nnimap + mailcrypt

nnimap + mailcrypt

[Nicolas Kowalski]

Hello.

I have already asked if the nnimap backend was able to edit
messages. The answer is no. I have to move the messages I want to edit
to an nnml group (or to any backend which supports article editing),
edit them then put them back in the originate nnimap folder.

This makes the nnimap backend "incompatible" with the mailcrypt
package: for example, when I use the `decrypt' function, I will always
get an error, since this require article modification.

Did someone managed to make mailcrypt work smoothly with nnimap ?

Thanks in advance,
Nicolas.

Re: nnimap + mailcrypt

[Simon Josefsson]

On Thu, 11 Apr 2002, Nicolas Kowalski wrote:

> Hello.
> 
> I have already asked if the nnimap backend was able to edit
> messages. The answer is no. I have to move the messages I want to edit
> to an nnml group (or to any backend which supports article editing),
> edit them then put them back in the originate nnimap folder.
> 
> This makes the nnimap backend "incompatible" with the mailcrypt
> package: for example, when I use the `decrypt' function, I will always
> get an error, since this require article modification.
> 
> Did someone managed to make mailcrypt work smoothly with nnimap ?

Isn't the decrypt functionality in Oort Gnus enough?  What is missing?

Re: nnimap + mailcrypt

[Nicolas Kowalski]

Simon Josefsson <jas@extundo.com> writes:

>> This makes the nnimap backend "incompatible" with the mailcrypt
>> package: for example, when I use the `decrypt' function, I will always
>> get an error, since this require article modification.
>> 
>> Did someone managed to make mailcrypt work smoothly with nnimap ?
>
> Isn't the decrypt functionality in Oort Gnus enough?  What is missing?

Do you mean the "W s runs `gnus-summary-force-verify-and-decrypt'"
feature of Oort ? If yes, this does nothing with my current setup.
I certainly have forgot to configure something however :-(.

Re: nnimap + mailcrypt

[Simon Josefsson]

On Thu, 11 Apr 2002, Nicolas Kowalski wrote:

> Simon Josefsson <jas@extundo.com> writes:
> 
> >> This makes the nnimap backend "incompatible" with the mailcrypt
> >> package: for example, when I use the `decrypt' function, I will always
> >> get an error, since this require article modification.
> >> 
> >> Did someone managed to make mailcrypt work smoothly with nnimap ?
> >
> > Isn't the decrypt functionality in Oort Gnus enough?  What is missing?
> 
> Do you mean the "W s runs `gnus-summary-force-verify-and-decrypt'"
> feature of Oort ? If yes, this does nothing with my current setup.

MIME buttons aren't displayed per default, so you need to frob
gnus-buttonized-mime-types.  Hm.  W s should alter that default behaviour
temporarily.  Try this patch.

--- gnus-sum.el.~6.203.~	Mon Apr  8 11:16:34 2002
+++ gnus-sum.el	Thu Apr 11 14:17:35 2002
@@ -6680,7 +6680,10 @@
 (defun gnus-summary-force-verify-and-decrypt ()
   (interactive)
   (let ((mm-verify-option 'known)
-	(mm-decrypt-option 'known))
+	(mm-decrypt-option 'known)
+	(gnus-buttonized-mime-types (append (list "multipart/signed" 
+						  "multipart/encrypted")
+					    gnus-buttonized-mime-types)))
     (gnus-summary-select-article nil 'force)))
 
 (defun gnus-summary-set-current-mark (&optional current-mark)

> I certainly have forgot to configure something however :-(.

No Gnus configuration should be needed to get PGP to work.  Everything 
Should Just Work.  Consider it a bug if it doesn't.

Re: nnimap + mailcrypt

[Nicolas Kowalski]

Simon Josefsson <jas@extundo.com> writes:

> On Thu, 11 Apr 2002, Nicolas Kowalski wrote:
>
>> Simon Josefsson <jas@extundo.com> writes:
>> 
>> >> This makes the nnimap backend "incompatible" with the mailcrypt
>> >> package: for example, when I use the `decrypt' function, I will always
>> >> get an error, since this require article modification.
>> >> 
>> >> Did someone managed to make mailcrypt work smoothly with nnimap ?
>> >
>> > Isn't the decrypt functionality in Oort Gnus enough?  What is missing?
>> 
>> Do you mean the "W s runs `gnus-summary-force-verify-and-decrypt'"
>> feature of Oort ? If yes, this does nothing with my current setup.
>

<snip patch>
>
>> I certainly have forgot to configure something however :-(.
>
> No Gnus configuration should be needed to get PGP to work.  Everything 
> Should Just Work.  Consider it a bug if it doesn't.

