Subject: [sup-devel] [Heliotrope/Turnsole] GPG signature verification

From: William Morgan <[email-masked]>
Date: Mon, 05 Mar 2012 14:45:20 -0800

Excerpts from Michael Stapelberg's message of 2012-03-01 03:58:24 -0800:
> I tried implementing GPG signature verification first, and got it
> nearly working

Awesome!

> 1) In ChunkParser#chunks_for_message, the message object has multiple
> parts, which in turn are just hashes. At least in my tests, the first
> part usually has a "content" entry, but the second part doesn’t.

As background, these message parts are pre-digested things sent by
Heliotrope as a way of displaying messages without needing to download
all the attachments. They are based on MIME parts but undergo a lossy
transformation. The basic rule right now is that text parts include the
content by default, and non-text parts do not (and so require a separate
download).

> Therefore, I need to request it from heliotrope. Should I introduce a
> new class for that or am I missing an existing class which I can use
> for that?

I think introducing a new chunk class is the right approach.

> 2) For verification, I need the not-decoded MIME part, but heliotrope
> decodes MIME parts. Thus, I always get a bad signature. How should we
> fix this? Not decode MIME in heliotrope, but in turnsole? Decode MIME
> in both? Make turnsole get the raw message, too, for GPG (roundtrip
> alert!)?

I think you will need to get the entire raw message and MIME decode it
in turnsole.

BTW, you can look at Sup for a lot of relevant code. There is a
CryptoNotice class in message-chunks.rb, and an inline_gpg_to_chunks
method in message.rb. The structure is pretty similar to what you
see in Turnsole (although not, of course, identical).

Good luck!
-- 
William <[email-masked]>
_______________________________________________
Sup-devel mailing list
[email-masked]
http://rubyforge.org/mailman/listinfo/sup-devel

---

From: Michael Stapelberg <[email-masked]>
Date: Thu, 01 Mar 2012 12:58:24 +0100

Hi,

Before I can actually switch to Heliotrope/Turnsole, I need to have GPG working
properly. I tried implementing GPG signature verification first, and got it
nearly working, but before I go down the rabbit hole too far, I decided to ask
a few questions here first:

1) In ChunkParser#chunks_for_message, the message object has multiple parts,
   which in turn are just hashes. At least in my tests, the first part usually
   has a "content" entry, but the second part doesn’t. Therefore, I need to
   request it from heliotrope. Should I introduce a new class for that or am I
   missing an existing class which I can use for that? Chunk::Attachment has
   very similar functionality with its content method.

2) For verification, I need the not-decoded MIME part, but heliotrope decodes
   MIME parts. Thus, I always get a bad signature. How should we fix this? Not
   decode MIME in heliotrope, but in turnsole? Decode MIME in both? Make
   turnsole get the raw message, too, for GPG (roundtrip alert!)?

Best regards,
Michael