3 test_description='S/MIME signature verification and decryption'
4 . $(dirname "$0")/test-lib.sh || exit 1
7 test_require_external_prereq openssl
8 test_require_external_prereq gpgsm
10 FINGERPRINT=$(openssl x509 -sha1 -fingerprint -in "$NOTMUCH_SRCDIR/test/smime/key+cert.pem" -noout | sed -e 's/^.*=//' -e s/://g)
14 test_begin_subtest "emacs delivery of S/MIME signed message"
17 "test signed message 001" \
18 "This is a test signed message." \
19 "(mml-secure-message-sign \"smime\")"'
21 test_begin_subtest "emacs delivery of S/MIME encrypted + signed message"
22 # Hard code the MML to avoid several interactive questions
25 "test encrypted message 001" \
26 "<#secure method=smime mode=signencrypt>\nThis is a test encrypted message.\n"'
28 test_begin_subtest "Signature verification (openssl)"
29 notmuch show --format=raw subject:"test signed message 001" |\
30 openssl smime -verify -CAfile $NOTMUCH_SRCDIR/test/smime/test.crt 2>OUTPUT
32 Verification successful
34 test_expect_equal_file EXPECTED OUTPUT
36 test_begin_subtest "signature verification (notmuch CLI)"
37 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
38 | notmuch_json_show_sanitize \
39 | sed -e 's|"created": [-1234567890]*|"created": 946728000|g' \
40 -e 's|"expires": [-1234567890]*|"expires": 424242424|g' )
41 expected='[[[{"id": "XXXXX",
44 "filename": ["YYYYY"],
45 "timestamp": 946728000,
46 "date_relative": "2000-01-01",
47 "tags": ["inbox","signed"],
48 "crypto": {"signed": {"status": [{"fingerprint": "'$FINGERPRINT'", "status": "good","userid": "CN=Notmuch Test Suite","expires": 424242424, "created": 946728000}]}},
49 "headers": {"Subject": "test signed message 001",
50 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
51 "To": "test_suite@notmuchmail.org",
52 "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
54 "sigstatus": [{"fingerprint": "'$FINGERPRINT'",
56 "userid": "CN=Notmuch Test Suite",
58 "created": 946728000}],
59 "content-type": "multipart/signed",
61 "content-type": "text/plain",
62 "content": "This is a test signed message.\n"},
64 "content-disposition": "attachment",
65 "content-length": "NONZERO",
66 "content-transfer-encoding": "base64",
67 "content-type": "application/pkcs7-signature",
68 "filename": "smime.p7s"}]}]},
70 test_expect_equal_json \
74 test_begin_subtest "Decryption and signature verification (openssl)"
75 notmuch show --format=raw subject:"test encrypted message 001" |\
76 openssl smime -decrypt -recip $NOTMUCH_SRCDIR/test/smime/key+cert.pem |\
77 openssl smime -verify -CAfile $NOTMUCH_SRCDIR/test/smime/test.crt 2>OUTPUT
79 Verification successful
81 test_expect_equal_file EXPECTED OUTPUT
83 test_begin_subtest "Decryption (notmuch CLI)"
