GPG signature verification

GPG signature verification

[Roland Mas]

Hi there,

If memory serves, once upon a time, the [[PGP signed part:OK]] (or
FAILED) was buttonized and that details were shown on click.

  It seems that this is not the case anymore (up-to-date Oort Gnus
from Manoj's Debian packages).  I respectfully deplore that situation,
on the following grounds:

- the information displayed in the info zone is ephemeral at best:
  when I'd like to check it out later, I either have to `g' the
  message again or read the *Messages* buffer;

- the information sometimes just doesn't fit: people with long user
  id's cause the displayed info to go past the end of the zone, so
  that I can't read the end of it; displaying the message under the
  button would allow wrapping;

- some email/news messages contain several signed parts, and there's
  no simple way to get the verification info on the first signature
  checked (well, there is the *Messages* buffer, but...);

  Is there a rationale for removing the previous behaviour?  Is it
some configuration option I overlooked?

Roland.
-- 
Roland Mas

A man walks into a bar.  Bang.

Re: GPG signature verification

[Simon Josefsson]

Roland Mas <mas@echo.fr> writes:

> If memory serves, once upon a time, the [[PGP signed part:OK]] (or
> FAILED) was buttonized and that details were shown on click.

It still does for me.

>   It seems that this is not the case anymore (up-to-date Oort Gnus
> from Manoj's Debian packages).  I respectfully deplore that situation,
> on the following grounds:

I agree.

Are you using mailcrypt or gpg.el?  Which OpenPGP implementation?  Do
you have any non-important example mail you could forward (to me)?

Re: GPG signature verification

[Roland Mas]

Simon Josefsson (2001-05-24 18:10:46 +0200) :

> Roland Mas <mas@echo.fr> writes:
> 
> > If memory serves, once upon a time, the [[PGP signed part:OK]] (or
> > FAILED) was buttonized and that details were shown on click.
> 
> It still does for me.

Yeah, I still have the buttons, but clicking on it shows "No details."
in the info zone (forgot its official name, sorry).

> >   It seems that this is not the case anymore (up-to-date Oort Gnus
> > from Manoj's Debian packages).  I respectfully deplore that situation,
> > on the following grounds:
> 
> I agree.
> 
> Are you using mailcrypt or gpg.el?  Which OpenPGP implementation?
> Do you have any non-important example mail you could forward (to
> me)?

  I'm using Mailcrypt with GnuPG 1.0.5, both from Debian.  I'll
forward a sample mail shortly to ding@gnus.org.

Roland.
-- 
Roland Mas

Qui trop embrasse rate son train.

Sample multi-signature email [jeff covey <jeff.covey@pobox.com>] keymaps missing from console-common

[Roland Mas]

[-- Attachment #1: Type: text/plain, Size: 211 bytes --]

Here comes one mail I got from a mailing-list.  It contains a
forwarded message, which in turn contains another one.  All three are
signed.  I see three buttons, but none of them show any details when
clicked.


[-- Attachment #2: Type: message/rfc822, Size: 7331 bytes --]

[-- Attachment #2.1.1.1: Type: text/plain, Size: 605 bytes --]

since i never got a reply from yann, i wrote to owner@bugs, who asked
me to write to you.  keyboard support has been broken in testing for
at least 5 weeks.  i hope someone can do something about it soon.

-- 
|----------------------------------------------------------------------------|
| jeff covey jeff.covey@pobox.com http://pobox.com/~jeff.covey/ 410-669-4926 |
|----------------------------------------------------------------------------|
|               phil: high priest and holy keeper of the metrics.            |
|----------------------------------------------------------------------------|

[-- Attachment #2.1.1.2: Type: message/rfc822, Size: 3323 bytes --]

[-- Attachment #2.1.1.2.1.1.1: Type: text/plain, Size: 930 bytes --]

i haven't had a response from yann.  could you do anything about this?
i'm amazed this is still unresolved, considering how serious it is.  
i was luckily able to log in from another machine after the upgrade
hosed my keyboard map.  other people were probably not as lucky.  even
now, i have to do this whenever i want to do anything with apt or dpkg
and have a usable keyboard afterwards:

apt-get --yes -f install ; [do something] ;
	dpkg -i --force-conflicts ~/console-data_1999.08.29-11.2.deb

