Re: Broken display of clearsigned PGP message

[Andreas Seltenreich <andreas+ding@gate450.dyndns.org>]

I wrote:

[...]
> message being displayed incorrectly (<URL:news:874putv834.fsf@sopos.org>).
[...]
> I'm not sure if this message is legal according to RFC 2440.  In 6.2
> it states that Armor Headers are followed by a blank line, which is
> defined as "zero-length, or containing only whitespace", however in
> 7. it uses the term "empty line" when describing Armor Headers in
> cleartext signatures.
>
> IMHO we should follow "be liberal in what you accept" here, especially
> since GnuPG considers the message legal.  Should I apply the attached
> patch to v5-10 and HEAD?  Can anyone imagine regressions?

I just realized that with the current behavior, an attacker could
completely replace the text within Gnus' signed-message markup with
his own message without interfering with the verification process.  So
I guess it is hard to make the situation worse...  Will commit the
patch.

regards,
andreas