Subject: [sup-devel] RubyMail cannot handle multipart/signed messages

From: Michael Stapelberg <[email-masked]>
Date: Mon, 19 Apr 2010 09:43:49 +0200

Hi,

yesterday I got a PGP/MIME message which had multiple attachments. Turns out
RubyMail cannot do multipart/signed (sup says RubyMail failed to decode the
document for some bizarre reason, when you try it in irb, you’ll see it
actually decodes the message parts as headers). I also tried 'mail' by the
same author which he claims can do multipart and is better in general, but
it seems it also cannot do multipart/signed (RFC 1847).

So, what are the plans in regard to RubyMail? Switching to something different
altogether? If so, to which library? I would then fix parsing of
multipart/signed messages for this library…

Best regards,
Michael

PS: I attached a minimum working example of a problematic message (decrypted
body only)
_______________________________________________
Sup-devel mailing list
[email-masked]
http://rubyforge.org/mailman/listinfo/sup-devel

---

From: Rich Lane <[email-masked]>
Date: Tue, 20 Apr 2010 11:27:54 -0400

Excerpts from Michael Stapelberg's message of 2010-04-20 02:40:36 -0400:
> So, when do we switch to 'mail'?

I'm all for it but we need to be careful about regressions. We'd need
to have a pretty extensive testsuite covering Message and Chunk before
switching, which is a bigger effort than the switch itself.
_______________________________________________
Sup-devel mailing list
[email-masked]
http://rubyforge.org/mailman/listinfo/sup-devel

---

From: Michael Stapelberg <[email-masked]>
Date: Mon, 19 Apr 2010 17:57:11 +0200

Hi Sam,

Excerpts from Sam Hall's message of 2010-04-19 14:55:37 +0200:
> ~> irb -r mail      
> irb(main):001:0> pp Mail.read('mwe').parts
> [#<Mail::Part:16136008, Multipart: true, Headers: <Content-Type: multipart/mixed; boundary="MP_/+kacMkT=yx+FKvl3YUds1sR">>,
>  #<Mail::Part:19934460, Multipart: false, Headers: <Content-Type: application/pgp-signature; name=signature.asc>, <Content-Disposition: attachment; filename=signature.asc>>]
> => nil
> What's the problem on your side?
The problem arises as soon as you try to iterate over the content of the mail.
You will see that it only contains 2 parts (according to 'mail'), while there
are at least three text files, a signature and a text part:

irb(main):003:0> puts mail.parts.length
2
irb(main):006:0> pp mail.parts.map { |p| p.content_type }
["multipart/mixed; boundary=\"MP_/+kacMkT=yx+FKvl3YUds1sR\"",
 "application/pgp-signature; name=signature.asc"]
irb(main):007:0>

Best regards,
Michael

---

From: Sam Hall <[email-masked]>
Date: Tue, 20 Apr 2010 08:26:00 +0200

> are at least three text files, a signature and a text part:

The first part is a multipart-message in itself, you have to recurse to get
hands on its parts:

irb(main):012:0> pp mail.parts.first.parts.map { |p| p.content_type }
["text/plain; charset=US-ASCII",
 "text/plain; charset=US_ASCII",
 "text/plain; charset=US_ASCII",
 "text/plain; charset=US_ASCII",
 "text/plain; charset=US_ASCII"]

This is not only legal, RFC 3156 even requires this (in 5.):

  The multipart/signed body MUST consist of exactly two parts.  The first part
  contains the signed data in MIME canonical format, including a set of
  appropriate content headers describing the data.

  The second body MUST contain the OpenPGP digital signature.  It MUST be
  labeled with a content type of "application/pgp-signature".

Best wishes, Sam

---

From: Sam Hall <[email-masked]>
Date: Mon, 19 Apr 2010 14:55:37 +0200

Hi,

On Mon, Apr 19, 2010 at 09:43 (+0200), Michael Stapelberg wrote:
> I also tried 'mail' by the same author which he claims can do
> multipart and is better in general, but it seems it also cannot do
> multipart/signed (RFC 1847).

'rmail' is significantly broken since a whole while IMHO, but 'mail'
works for me:

~> irb -r mail      

Best wishes, Sam

---

From: Michael Stapelberg <[email-masked]>
Date: Tue, 20 Apr 2010 08:40:36 +0200

Hi Sam,

> The first part is a multipart-message in itself, you have to recurse to get
Ah, alright. I thought 'mail' would automatically flatten the parts. Nevermind,
then.

Best regards,
Michael