Seems to work when I send myself encrypted messages (before and after
patching). Gnus asks if I want to decrypt message.

Ah ! I think I found what the problem is : the messages I am unable to
decrypt come from M$ Outlook :


------=_NextPart_000_000B_01C1E13F.73BCB220
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_000C_01C1E13F.73BE38C0"


------=_NextPart_001_000C_01C1E13F.73BE38C0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


<pgp-message-here>

Re: nnimap + mailcrypt

[Simon Josefsson]

On Thu, 11 Apr 2002, Nicolas Kowalski wrote:

> Ah ! I think I found what the problem is : the messages I am unable to
> decrypt come from M$ Outlook :

Gnus does not support Outlook-PGP yet.  C-d on the message may be a
workaround.

The reason is that the Outlook PGP plugins do not support either of the
two IETF standards on how PGP in mail should look like.  Outlook supports
S/MIME correctly and natively though (and so do Gnus), so perhaps you will
have better luck with it.  S/MIME seem to interop a magnitude or so better
than PGP today...  a few years ago, the reverse was true.

smime setup [was: Re: nnimap + mailcrypt]

[Nicolas Kowalski]

Simon Josefsson <jas@extundo.com> writes:

> On Thu, 11 Apr 2002, Nicolas Kowalski wrote:
>
>> Ah ! I think I found what the problem is : the messages I am unable to
>> decrypt come from M$ Outlook :
>
> Gnus does not support Outlook-PGP yet.  C-d on the message may be a
> workaround.

Ok.


> The reason is that the Outlook PGP plugins do not support either of the
> two IETF standards on how PGP in mail should look like.  Outlook supports
> S/MIME correctly and natively though (and so do Gnus), so perhaps you will
> have better luck with it.  S/MIME seem to interop a magnitude or so better
> than PGP today...  a few years ago, the reverse was true.

I have no luck :-(. See below. I followed the instructions from smime.el.

Excerpt from my .emacs:

 (smime-CA-file "\"~/perso/certs/cacert.pem\"")
 (canlock-password "4de89211c1a1f5ac8dca322797c2cb38f36f2018")
 (smime-keys (quote (("Nicolas.Kowalski@imag.fr" "\"~/perso/certs/niko.pem\"" nil))))


And when I try to send a smime signed message, I have (sorry for the
long lines) :

Signaling: (wrong-number-of-arguments #<compiled-function (prompt table &optional predicate require-match initial-contents history) "...(37)" [table predicate require-match t nil last-exact-completion minibuffer-completion-confirm minibuffer-completion-predicate minibuffer-completion-table read-from-minibuffer prompt initial-contents minibuffer-local-completion-map minibuffer-local-must-match-map history] 6 748493> 7)
  completing-read("Sign using which signature? (default Nicolas.Kowalski@imag.fr) " (("Nicolas.Kowalski@imag.fr" "\"~/perso/certs/niko.pem\"" nil)) nil nil nil nil "Nicolas.Kowalski@imag.fr")
  smime-sign-buffer(nil)
  mml-smime-sign((part (sign . "smime") (tag-location . 549) (contents . "\n\nnklnklgf\ngfkflknglf\n")))
  mml-smime-sign-buffer((part (sign . "smime") (tag-location . 549) (contents . "\n\nnklnklgf\ngfkflknglf\n")))
  mml-generate-mime-1((part (sign . "smime") (tag-location . 549) (contents . "\n\nnklnklgf\ngfkflknglf\n")))
  mml-generate-mime()
  message-encode-message-body()
  message-send-mail(nil)
  message-send-via-mail(nil)
  message-send(nil)
  message-send-and-exit(nil)
  call-interactively(message-send-and-exit)

