From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by arlo.cworth.org (Postfix) with ESMTP id 87DFD6DE0F76 for ; Fri, 5 Apr 2019 08:11:29 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at cworth.org X-Spam-Flag: NO X-Spam-Score: -0.023 X-Spam-Level: X-Spam-Status: No, score=-0.023 tagged_above=-999 required=5 tests=[AWL=-0.022, SPF_PASS=-0.001] autolearn=disabled Received: from arlo.cworth.org ([127.0.0.1]) by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l_efcaZ9ZLAv for ; Fri, 5 Apr 2019 08:11:28 -0700 (PDT) Received: from fethera.tethera.net (fethera.tethera.net [198.245.60.197]) by arlo.cworth.org (Postfix) with ESMTPS id 6D9D26DE0C5F for ; Fri, 5 Apr 2019 08:11:28 -0700 (PDT) Received: from remotemail by fethera.tethera.net with local (Exim 4.89) (envelope-from ) id 1hCQV2-0006ss-Ml; Fri, 05 Apr 2019 11:11:24 -0400 Received: (nullmailer pid 20550 invoked by uid 1000); Fri, 05 Apr 2019 15:11:22 -0000 From: David Bremner To: Rainer Gemulla , notmuch@notmuchmail.org Cc: Daniel Kahn Gillmor Subject: Re: notmuch-show: Verification via epa-verify-region affected by formatting hooks In-Reply-To: <87h8bd23yd.fsf@gemma> References: <87h8bd23yd.fsf@gemma> X-List-To: notmuch Date: Fri, 05 Apr 2019 12:11:22 -0300 Message-ID: <87imvscwrp.fsf@tethera.net> MIME-Version: 1.0 Content-Type: text/plain X-BeenThere: notmuch@notmuchmail.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Apr 2019 15:11:29 -0000 Rainer Gemulla writes: > Hi all, > > when a message contains an text/plain part that is signed via inline pgp and shown in notmuch-show-mode, verification of that part's signature via epa-mail-verify or epa-verify-region fails. > > The reason is that the hooks in notmuch-show-insert-text/plain-hook modify the text (and thus the signature becomes invalid). Calling notmuch-show-pipe-part with "gpg --verify" works as expected and verifies the correctness of the signature. > > Not sure what to do about this, but I find the current behavior confusing. The notmuch emacstips documentation also (implicitly) states that verification of inline pgp can be done via the epa-* functions. > That documentation is wiki. That means both that you should take it with a grain of salt, and that we welcome updates to it https://notmuchmail.org/wikiwriteaccess/ > One option may be to document this behavior. Another one to add a > function like notmuch-crypto-verify-part (which is what I currently > do). I suppose that you could also customize notmuch-show-insert-text/plain-hook > And/or one may be verify each inline pgp signature part by > default (when crypto processing is enabled) and add a "crypto button". As far as documentation in the wiki there is a FAQ about (non) support for inline PGP. I think dkg (in copy) was working on decryption of inline PGP, but explicitely not on verifying signatures. You can read a summary of his issues with inline PGP signatures at https://dkg.fifthhorseman.net/notes/inline-pgp-harmful/