Re: Bad PGP signatures due to MIME encoding (?)

[Simon Josefsson <jas@extundo.com>]

Marshall T. Vandegrift <vandem2@rpi.edu> writes:

> Simon Josefsson <jas@extundo.com> writes:
>
>> No idea, people complain about it from time to time.  I refuse to
>> enable the key phrase cache or gpg-agent so that I'm reminded that the
>> problem is still there, in the hope that I get annoyed enough to
>> actually investigate it some time.  Not yet, though.
>
> Ooh...  Yummy.  So I investigated, sent around a bazillion test
> messages to myself, and learned more features of the elisp debuggers
> along the way.
>
> It looks like the cause is that `message-send' calls
> `message-send-mail' or `message-send-news' (as appropriate), which
> translates any mml in the message into actual MIME parts.  If there's
> a `Gcc' header, then `gnus-inews-do-gcc' eventually gets called, but
> on the original message, so it gets to turn around and do all the
> complicated mml-->MIME processing all over again, including PGP
> signature generation.
>
> I don't know nearly enough about the Gnus internals to even begin
> suggesting how to fix this, but it seems like there should be a Better
> Way...

Thanks for the analysis.  I think one complication in solving this is
when an article is both mailed and posted (to news).  Depending on the
destination, the body might end up being encoded differently, so it is
unclear where to invoke the PGP signing.  The same applies to GCC --
what encodings are appropriate for mail or news might not be
appropriate for a GCC.

I'm also not sure what a good solution would be.  Perhaps simply
explaining the problem is enough, then users can understand what is
going on.  In mail, the user can add a BCC to get a copy of the
message as it really was sent.  There should probably be a feature
that inhibits PGP/SMIME for GCC.  There is
gnus-gcc-externalize-attachments now, that does roughly the same but
for attachments.  Maybe a gnus-gcc-inhibit-security would be useful.