, which is ridiculous.

thanks,

-- 
|----------------------------------------------------------------------------|
| jeff covey jeff.covey@pobox.com http://pobox.com/~jeff.covey/ 410-669-4926 |
|----------------------------------------------------------------------------|
|                    all composite things are impermanent.                   |
|----------------------------------------------------------------------------|

[-- Attachment #2.1.1.2.1.1.2: Type: message/rfc822, Size: 1469 bytes --]

[-- Attachment #2.1.1.2.1.1.2.1.1: Type: text/plain, Size: 705 bytes --]

could you please let me know when you think you'll be able to deal
with this issue?:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=94268&repeatmerged=yes

it's listed as a "normal bug", but i consider the fact that the
keyboard no longer works on my workstation to be of rather high
urgency.

thanks,

-- 
|----------------------------------------------------------------------------|
| jeff covey jeff.covey@pobox.com http://pobox.com/~jeff.covey/ 410-669-4926 |
|----------------------------------------------------------------------------|
|                      i have a wide variety of superpowers.                 |
|----------------------------------------------------------------------------|

[-- Attachment #2.1.1.2.1.1.2.1.2: Type: application/pgp-signature, Size: 232 bytes --]

[-- Attachment #2.1.1.2.1.2: Type: application/pgp-signature, Size: 232 bytes --]

[-- Attachment #2.1.2: Type: application/pgp-signature, Size: 232 bytes --]

[-- Attachment #3: Type: text/plain, Size: 65 bytes --]



-- 
Roland Mas

C'est un type qui rentre dans un café.  Plouf.

Re: Sample multi-signature email [jeff covey <jeff.covey@pobox.com>] keymaps missing from console-common

[Roland Mas]

Roland Mas (2001-05-24 19:06:30 +0200) :

> Here comes one mail I got from a mailing-list.  It contains a
> forwarded message, which in turn contains another one.  All three
> are signed.  I see three buttons, but none of them show any details
> when clicked.

And I just saw that forwarding emails seems to break the signatures in
them.  Dunno why.

Roland.
-- 
Roland Mas

Qu'est-ce qui est jaune, qui pèse deux cents kilos et qui chante ?
Un sumotori qui a bu trop de saké.

Re: Sample multi-signature email [jeff covey <jeff.covey@pobox.com>] keymaps missing from console-common

[Simon Josefsson]

Roland Mas <lolando@debian.org> writes:

> Here comes one mail I got from a mailing-list.  It contains a
> forwarded message, which in turn contains another one.  All three are
> signed.  I see three buttons, but none of them show any details when
> clicked.

Switch to gpg.el or try attached patch.  It relies on mailcrypt/gpg
internals to work so is less than perfect.  (Maybe we could send a
patch to mailcrypt people to clean up the hardcoded buffer names..)

--- mml2015.el.~6.30.~	Sat Mar 24 11:58:22 2001
+++ mml2015.el	Thu May 24 19:49:08 2001
@@ -175,6 +175,7 @@
 	      (replace-match "-----BEGIN PGP SIGNATURE-----" t t))
 	  (if (re-search-forward "^-----END PGP [^-]+-----\r?$" nil t)
 	      (replace-match "-----END PGP SIGNATURE-----" t t)))
+	(let ((mc-gpg-debug-buffer (get-buffer-create " *gnus gpg debug*")))
 	(unless (condition-case err
 		    (funcall mml2015-verify-function)
 		  (error
@@ -185,9 +186,22 @@
 		   (mm-set-handle-multipart-parameter
 		    mm-security-handle 'gnus-details "Quit.")
 		   nil))
+	    (if (get-buffer " *mailcrypt stderr temp")
+		(mm-set-handle-multipart-parameter
+		 mm-security-handle 'gnus-details
+		 (with-current-buffer " *mailcrypt stderr temp"
+		   (buffer-string))))
 	  (mm-set-handle-multipart-parameter
 	   mm-security-handle 'gnus-info "Failed")
-	  (throw 'error handle)))
+	    (if (get-buffer " *mailcrypt stdout temp")
+		(kill-buffer " *mailcrypt stdout temp"))
+	    (if (get-buffer " *mailcrypt stderr temp")
+		(kill-buffer " *mailcrypt stderr temp"))
+	    (if (get-buffer " *mailcrypt status temp")
+		(kill-buffer " *mailcrypt status temp"))
+	    (if (get-buffer mc-gpg-debug-buffer)
+		(kill-buffer mc-gpg-debug-buffer))
+	    (throw 'error handle))))
       (mm-set-handle-multipart-parameter
        mm-security-handle 'gnus-info "OK")
       handle)))

