[Evolution-hackers] Evolution (1.5), GPG, and other email clients; compat problems

[Lars Vilhuber <lists all cloutier-vilhuber net>]

 guess it is now two weeks that I have been trying out Evolution as a
email/calendar/task client ("groupware",
http://www.novell.com/products/evolution). Prime incentive was the
integration of email/calendar/addressbook with Palm sync - my current
combo of Mozilla (email/addressbook) and JPilot
(addressbook/calendar/palm sync) does not work well together, nor does
Jpilot use the Ical standard that Oracle/other calendars use. I have
been using Evolution 1.5 (development, pre-2.0) version, since it is
the one with a more usual user interface, integrated junk mail
filtering, and other supposed improvements. I have been using it for
my list subscriptions and private email, some calendaring, but no
"main" email.

System:
SuSE 9.0,
upgraded to KDE 3.3
evolution-1.5/evolution-2.0 downloaded via red-carpet
(evolution1.5-1.5.94.1.0.200409071004-0.snap.ximian.8.1)
Mozilla 1.7.2

Results/winners:
- junk mail filtering is on par between the two (so far), but the bulk
of my junk mail is received on main email, not the lists or the
private email, so it remains to be seen.
- screen appearance: Mozilla
- calendaring: Evolution
- Addressbook: Jpilot, but Evolution integrated, with quirks
- email compatibility: Mozilla.

This last one surprised me, until I got messages from my parents and
colleagues about weird email attachments. It turns out the problem is 
with the way Evo handles GPG-signed messages, and the way Mozilla 
and/or Windows email clients see it. I believe this is a non-trivial 
problem.

I set up a test email account, and mailed
myself from both Mozilla and Evolution (on Linux), then read the
emails (on Windows) with Mozilla and Outlook Express. Results: it's
the security signing that I do that confuses Outlook Express (maybe
also Eudora) but NOT Mozilla (all platforms) and not any of the
web-based (mostly LInux-based) platforms.  When sending non-signed
messages from Evo, OE does not have problems.

In essence: when I "GPG sign" my messages, Mozilla, when sending,
recombines the signed message and its signature, "inserting" it into
the main mail message:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is signed.
- --
[other stuff ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
[actual GPG signature hash]
-----END PGP SIGNATURE-----

Evolution seems to do something else: it
attaches the original email message and the (separate) signature
invididually as attachments.

Attachment 1: "This is signed."
Attachment 2: "-----BEGIN PGP SIGNATURE..."

NOw on the receiving end, Mozilla is fine with both  ways of sending, 
but doesn't explicitly identify the Evo-sent message as being 
digitally signed. It shows the main message inline (even if I tell it 
not to show attachments inline), and sees the signature as a .asc file 
in attachment.

OE, on the other hand, sees BOTH components as
attachments, and strips out the main message body as "unsafe"...
Eudora possibly does the same thing, creating a .ems attachment
(.ems="email message"?) that it may or may not show inline.

Obviously, GPG-signed messages sent from Mozilla are identified as 
such in Mozilla.

When you have Evo on the receiving end, it is the converse. It doesn't 
recognize the Mozilla way of signing messages as being "digitally 
signed", but correctly processes Evo-sent messages.

So the matrix looks like this, for encrypted/non-encyrpted messages.
YES=can read message, identifies as signed
Yes=can read message, but does not identify as signed
NO= cannot read message

                 |  Receiving:
Sending:         |  Mozilla       Evolution       OE
--------------------------------------------------------
Mozilla/GPG         YES           Yes             Yes
Mozilla             Yes           Yes             Yes
Evolution/GPG       Yes           YES             NO
Evolution           Yes           Yes             Yes

So it seems to be a email setup problem, but related to the fact that
the message is coming from a Unix host. Mozilla, which is
cross-platform, has no problems; OE and possibly Eudora, which are
not, have problems. The problem is still in the way Evolution handles
PGP-signing - it treats a message differently when it is being signed
then when it is not being signed, contrary to the Mozilla-way of
creating a message.

For me, this is a critical failure - I want to sign my emails, but 
most of my correspondents are either Windows users (have problems 
above) or are Mozilla users (and the signing would not show up as 
signings).

On the positive side, Evo's calendar apps and calendar compatibility
is far greater than Jpilot's. However, given my intensity of email use
relative to the intensity of sophisticated calendar usage, that
doens't trump Evo's email problems.

I think at this point in time, I will continue to monitor Evolution,
but not use it for anything - I'll revert back to my current combo.
--
Lars Vilhuber                    lists all cloutier-vilhuber net