From: Jameson Rollins <jrollins@finestructure.net>
To: Carl Worth <cworth@cworth.org>,
	Daniel Kahn Gillmor <dkg@fifthhorseman.net>,
	notmuch <notmuch@notmuchmail.org>
Subject: Re: a proposed change to JSON output to report verification of
	PGP/MIME signatures.
In-Reply-To: <87hbfhdpa6.fsf@yoom.home.cworth.org>
References: <4CDE4486.2050101@fifthhorseman.net>
	<87hbfhdpa6.fsf@yoom.home.cworth.org>
User-Agent: Notmuch/0.5 (http://notmuchmail.org) Emacs/23.2.1
	(i486-pc-linux-gnu)
Date: Tue, 16 Nov 2010 15:10:59 -0500
Message-ID: <87wrod9gh8.fsf@servo.finestructure.net>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha256; protocol="application/pgp-signature"
Precedence: list

--=-=-=
Content-Transfer-Encoding: quoted-printable

On Tue, 16 Nov 2010 11:47:13 -0800, Carl Worth <cworth@cworth.org> wrote:
> The only other piece I think I'd like to see is actually making the
> content of the signature pieces available in the json output. Then, a
> client could do its own verification.
>=20
> Then if we had that would we not want to add the --verify support into
> notmuch? (My guess is that we still would want it.)

Hey, Carl.  I think your suggestion to include the signatures in the
output is a reasonable.  However, (I could be misunderstanding your
suggestion but) I really think the Right thing is for notmuch to do the
verification itself.  I would almost say that --verify should be the
default, with a --no-verify option.  It will make things much easier for
all the UIs if notmuch handles the verification and just outputs the
result.

jamie.

--=-=-=
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAEBCAAGBQJM4uVTAAoJEO00zqvie6q8lhwQAJb7hMz+trFFiAoyoCdNfna4
/QN36aEcr7O+fKAhwLtqVGvJI3ljA0lD3h7BarC4FGaZx0ZR8f1LDE8uDTRT/DOt
5t2zfPWEXlPgkKZngyl+7h/uZ2GHUuP1B93BWi+yiK4rlKvrkjYyBiySAYEVR3n9
sfT/7oBjFH8OATFzHPaQzNM53R5YWvCxzGFZjZFa3gA8eHUN76MXQIlDZ9qgIfhj
dIQ9RkfBm5l+szVKELrwFKD1bgd6OacFXVRmn2dpANE05fuztctm5rUizS3zw/mk
zxhctrfJ1Zv5B5BKBhgqrMsYm9PsgJsfkXQH/+SkQZyjY0xfLkiP2ikMlebyTrEA
F3boq7PkDbA2PAuD5RhwfZgBwFEgYaz98FeBAWTFVxvd9wpWdAat/Yd4JTAHGbT8
ot3akMSERtiKFK852QfLSt1fU53CIHXgVNdecYxDnZBl+X4pTIkzwkdVUZR9/xVj
LdJgM6M0otpGMSjfSIgAd5/zCwNvEu0+0rzY54sTD7daViTMU/7WnpTluRXixdDA
zVk8pfaRu9mLdloHI1Y0EhxOS4TbZ7CVVgnG3crUcuf4JFVlPOa19IRZdbNEXlE9
rWAzzF1kv/pXKtc90+tNcBcv5xZAGLL5vwPWHlvrKwiXpYtv5QhF6/cvmo2FmBPu
oFOfHEkm6l/5K7VllJrB
=iR0i
-----END PGP SIGNATURE-----
--=-=-=--