Subject: [sup-talk] Status of GPG support?

From: [email-masked] (Magnus Therning)
Date: Mon, 10 Dec 2007 21:49:08 +0000

I haven't had time to keep up-to-date on sup development, so I'm sorry
if I'm asking something that's obvious to everyone else.  A few weeks
ago there was only support for using GPG on received messages (signature
verification and I believe decryption); support for signing and
encrypting was lacking.  Has this changed by now, or are there
well-known (external to sup) workarounds?

/M

-- 
Magnus Therning                             (OpenPGP: 0xAB4DFBA4)
magnus?therning?org             Jabber: magnus?therning?gmail?com
http://therning.org/magnus

What if I don't want to obey the laws? Do they throw me in jail with
the other bad monads?
     -- Daveman

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
Url : http://rubyforge.org/pipermail/sup-talk/attachments/20071210/d6f1a105/attachment.bin

---

From: [email-masked] (William Morgan)
Date: Mon, 10 Dec 2007 14:13:42 -0800

Excerpts from Magnus Therning's message of Mon Dec 10 13:49:08 -0800 2007:
> A few weeks ago there was only support for using GPG on received
> messages (signature verification and I believe decryption); support
> for signing and encrypting was lacking.  Has this changed by now, or
> are there well-known (external to sup) workarounds?

Excellent timing on this question. SVN currently has a mocked-up
interface for choosing sign/encrypt/sign+encrypt for each message, and
as of last night I have most of the code necessary for signing outgoing
messages in my local repository. It needs a little polishing but should
be committed soon. (And encrypt/sign+encrypt should be pretty easy after
that.) (Also, this is all gpg-specific at this point.)

I will send an announcement when it's in.

-- 
William <wmorgan-sup at masanjin.net>

---

From: [email-masked] (William Morgan)
Date: Thu, 13 Dec 2007 17:01:24 -0800

> I will send an announcement when it's in.

I've committed a patch to add sign, encrypt, and sign+encrypt
capability. As with decryption and signature verification, this is gpg-
specific, and relies on gpg-agent for all password interactions. I don't
really want to get into the business of password management.

I need to add some mechanics for determining which setting is pre-
selected on a per-message basis. This will almost certainly be a hook.
Other than that, is should be basically functionally complete. 

I did add one config option: :discard_snippets_from_encrypted_messages,
which defaults to false. If this option is set to true, snippets that
were generated from encrypted content will not be stored in the index.
This is a limited security measure, because someone with access to the
Ferret index can recover the contents of the message in several ways
(that's the problem with the basic operation being full-text search!),
but this eliminates the most trivial way of getting encrypted message
content. It also means that the snippet for a message won't show up in
thread-index-mode until you load the message and enter in the password.