Re: smime setup [was: Re: nnimap + mailcrypt]

[Simon Josefsson]

On Thu, 11 Apr 2002, Nicolas Kowalski wrote:

> > two IETF standards on how PGP in mail should look like.  Outlook supports
> > S/MIME correctly and natively though (and so do Gnus), so perhaps you will
> > have better luck with it.  S/MIME seem to interop a magnitude or so better
> > than PGP today...  a few years ago, the reverse was true.
> 
> I have no luck :-(. See below. I followed the instructions from smime.el.
> 
> Excerpt from my .emacs:
> 
>  (smime-CA-file "\"~/perso/certs/cacert.pem\"")
>  (canlock-password "4de89211c1a1f5ac8dca322797c2cb38f36f2018")
>  (smime-keys (quote (("Nicolas.Kowalski@imag.fr" "\"~/perso/certs/niko.pem\"" nil))))

Looks good.

> And when I try to send a smime signed message, I have (sorry for the
> long lines) :

Oops.

Index: smime.el
===================================================================
RCS file: /usr/local/cvsroot/gnus/lisp/smime.el,v
retrieving revision 6.25
diff -u -w -u -u -r6.25 smime.el
--- smime.el	2002/03/04 22:34:32	6.25
+++ smime.el	2002/04/11 15:19:15
@@ -314,10 +314,10 @@
 	 keyfile
        (smime-get-key-by-email
 	(completing-read
-	 (concat "Sign using which signature? "
+	 (concat "Sign using which key? "
 		 (if smime-keys (concat "(default " (caar smime-keys) ") ")
 		   ""))
-	 smime-keys nil nil nil nil (car-safe (car-safe smime-keys))))))))
+	 smime-keys nil nil (car-safe (car-safe smime-keys))))))))
 
 (defun smime-encrypt-buffer (&optional certfiles buffer)
   "S/MIME encrypt BUFFER for recipients specified in CERTFILES.
@@ -438,7 +438,7 @@
 	    (concat "Decipher using which key? "
 		    (if smime-keys (concat "(default " (caar smime-keys) ") ")
 		      ""))
-	    smime-keys nil nil nil nil (car-safe (car-safe smime-keys)))))))))
+	    smime-keys nil nil (car-safe (car-safe smime-keys)))))))))
 
 ;; Various operations
 

Re: smime setup [was: Re: nnimap + mailcrypt]

[Nicolas Kowalski]

Simon Josefsson <jas@extundo.com> writes:

> Oops.

Works better now with the patch, but now...

When I hit C-c C-c, it asks me what signature to use, my passphrase,
then it stops with the following error :

Signaling: (args-out-of-range "" 0)
  message-encode-message-body()
  message-send-mail(nil)
  message-send-via-mail(nil)
  message-send(nil)
  message-send-and-exit(nil)
  call-interactively(message-send-and-exit)

Re: smime setup [was: Re: nnimap + mailcrypt]

[Simon Josefsson]

Nicolas Kowalski <Nicolas.Kowalski@imag.fr> writes:

> Simon Josefsson <jas@extundo.com> writes:
>
>> Oops.
>
> Works better now with the patch, but now...
>
> When I hit C-c C-c, it asks me what signature to use, my passphrase,
> then it stops with the following error :
>
> Signaling: (args-out-of-range "" 0)
>   message-encode-message-body()

Can you M-x load-library RET message.el RET before, to get another
more detailed backtrace?

Re: smime setup [was: Re: nnimap + mailcrypt]

[Nicolas Kowalski]

Simon Josefsson <jas@extundo.com> writes:

>> When I hit C-c C-c, it asks me what signature to use, my passphrase,
>> then it stops with the following error :
>>
>> Signaling: (args-out-of-range "" 0)
>>   message-encode-message-body()
>
> Can you M-x load-library RET message.el RET before, to get another
> more detailed backtrace?

I have the same message...

Sorry for inconvenience. How can I help now ?

