Message-ID: <531F4FDD.6000506@fifthhorseman.net>
Date: Tue, 11 Mar 2014 14:03:09 -0400
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:24.0) Gecko/20100101 Icedove/24.2.0
MIME-Version: 1.0
To: Baptiste <bateast@bat.fr.eu.org>, notmuch@notmuchmail.org
Subject: Re: Smime signature verification in Notmuch - Emacs
References: <87y50r42do.fsf@bat.fr.eu.org>
In-Reply-To: <87y50r42do.fsf@bat.fr.eu.org>
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
	boundary="9GtqB0nCORLb3dPEnV7SGNs5BUj58uoxD"
Precedence: list

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--9GtqB0nCORLb3dPEnV7SGNs5BUj58uoxD
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Baptiste--

On 03/03/2014 12:29 PM, Baptiste wrote:
> I made a little |Emacs| advice for |notmuch-show-insert-part-multipart/=
signed|=20
> to deal with mails signed with /SMIME/ mechanism. It calls /openssl/ to=
 create=20
> missing :sigstatus.
>=20
> Here it is : https://github.com/bateast/notmuch-openssl
> (it is an org-file, in |Emacs|, use /org-babel-tangle/ on it to extract=
 the .el).
>=20
> You are welcomed to make any comment.

i'm interested in the functionality you're describing, but i confess i'm
confused by the syntax of your e-mail and the structure of the file in
question, as well as how you think it should be related to the notmuch
project.  This might all be obvious to other people; sorry for my confusi=
on!

Do you think this should be integrated into notmuch and shipped with it?
 if so, can you provide it as a standard patch for folks here to review?

Some questions worth documenting if possible:

 * do you expect this to work for S/MIME encrypted messages as well as
S/MIME signed messages?

 * is there a reason to do this only in emacs?  PGP/MIME-signed (and
-encrypted) messages can be parsed directly by libnotmuch so they are
useful in other contexts as well

 * what key management model does this code assume and/or enforce?  how
do we know which keys belong to which users?

Thanks for working on notmuch!

Regards,

	--dkg


--9GtqB0nCORLb3dPEnV7SGNs5BUj58uoxD
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Icedove - http://www.enigmail.net/

iQJ8BAEBCgBmBQJTH0/dXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFQjk2OTEyODdBN0FEREUzNzU3RDkxMUVB
NTI0MDFCMTFCRkRGQTVDAAoJEKUkAbEb/fpcGBAP/14WqoZtyOu4sAzge4hYZ5TZ
tWEDmujJsLn6JWQqekSxlRcs7oq1bBfpD/9wq1cHU7jgD3vKnHgJ+7eFsQOds5W7
yHtVh8lGBmdI3ip1eeo/YJy3ApNb5iJ98xbHFGEq5dRwfCk6DuHGj2GzFabY6+kv
Ow/LEMsjNJ2Yt7ZRPJuJcwpbPVzM1QcZUdcUZa/ROFZEu7XyxvzzGxPi41fvxQb+
Gn6gwuCzwSfulMBqtrNUSEHvOTAuQslHNiwpYL6l9F6RYNWliFwMJBtd2+fVb3/V
9NkgLD3kzEkKK3GyOfWWqF7OO4iBllu8u1m3gWk691tR/UQ2dV5OuAvxeDQ4LzvF
X47+McrSfZoRTkgJQdEIy6DDOpoES0hsEufa9Kh8E8S//Wfzg/FVJRDLwQP1JZLe
EaUNwl4rYd71Z8B/37au46QoxGpwjkJnQ0ygh/IAR7Ql13qfUTEpJ5BGVHwhdUWl
3LNFUkkQoSqw3D2UnxcbFvgCFt8OT8KqcnHA0g3FPO9XorjbSUILJpA92LdUxFhs
BdHmwtVoNu7DArtMPmy0WteWzLcz0rUg739KzryVeDeulHoxweQOFkDQvl/ZqMgL
yVhhjiVcQxtU0xPVlb5mEsybfrE2+osbLzDbISN4aObLHO8qNomOUyWYYSc5zLyV
hcWqFkIZ3+K57xp341cH
=cwod
-----END PGP SIGNATURE-----

--9GtqB0nCORLb3dPEnV7SGNs5BUj58uoxD--