PGP verification fails consistently for specific sender

PGP verification fails consistently for specific sender

[Sascha Silbe]

[-- Attachment #1.1: Type: text/plain, Size: 749 bytes --]

Hello,

signed PGP/MIME mails from a specific sender (using a ticket system
identifying as "X-Mailer: OTOBO Mail Service (10.1.7)") consistently
fail to verify with notmuch ("[ Bad signature (claimed key ID 0x...)
]"). However the same mail verifies fine in mutt (version 2.0.5) so I
expect it to be a bug on my side (i.e. in notmuch) rather than the
sender side.

Is anyone interested in debugging this failure? I can provide a copy of
a failing mail off-list but don't have time myself to dive into the gory
details of PGP/MIME verification right now.

Tried notmuch 0.31.4 (Debian bullseye) and 0.37 (bullseye-backports);
both fail the same way. The commits in git master since 0.37 don't look
related to PGP/MIME signature verification.

Sascha

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: PGP verification fails consistently for specific sender

[David Bremner]

Sascha Silbe <sascha-ml-reply-to-2023-3@silbe.org> writes:


> Is anyone interested in debugging this failure? I can provide a copy of
> a failing mail off-list but don't have time myself to dive into the gory
> details of PGP/MIME verification right now.
>

Not sure I have much time to devote to it myself, but if you send me one
of the messages I can see if I can pin down the bug.

d

Re: PGP verification fails consistently for specific sender

[David Bremner]

David Bremner <david@tethera.net> writes:

> Sascha Silbe <sascha-ml-reply-to-2023-3@silbe.org> writes:
>
>
>> Is anyone interested in debugging this failure? I can provide a copy of
>> a failing mail off-list but don't have time myself to dive into the gory
>> details of PGP/MIME verification right now.
>>
>
> Not sure I have much time to devote to it myself, but if you send me one
> of the messages I can see if I can pin down the bug.
>
> d

I got as far as verifying that the problem occurs to me too, and seems
to happen inside libgmime. I didn't yet figure out how to construct a
test case for libgmime, but before I go further I'll need test data I
can share.

d

Re: PGP verification fails consistently for specific sender

[Sascha Silbe]

[-- Attachment #1.1: Type: text/plain, Size: 1285 bytes --]

Hello David,

David Bremner <david@tethera.net> writes:

>>> Is anyone interested in debugging this failure? I can provide a copy of
>>> a failing mail off-list but don't have time myself to dive into the gory
>>> details of PGP/MIME verification right now.
[...]
> I got as far as verifying that the problem occurs to me too, and seems
> to happen inside libgmime. I didn't yet figure out how to construct a
> test case for libgmime, but before I go further I'll need test data I
> can share.

Thanks again for looking into it! The sending software seems to be
open-source [1]; I've asked on GitHub for a sample that can be shared
[2]. 🤞

My original hope was that once you figure out the reason you could
create a synthetic example. Unfortunately I don't have control over the
sender side myself, I can only ask them to send me an email over this
system. And because it's a (hosted) production instance it will always
include personal data (of the sender) that shouldn't be published. :-/

It's fine to share with individual developers of other projects like
libgmime, though, as long as it doesn't end up anywhere public (e.g. git
repo, public bug tracker).

Sascha

[1] https://otobo.de/en/
[2] https://github.com/RotherOSS/otobo/discussions/2400

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]