84 notmuch show --decrypt=true subject:"test encrypted message 001" |\
85 grep "^This is a" > OUTPUT
87 This is a test encrypted message.
89 test_expect_equal_file EXPECTED OUTPUT
91 test_begin_subtest "Cryptographic message status (encrypted+signed)"
92 output=$(notmuch show --format=json --decrypt=true subject:"test encrypted message 001")
93 test_json_nodes <<<"$output" \
94 'crypto_encrypted:[0][0][0]["crypto"]["decrypted"]["status"]="full"' \
95 'crypto_sigok:[0][0][0]["crypto"]["signed"]["status"][0]["status"]="good"' \
96 'crypto_fpr:[0][0][0]["crypto"]["signed"]["status"][0]["fingerprint"]="616F46CD73834C63847756AF0DFB64A6E0972A47"' \
97 'crypto_uid:[0][0][0]["crypto"]["signed"]["status"][0]["userid"]="CN=Notmuch Test Suite"'
99 test_begin_subtest "encrypted+signed message is known to be encrypted, but signature is unknown"
100 output=$(notmuch search subject:"test encrypted message 001")
101 test_expect_equal "$output" "thread:0000000000000002 2000-01-01 [1/1] Notmuch Test Suite; test encrypted message 001 (encrypted inbox)"
103 test_begin_subtest "Encrypted body is not indexed"
104 output=$(notmuch search 'this is a test encrypted message')
105 test_expect_equal "$output" ""
107 test_begin_subtest "Reindex cleartext"
108 test_expect_success "notmuch reindex --decrypt=true subject:'test encrypted message 001'"
110 test_begin_subtest "signature is now known"
111 output=$(notmuch search subject:"test encrypted message 001")
112 test_expect_equal "$output" "thread:0000000000000002 2000-01-01 [1/1] Notmuch Test Suite; test encrypted message 001 (encrypted inbox signed)"
114 test_begin_subtest "Encrypted body is indexed"
115 output=$(notmuch search 'this is a test encrypted message')
116 test_expect_equal "$output" "thread:0000000000000002 2000-01-01 [1/1] Notmuch Test Suite; test encrypted message 001 (encrypted inbox signed)"
118 add_email_corpus pkcs7
120 test_begin_subtest "index PKCS#7 SignedData message"
121 output=$(notmuch search --output=messages Thanks)
122 expected=id:smime-onepart-signed@protected-headers.example
123 test_expect_equal "$expected" "$output"
125 test_begin_subtest "do not index embedded certificates from PKCS#7 SignedData"
126 output=$(notmuch search --output=messages 'LAMPS Certificate')
128 test_expect_equal "$expected" "$output"
130 test_begin_subtest "know the MIME type of the embedded part in PKCS#7 SignedData"
131 output=$(notmuch search --output=messages 'mimetype:text/plain')
132 expected=id:smime-onepart-signed@protected-headers.example
133 test_expect_equal "$expected" "$output"
135 test_begin_subtest "PKCS#7 SignedData message is tagged 'signed'"
136 output=$(notmuch dump id:smime-onepart-signed@protected-headers.example)
137 expected='#notmuch-dump batch-tag:3 config,properties,tags
138 +inbox +signed +unread -- id:smime-onepart-signed@protected-headers.example'
139 test_expect_equal "$expected" "$output"
141 test_begin_subtest "show contents of PKCS#7 SignedData message"
142 output=$(notmuch show --format=raw --part=2 id:smime-onepart-signed@protected-headers.example)
144 expected="Bob, we need to cancel this contract.
146 Please start the necessary processes to make that happen today.
152 OpenPGP Example Corp"
153 test_expect_equal "$expected" "$output"
155 test_begin_subtest "reply to PKCS#7 SignedData message with proper quoting and attribution"
156 output=$(notmuch reply id:smime-onepart-signed@protected-headers.example)
157 expected="From: Notmuch Test Suite <test_suite@notmuchmail.org>
158 Subject: Re: The FooCorp contract
159 To: Alice Lovelace <alice@smime.example>, Bob Babbage <bob@smime.example>
160 In-Reply-To: <smime-onepart-signed@protected-headers.example>
161 References: <smime-onepart-signed@protected-headers.example>
163 On Tue, 26 Nov 2019 20:11:29 -0400, Alice Lovelace <alice@smime.example> wrote:
164 > Bob, we need to cancel this contract.
166 > Please start the necessary processes to make that happen today.
172 > OpenPGP Example Corp"
173 test_expect_equal "$expected" "$output"
175 test_begin_subtest "show PKCS#7 SignedData outputs valid JSON"
176 output=$(notmuch show --format=json id:smime-onepart-signed@protected-headers.example)
177 test_valid_json "$output"
179 test_begin_subtest "Verify signature on PKCS#7 SignedData message"
180 if [ $NOTMUCH_HAVE_64BIT_TIME_T -ne 1 ]; then
181 test_subtest_known_broken
183 output=$(notmuch show --format=json id:smime-onepart-signed@protected-headers.example)
185 test_json_nodes <<<"$output" \
186 'created:[0][0][0]["crypto"]["signed"]["status"][0]["created"]=1574813489' \
187 'expires:[0][0][0]["crypto"]["signed"]["status"][0]["expires"]=2611032858' \
188 'fingerprint:[0][0][0]["crypto"]["signed"]["status"][0]["fingerprint"]="702BA4B157F1E2B7D16B0C6A5FFC8A7DE2057DEB"' \
189 'status:[0][0][0]["crypto"]["signed"]["status"][0]["status"]="good"'
191 test_begin_subtest "Verify signature on PKCS#7 SignedData message signer User ID"
192 if [ $NOTMUCH_GMIME_X509_CERT_VALIDITY -ne 1 ]; then
193 test_subtest_known_broken
195 test_json_nodes <<<"$output" \
196 'userid:[0][0][0]["crypto"]["signed"]["status"][0]["userid"]="CN=Alice Lovelace"'