Re: smime setup [was: Re: nnimap + mailcrypt]

[Simon Josefsson]

Nicolas Kowalski <Nicolas.Kowalski@imag.fr> writes:

>>> Signaling: (args-out-of-range "" 0)
>>>   message-encode-message-body()
>>
>> Can you M-x load-library RET message.el RET before, to get another
>> more detailed backtrace?
>
> I have the same message...
>
> Sorry for inconvenience. How can I help now ?

Weird, then I don't understand the backtrace.  Does (setq
debug-on-signal t) change anything?  Recompiling?  Waving a rubber
chicken in front of the screen while rebooting the machine and then
trying again?

Ah.  It says Signaling:, not Error:.  I gue

Re: smime setup [was: Re: nnimap + mailcrypt]

[Simon Josefsson]

Simon Josefsson <jas@extundo.com> writes:

> Nicolas Kowalski <Nicolas.Kowalski@imag.fr> writes:
>
>>>> Signaling: (args-out-of-range "" 0)
>>>>   message-encode-message-body()
>>>
>>> Can you M-x load-library RET message.el RET before, to get another
>>> more detailed backtrace?
>>
>> I have the same message...
>>
>> Sorry for inconvenience. How can I help now ?
>
> Weird, then I don't understand the backtrace.  Does (setq
> debug-on-signal t) change anything?  Recompiling?  Waving a rubber
> chicken in front of the screen while rebooting the machine and then
> trying again?
>
> Ah.  It says Signaling:, not Error:.  I gue

...ss you simply need to (setq debug-on-signal nil) or press c at the
debug prompt.

Note to self: never try to provoke emacs errors (to see how ordinary
emacs backtraces look like) by pressing supposedly unknown key
bindings, you'll end up pressing C-c C-c.

Re: smime setup [was: Re: nnimap + mailcrypt]

[Nicolas Kowalski]

Simon Josefsson <jas@extundo.com> writes:

>> Ah.  It says Signaling:, not Error:.  I gue
>
> ...ss you simply need to (setq debug-on-signal nil) or press c at the
> debug prompt.

Nothing happens thereafter :-(.  In fact, yes : when I hit 'c' one
more time, it continues to edit the message, inserting the 'c'
character....

Re: smime setup [was: Re: nnimap + mailcrypt]

[Simon Josefsson]

Nicolas Kowalski <Nicolas.Kowalski@imag.fr> writes:

> Simon Josefsson <jas@extundo.com> writes:
>
>>> Ah.  It says Signaling:, not Error:.  I gue
>>
>> ...ss you simply need to (setq debug-on-signal nil) or press c at the
>> debug prompt.
>
> Nothing happens thereafter :-(.  In fact, yes : when I hit 'c' one
> more time, it continues to edit the message, inserting the 'c'
> character....

Hm.  I don't understand the backtrace then.  Anyone?

Re: smime setup [was: Re: nnimap + mailcrypt]

[Nicolas Kowalski]

Simon Josefsson <jas@extundo.com> writes:

> Weird, then I don't understand the backtrace.  Does (setq
> debug-on-signal t) change anything?  Recompiling?  Waving a rubber
> chicken in front of the screen while rebooting the machine and then
> trying again?

1) does not change anything
2) nothing better
3) arghhh... :-)


> Ah.  It says Signaling:, not Error:.  I gue

You guess ???

As I wrote before, I will recheck all my Gnus configuration. Perhaps
could someone send me an excerpt of his/her setup for smime ? Anyone ?

Re: smime setup [was: Re: nnimap + mailcrypt]

[Simon Josefsson]

Nicolas Kowalski <Nicolas.Kowalski@imag.fr> writes:

> As I wrote before, I will recheck all my Gnus configuration. Perhaps
> could someone send me an excerpt of his/her setup for smime ? Anyone ?

I guess this won't help you much, but in theory the following should
be enough.  It seems to be for me.  The first one set up trust with
some CAs for verify, and the second indicate my identity for sign, the
rest is UI stuff.

 '(smime-CA-directory "~/.certs/")
 '(smime-keys (quote (("simon@josefsson.org" "~/jas.key+cert") ("sj@extundo.com" "~/sj.key+cert"))))
 '(gnus-buttonized-mime-types (quote ("multipart/encrypted" "multipart/signed")))
 '(mm-decrypt-option (quote always))
 '(mm-verify-option (quote always))

I think RedHat's OpenSSL defaults to use some CAs that is shipped with
RedHat, so the first one probably isn't needed if you run RedHat.

