>
> The reason is that the hooks in notmuch-show-insert-text/plain-hook modify the text (and thus the signature becomes invalid). Calling notmuch-show-pipe-part with "gpg --verify" works as expected and verifies the correctness of the signature.
>
> Not sure what to do about this, but I find the current behavior confusing. The notmuch emacstips documentation also (implicitly) states that verification of inline pgp can be done via the epa-* functions. 
>

That documentation is wiki. That means both that you should take it with
a grain of salt, and that we welcome updates to it

  https://notmuchmail.org/wikiwriteaccess/
  
> One option may be to document this behavior. Another one to add a
> function like notmuch-crypto-verify-part (which is what I currently
> do).

I suppose that you could also customize notmuch-show-insert-text/plain-hook

> And/or one may be verify each inline pgp signature part by
> default (when crypto processing is enabled) and add a "crypto button".

As far as documentation in the wiki there is a FAQ about (non) support
for inline PGP. I think dkg (in copy) was working on decryption of
inline PGP, but explicitely not on verifying signatures. You can read a
summary of his issues with inline PGP signatures at

        https://dkg.fifthhorseman.net/notes/inline-pgp-harmful/

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: notmuch-show: Verification via epa-verify-region affected by formatting hooks
  2019-04-05 15:11 ` David Bremner
@ 2019-04-09 17:50   ` Rainer Gemulla
  0 siblings, 0 replies; 3+ messages in thread
From: Rainer Gemulla @ 2019-04-09 17:50 UTC (permalink / raw)
  To: David Bremner, notmuch; +Cc: Daniel Kahn Gillmor

[-- Attachment #1: Type: text/plain, Size: 1795 bytes --]

Thanks David! I updated the Wiki accordingly. This issue can be closed from my point of view.

Best,
Rainer

David Bremner <david@tethera.net> writes:

> Rainer Gemulla <rgemulla@gmx.de> writes:
>
>> Hi all,
>>
>> when a message contains an text/plain part that is signed via inline pgp and shown in notmuch-show-mode, verification of that part's signature via epa-mail-verify or epa-verify-region fails. 
>>
>> The reason is that the hooks in notmuch-show-insert-text/plain-hook modify the text (and thus the signature becomes invalid). Calling notmuch-show-pipe-part with "gpg --verify" works as expected and verifies the correctness of the signature.
>>
>> Not sure what to do about this, but I find the current behavior confusing. The notmuch emacstips documentation also (implicitly) states that verification of inline pgp can be done via the epa-* functions. 
>>
>
> That documentation is wiki. That means both that you should take it with
> a grain of salt, and that we welcome updates to it
>
>   https://notmuchmail.org/wikiwriteaccess/
>   
>> One option may be to document this behavior. Another one to add a
>> function like notmuch-crypto-verify-part (which is what I currently
>> do).
>
> I suppose that you could also customize notmuch-show-insert-text/plain-hook
>
>> And/or one may be verify each inline pgp signature part by
>> default (when crypto processing is enabled) and add a "crypto button".
>
> As far as documentation in the wiki there is a FAQ about (non) support
> for inline PGP. I think dkg (in copy) was working on decryption of
> inline PGP, but explicitely not on verifying signatures. You can read a
> summary of his issues with inline PGP signatures at
>
>         https://dkg.fifthhorseman.net/notes/inline-pgp-harmful/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2019-04-09 17:50 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-04-04 15:19 notmuch-show: Verification via epa-verify-region affected by formatting hooks Rainer Gemulla
2019-04-05 15:11 ` David Bremner
2019-04-09 17:50   ` Rainer Gemulla

Code repositories for project(s) associated with this public inbox

	https://yhetil.org/notmuch.git/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).