Re: Trailing whitespace and PGP/MIME

[Jesper Harder <harder@ifa.au.dk>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Simon Josefsson <jas@extundo.com> writes:

> Jesper Harder <harder@ifa.au.dk> writes:
>
>> It'll fix pgp/mime, but it will also force QP for inline pgp if you
>> use a signature -- which for a lot of people means _always_ -- thus
>> more or less reverting the intention of your previous change.
>
> Ah.  Hm.  Er.  So what IS the right thing?  The MUST above is for
> PGP/MIME, yes, but the _reason_ the MUST is there in the document is
> about as valid for plain PGP as it is for PGP/MIME, I think, arguing
> that the obvious approach is the right.

I'm not sure all the reasons are valid for cleartext signatures.

In RFC 2440 textmode is used for cleartext signatures.  PGP/MIME
allows you to use either a textmode or a binary mode detached
signature.

I think that's why they need the extra restrictions.  Trailing SPC
doesn't matter if you're only using textmode, because it's ignored
when computing the signature.

> One (non-)solution is to warn the user whenever the message content
> may not work reliably with plain PGP and ask the user if she wants to
> continue, or use PGP/MIME instead.

This is similar to Mutt (or at least what Mutt used to do -- my
version is fairly old):

,----
|   6.3.115 pgp_create_traditional
| 
|   Type: quadoption
|   Default: no
| 
|   This option controls whether Mutt generates old-style PGP encrypted or
|   signed messages under certain circumstances.
| 
|   Note that PGP/MIME will be used automatically for messages which have
|   a character set different from us-ascii, or which consist of more than
|   a single MIME part.
| 
|   Also note that using the old-style PGP message format is *strongly
|   depreceated*
`----

> There are many things on this list now, e.g., non-ASCII,

Yup, I agree that inline signatures are unsuitable for non-ASCII.

> trailing unencoded SPC,

I don't think that's a problem.

> data that look dash escaped.

But gpg seems to handle dash-escapes just fine:

- - -

Also, the "PGP sign part" and "PGP encrypt part" commands should
probably be removed, since Gnus itself isn't even able to handle the
result.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (GNU/Linux)

iD8DBQE/8gpCzEN/MEcathkRAsyuAJ0ZYZAW43Vomkvgy1USXy7csgC76wCg0cpN
dUEzVV66ZtZolVLRv6RQ/6I=
=Sl27
-----END PGP SIGNATURE-----