Re: smime setup [was: Re: nnimap + mailcrypt]

[Nicolas Kowalski]

Simon Josefsson <jas@extundo.com> writes:

> Nicolas Kowalski <Nicolas.Kowalski@imag.fr> writes:
>
>> As I wrote before, I will recheck all my Gnus configuration. Perhaps
>> could someone send me an excerpt of his/her setup for smime ? Anyone ?
>
> I guess this won't help you much, but in theory the following should
> be enough.  It seems to be for me.  The first one set up trust with
> some CAs for verify, and the second indicate my identity for sign, the
> rest is UI stuff.
>
>  '(smime-CA-directory "~/.certs/")
>  '(smime-keys (quote (("simon@josefsson.org" "~/jas.key+cert") ("sj@extundo.com" "~/sj.key+cert"))))
>  '(gnus-buttonized-mime-types (quote ("multipart/encrypted" "multipart/signed")))
>  '(mm-decrypt-option (quote always))
>  '(mm-verify-option (quote always))

I now use something similar :


 '(smime-CA-directory "~/perso/certs/")
 '(smime-CA-file "\"~/perso/certs/cacert.pem\"")
 '(smime-keys (quote (("Nicolas.Kowalski@imag.fr" "~/perso/certs/niko.pem" ))))
 '(mm-decrypt-option (quote always))
 '(mm-verify-option (quote always))


> I think RedHat's OpenSSL defaults to use some CAs that is shipped with
> RedHat, so the first one probably isn't needed if you run RedHat.

I need it so (Debian GNU/Linux).

I think I understand the backtrace now : when I compose a new message
('m'), if I try to use `smime-sign-buffer', I get an empty buffer (all
text is erased) in message mode. This explains the 

`(args-out-of-range "" 0) 


ie. there is nothing to encode....

Re: smime setup [was: Re: nnimap + mailcrypt]

[Kai Großjohann]

Nicolas Kowalski <Nicolas.Kowalski@imag.fr> writes:

>  '(smime-CA-file "\"~/perso/certs/cacert.pem\"")

I'm not sure that the extra quotes are a good idea.  What happens
when you remove them?

Also, maybe it helps to replace ~ with the name of your home dir.

kai
-- 
Silence is foo!

[SOLVED: openssl issue] Re: smime setup [was: Re: nnimap + mailcrypt]

[Nicolas Kowalski]

Kai.Grossjohann@CS.Uni-Dortmund.DE (Kai Großjohann) writes:

> Nicolas Kowalski <Nicolas.Kowalski@imag.fr> writes:
>
>>  '(smime-CA-file "\"~/perso/certs/cacert.pem\"")
>
> I'm not sure that the extra quotes are a good idea.  What happens
> when you remove them?
>
> Also, maybe it helps to replace ~ with the name of your home dir.


I followed your instruction. Behaviour was not changed.

Just to be sure, I recompiled a recent version (0.9.6c) of OpenSSL,
added it to my config as :

(require 'smime)
(setq smime-openssl-program "/usr/local/ssl/bin/openssl")


...and it worked !

My previous openssl comes from Debian (potato) :

astazou:~> openssl version
OpenSSL 0.9.4 09 Aug 1999


which was not tested :

smime.el:
...
;; It uses OpenSSL (tested with version 0.9.5a and 0.9.6) for signing,
;; encryption and decryption.
...



Thanks to all.

Re: [SOLVED: openssl issue] Re: smime setup [was: Re: nnimap + mailcrypt]

[Simon Josefsson]

Nicolas Kowalski <Nicolas.Kowalski@imag.fr> writes:

> My previous openssl comes from Debian (potato) :
>
> astazou:~> openssl version
> OpenSSL 0.9.4 09 Aug 1999

Ick.  If I'm not mistaken, that version has security bugs.

> which was not tested :
>
> smime.el:
> ...
> ;; It uses OpenSSL (tested with version 0.9.5a and 0.9.6) for signing,
> ;; encryption and decryption.

Gnus needs 0.9.6 or later to work correctly.