Message-ID: <4CEC658D.6050101@fifthhorseman.net>
Date: Tue, 23 Nov 2010 20:08:29 -0500
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
	rv:1.9.2.12) Gecko/20101110 Icedove/3.1.6
MIME-Version: 1.0
To: notmuch <notmuch@notmuchmail.org>
Subject: Re: a proposed change to JSON output to report verification
	of	PGP/MIME signatures.
References: <4CDE4486.2050101@fifthhorseman.net>
	<87hbfhdpa6.fsf@yoom.home.cworth.org>	<4CE2E45C.7080206@fifthhorseman.net>
In-Reply-To: <4CE2E45C.7080206@fifthhorseman.net>
OpenPGP: id=D21739E9
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
	boundary="------------enigD00063A655409E945D172EF7"
Precedence: list
Reply-To: notmuch <notmuch@notmuchmail.org>

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigD00063A655409E945D172EF7
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 11/16/2010 03:06 PM, Daniel Kahn Gillmor wrote:
> On 11/16/2010 02:47 PM, Carl Worth wrote:
>> The current linearization of parts is a bug that should be fixed. And =
I
>> think several aspects of your proposal are effectively workarounds for=

>> this bug. So I'd rather we fix the json output to emit the tree
>> structure first, and then see what parts of the proposal can be
>> eliminated.
>>
>> [And I think David Edmondson's reply said the same as above, but with
>> more detail. Right?]
>=20
> ok, good to know.  that makes sense to me, and i'll plan my work around=

> the idea of future tree-structured output.  i didn't know whether the
> linearized output was considered a feature or not.  tree-structured
> output makes me happier.

After a bit of working on this today, i realized that implementing
signature verification on the current linearized MIME output involves a
lot of wasted data tracking. i found myself adding ways to pass around
extra metadata to each part, but that won't be necessary if we get
tree-based mime in JSON.

So instead of implementing signature verification, i've successfully
rebased David Edmondson's mp3 patchset to notmuch 0.5.

That branch is published with the name of mp3-on-0.5 at my notmuch git re=
po:

 git://lair.fifthhorseman.net/~dkg/notmuch

The current head is commit id de836c032c43d0b2bc06553433ed4271ab54f3f3

The rebase was relatively clean (only a few manual interventions
necessary), and the bulk of my work was normalizing the part ID numbers
between output formats and cleaning up the test suite.

I've got this version working now, and the emacs interface works fine
for me.

Unless i hear objections to it, i'll be basing my future signature
verification work off of this branch.

I plan to attach the previously-proposed sigstatus member of the json
output to the parent element instead of the child elements.

So a message structured like this:

 1 =E2=94=94=E2=94=AC=E2=95=B4multipart/signed 1909 bytes
 2  =E2=94=9C=E2=95=B4text/plain 53 bytes
 3  =E2=94=94=E2=95=B4application/pgp-signature attachment [signature.asc=
] 900 bytes

part 1's json object would have the new sigstatus member, and parts 2
and 3 would not have any change from the current json format.

It looks like this will dramatically simplify the signature verification.=


Feedback would be very much appreciated!

Regards,

	--dkg


--------------enigD00063A655409E945D172EF7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBCgAGBQJM7GWNAAoJEMzS7ZTSFznpq+AP/izOzD1JhZst+BKuxtfXXrFK
Oj5rhDB8JuElZiqQ5jfACITXGDVPgFO1VK3eNi7qvwrueiRqQkd6P+eSuqU7h4+/
tgYT52qYIL9AhXAnx/GKV1GO6hp3pMcHgEStv2cQ2FjrToMWPrT9leZv6c3JsmVi
o6PkAINFVl3VX1g//zLBpCfRT9Sr5Kn1eElEj6N48UProY4ErMGskq/OGE5jweSc
LEMR5ApzWfzvW9PJ1UDl4buscRLKtXIxgAm4BLkxB9uVWuzWRQ7vc86clBNISZ7J
su95O77uXm/LqjWDM1cDv8W444z7dl6giw+IV4XoJF/xZG2569lNU/QKs/ve/P40
SyR0z/Ay95HrQTyXaIY9ZrJ2Bnf2VOOJpZe9rONVFa8bwjSButHnR6GHnAHY7bSy
ORB9XMv3yLdYRr20zExyv19TLE3WMHD5u+zvSE+2yWWTWNFJVsBxAXhNLTgr4AfD
UWE1/Zi6XWFYg1a2/3SgBFzZZjUhuyVRgREs2wb1BUcQZ4yWJHKxyZhn4xYcD08r
wTtb76HvbwvWn2YP2gEjl0Es6tE2iLBhe4H0uqo0yfZrxJE9ftMtbR2RcRqPISnp
1LkVPJtrY9tcIpq3FQkY8xjNQiNhySPycT4oGzHwLVy5sa7P17rvuH4cr94IrlqU
QThjcfwBWXW+XHQFUyFF
=+a4a
-----END PGP SIGNATURE-----

--------------enigD00063A655409E945D172EF7--