Re: Sample multi-signature email [jeff covey <jeff.covey@pobox.com>] keymaps missing from console-common

[Simon Josefsson]

Roland Mas <mas@echo.fr> writes:

>> Here comes one mail I got from a mailing-list.  It contains a
>> forwarded message, which in turn contains another one.  All three
>> are signed.  I see three buttons, but none of them show any details
>> when clicked.
> 
> And I just saw that forwarding emails seems to break the signatures in
> them.  Dunno why.

Signatures are calculated on MIME headers as well the content -- this
makes it difficult to use a signed MIME blob out of context while
preserving the validity of the signature.  I think this was bad
design, but it's too late to fix now.

But wait, you wanted details when the signature was good?  Ah, my
previous patch only fixed details upon failures.  Try the following,
it should provide details both on success and failures.

--- mml2015.el.~6.30.~	Sat Mar 24 11:58:22 2001
+++ mml2015.el	Thu May 24 20:07:07 2001
@@ -175,8 +175,23 @@
 	      (replace-match "-----BEGIN PGP SIGNATURE-----" t t))
 	  (if (re-search-forward "^-----END PGP [^-]+-----\r?$" nil t)
 	      (replace-match "-----END PGP SIGNATURE-----" t t)))
+	(let ((mc-gpg-debug-buffer (get-buffer-create " *gnus gpg debug*")))
 	(unless (condition-case err
+		      (prog1
 		    (funcall mml2015-verify-function)
+			(if (get-buffer " *mailcrypt stderr temp")
+			    (mm-set-handle-multipart-parameter
+			     mm-security-handle 'gnus-details
+			     (with-current-buffer " *mailcrypt stderr temp"
+			       (buffer-string))))
+			(if (get-buffer " *mailcrypt stdout temp")
+			    (kill-buffer " *mailcrypt stdout temp"))
+			(if (get-buffer " *mailcrypt stderr temp")
+			    (kill-buffer " *mailcrypt stderr temp"))
+			(if (get-buffer " *mailcrypt status temp")
+			    (kill-buffer " *mailcrypt status temp"))
+			(if (get-buffer mc-gpg-debug-buffer)
+			    (kill-buffer mc-gpg-debug-buffer)))
 		  (error
 		   (mm-set-handle-multipart-parameter
 		    mm-security-handle 'gnus-details (cadr err))
@@ -187,7 +202,7 @@
 		   nil))
 	  (mm-set-handle-multipart-parameter
 	   mm-security-handle 'gnus-info "Failed")
-	  (throw 'error handle)))
+	    (throw 'error handle))))
       (mm-set-handle-multipart-parameter
        mm-security-handle 'gnus-info "OK")
       handle)))

Re: GPG signature verification

[Ulf Rompe]

Roland Mas <mas@echo.fr> writes:

> > > If memory serves, once upon a time, the [[PGP signed part:OK]]
> > > (or FAILED) was buttonized and that details were shown on click.
> 
> I'm using Mailcrypt with GnuPG 1.0.5, both from Debian.

The output of GnuPG 1.0.5 differs a bit from previous versions. This
renders decryption of crypted mail impossible with mailcrypt 3.5.5 and
maybe also the verify. If you use Emacs you should install the latest
mailcrypt available from Debian which contains a little patch. For
Xemacs it may be the easiest to install mailcrypt 3.5.6 manually,
available from http://mailcrypt.sourceforge.net/ .

I could also recommend a downgrade to GnuPG 1.0.4 until the mailcrypt
package for Xemacs is up to date but I fear the flames of the security
experts out there. :-)

[x] ulf

-- 
Besuche machen immer Freude. Wenn nicht beim Kommen, dann beim Gehen.
(Spanisches Sprichwort)