From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by arlo.cworth.org (Postfix) with ESMTP id 9227F6DE0C19 for ; Thu, 7 Dec 2017 22:52:26 -0800 (PST) X-Virus-Scanned: Debian amavisd-new at cworth.org X-Spam-Flag: NO X-Spam-Score: -0.009 X-Spam-Level: X-Spam-Status: No, score=-0.009 tagged_above=-999 required=5 tests=[AWL=-0.009] autolearn=disabled Received: from arlo.cworth.org ([127.0.0.1]) by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4lui5iTMz4SP for ; Thu, 7 Dec 2017 22:52:25 -0800 (PST) Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by arlo.cworth.org (Postfix) with ESMTPS id B30536DE0B2F for ; Thu, 7 Dec 2017 22:52:25 -0800 (PST) Received: from fifthhorseman.net (ool-6c3a0662.static.optonline.net [108.58.6.98]) by che.mayfirst.org (Postfix) with ESMTPSA id 37EA2F99A for ; Fri, 8 Dec 2017 01:52:25 -0500 (EST) Received: by fifthhorseman.net (Postfix, from userid 1000) id 94284208C5; Fri, 8 Dec 2017 01:39:00 -0500 (EST) From: Daniel Kahn Gillmor To: Notmuch Mail Subject: Re: [PATCH] crypto: signature verification reports valid User IDs In-Reply-To: <20171130042035.9502-1-dkg@fifthhorseman.net> References: <20171130042035.9502-1-dkg@fifthhorseman.net> Date: Fri, 08 Dec 2017 01:38:57 -0500 Message-ID: <87r2s52072.fsf@fifthhorseman.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-BeenThere: notmuch@notmuchmail.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Dec 2017 06:52:26 -0000 --=-=-= Content-Type: text/plain On Wed 2017-11-29 23:20:35 -0500, Daniel Kahn Gillmor wrote: > When i'm trying to understand a message signature, i care that i know > who it came from (the "validity" of the identity associated with the > key), *not* whether i'm willing to accept the keyholder's other > identity assertions (the "trust" associated with the certificate). > > We've been reporting User ID information based on the "trust" > associated with the certificate, because GMime didn't clearly expose > the validity of the User IDs. > > This change relies on fixes made in GMime 3.0.3 and later which > include https://github.com/jstedfast/gmime/pull/18. Without this patch, the notmuch test suite currently fails when built against gmime 3 on debian testing, because gmime 3 on debian testing now correctly returns key IDs for _get_key_id(). This patch corrects the misbehavior of previous versions of notmuch, and restores the ability to display correct validity of the keys in question. I welcome review for it! --dkg --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEOCdgUepHf6PklTkyFJitxsGSMjcFAloqM4EACgkQFJitxsGS Mje+WBAAsNAzXuWuMD+LT+6FPJK/jw+97+Wuxe3Z59THTweU/VwdozQpXC6emAGw Gchdb29pgyyTLd1McSeo2SAFNX6MJV5860fJ2U32goekc6u2rYtCuAXspxY7zlrr xEUNHPCrywA0O93DxthTP5QAZ/UA1DiJja4/NZMSDZSWB/YInR7SBQ3/Bwmpwl9u gi6QeTJRLC3U6TbfIOihGawzhG+5SqeCHdHBfJmQl3dNsH3H9OeR5gEvqKUucX8Y dZqBda1rplwAKE1F04cj+KDb8kTvwy+cidVJIpxIzQtLVPu8M0WWHvAB7dXcV3zj GrFfmKPJGFuSF/ZxpU+xx2roYhxx6iZBKbDFoxX/asoMphKCDJx/UzGgfSTskRyC lWy000xp+zLrbI1W7+0kgTOSw1EUb3mNa55l574HZ9uBKvhA9AZzNXwlHjjPb4EB SFDIhgDB2CLz4oPa6Copmg4C9Ho9lWgaPKLKn/LwjuzFgAq80zCjbYqHO68vElSP K9hgzeeLx3cdSQbcYkqu47j9mk2BVTrFaUyE0USYZVXzo2q5j7YjOhuWN7anqYG/ BOUI7qNAQNVj650ripecKmHKWx5wLddYQ6mPl5qk8dqGS0ssZnIR2gSJzownXKDz pusr0H4c9OCc7e2TkKzB/c1dIXrrjSwsU05ym0a3n8nnIfIkijo= =no2F -----END PGP SIGNATURE----- --=-=-=--