Re: [PATCH/2.1] gpgme fixes & entensions

[Albrecht Dreß <albrecht dress arcor de>]

Am 26.05.04 22:08 schrieb(en) Jeffrey Stedfast:
> I've actually been meaning to ask if you have any comments on the new
> cipher context interfaces. My goal was to improve them as much as I
> could without breaking binary/source compat.

Well, to be honest, I just don't use them as more information about the  
signature status is needed *and* provided by gpgme... ;-) For that, I  
implemented the gpgme signature status (which is not OpenPGP specific,  
btw.) as a GObject. See libbalsa/gmime-gpgme-signature.[hc], if you're  
interested.

I have indeed a few remarks, though. IMHO the by far most important  
problem is fixing the bug which doesn't feed the headers verbatim into the  
crypto engine, frequently (but not always) breaking signatures if the  
signed stuff is itself multipart. This one is simply a show stopper, as it  
makes signature checking completely unreliable. BTW the reason that I  
develop on balsa 2.1, but still use 2.0... I think fixing it should have  
absolutely top priority.

It would also be interesting to support single-part protocols like RFC2440  
parts or RFC 2633 application/pkcs7-mime with the crypto context. I did  
that for RFC 2440 in balsa using a simple hack: added a field in the gpgme  
context (derived from the crypto context) which indicates if we are in  
single or multipart mode. Now the verify method works as usual in  
multipart mode, but in single part mode the RFC 2440 part is fed into  
istream, and the "decrypted" (i.e. RFC 2440 armor removed) output is  
written to sigstream. Implementing a RFC2440 part class is then trivial;  
see libbalsa/gmime-part-rfc2440.[hc].

With the single-/multipart hack, it will also be easy to implement rfc  
2633 support (well, at least with the gpgme backend - gpgsm has it's own  
problems!). I already have a small patch for gmime-multipart-signed.c to  
get multipart/signed with application/pkcs7-signature protocol working -  
it's just changing ~15 lines and you're done. I also have a working  
implementation for application-pkcs7-mime (the single-part singed and/or  
encrypteed protocol), but both are not yet verified with gmime 2.1.5  
(delayed by other work and a gpgme bug; maybe next weekend's task? ;-)).  
If you are interested, I could send you both.

Just my ¤ 0.01...

Cheers,

	Albrecht.


--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Albrecht Dreß  -  Johanna-Kirchner-Straße 13  -  D-53123 Bonn (Germany)
      Phone (+49) 228 6199571  -  mailto:albrecht dress arcor de
_________________________________________________________________________

Attachment: pgp00032.pgp
Description: PGP signature