From: "Bryant, Daniel B." <Dan.Bryant@jhuapl.edu>
To: 'Jameson Graef Rollins' <jrollins@finestructure.net>, Notmuch Mail
	<notmuch@notmuchmail.org>
Date: Mon, 9 Jul 2012 14:33:17 -0400
Subject: RE: S/MIME support
Thread-Topic: S/MIME support
Thread-Index: Ac1WJpG3cF0T/3SwRbaWe/RvL0uQfAH1xQaQ
Message-ID:
 <24CAA033F4DBCD4DB53CBFB11AEF037C1044F0566F@aplesrepublic.dom1.jhuapl.edu>
References: <1340995101-9616-1-git-send-email-jrollins@finestructure.net>
In-Reply-To: <1340995101-9616-1-git-send-email-jrollins@finestructure.net>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Precedence: list

Jamie,

I was able to get signature verification working with your patchset (with a=
 caveat) but not decryption.

Signature Verification
----------------------

The caveat is that GMime is still borked with handling signatures with cont=
ent type application/x-pkcs7-signature (vs. application/pkcs7-signature, wh=
ich works fine). This is upstream GNOME bug #674032 that was supposed to ha=
ve been fixed in GMime 2.6.9, but that original fix is also broken.

One possible workaround is to twiddle the content-type of the signature par=
t (and the corresponding protocol in the multipart/signed part). I implemen=
ted this by looping over each message part in mime_node_open() and modifyin=
g as necessary using the following logic:


    GMimeContentType *content_type =3D g_mime_object_get_content_type (part=
);

    const char *subtype =3D g_mime_content_type_get_media_subtype (content_=
type);
    const char *protocol =3D g_mime_content_type_get_parameter (content_typ=
e, "protocol");

    if (!strcmp(subtype, "x-pkcs7-signature")) {
        g_mime_content_type_set_media_subtype (content_type, "pkcs7-signatu=
re");
    }

    if (protocol && !strcmp(protocol, "application/x-pkcs7-signature")) {
        g_mime_content_type_set_parameter (content_type, "protocol","applic=
ation/pkcs7-signature");
    }   =20


Decryption
----------

All of my S/MIME encrypted mail consists of single part messages with conte=
nt-type "application/x-pkcs7-mime". These conform to RFC3851, section 3.3/3=
.4. (sample messages are included in the RFC as well). This fails to be dec=
rypted by notmuch because the mime node traversal code assumes that every e=
ncrypted message is multipart/encrypted, which appears to only be true for =
PGP/MIME.


Dan



-----Original Message-----
From: notmuch-bounces@notmuchmail.org [mailto:notmuch-bounces@notmuchmail.o=
rg] On Behalf Of Jameson Graef Rollins
Sent: Friday, June 29, 2012 2:38 PM
To: Notmuch Mail
Subject: S/MIME support

Hey, folks.  This patch adds S/MIME support to notmuch-show.  It's
pretty simple, now that the crypto rework [0] is complete.

I was going to wait to submit this patch until we had a test suite
(ehem, dkg!), but seeing as there has been some other interest
expressed in seeing this feature I'm going to go ahead and send it to
the list in the hopes that it might spur development of the needed
tests.

jamie.

[0] id:"1338057946-29209-2-git-send-email-jrollins@finestructure.net"

_______________________________________________
notmuch mailing list
notmuch@notmuchmail.org
http://notmuchmail.org/mailman/listinfo/notmuch