4 # - decryption/verification with signer key not available
5 # - verification of signatures from expired/revoked keys
7 test_description='PGP/MIME signature verification and decryption'
13 [ -d ${GNUPGHOME} ] && return
14 mkdir -m 0700 "$GNUPGHOME"
15 gpg --no-tty --import <$TEST_DIRECTORY/gnupg-secret-key.asc >"$GNUPGHOME"/import.log 2>&1
16 test_debug "cat $GNUPGHOME/import.log"
17 if (gpg --quick-random --version >/dev/null 2>&1) ; then
18 echo quick-random >> "$GNUPGHOME"/gpg.conf
19 elif (gpg --debug-quick-random --version >/dev/null 2>&1) ; then
20 echo debug-quick-random >> "$GNUPGHOME"/gpg.conf
24 ##################################################
28 FINGERPRINT=$(gpg --no-tty --list-secret-keys --with-colons --fingerprint | grep '^fpr:' | cut -d: -f10)
30 # for some reason this is needed for emacs_deliver_message to work,
31 # although I can't figure out why
34 test_expect_success 'emacs delivery of signed message' \
35 'emacs_deliver_message \
36 "test signed message 001" \
37 "This is a test signed message." \
38 "(mml-secure-message-sign)"'
40 test_begin_subtest "signature verification"
41 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
42 | notmuch_json_show_sanitize \
43 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
44 expected='[[[{"id": "XXXXX",
47 "timestamp": 946728000,
48 "date_relative": "2000-01-01",
49 "tags": ["inbox","signed"],
50 "headers": {"Subject": "test signed message 001",
51 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
52 "To": "test_suite@notmuchmail.org",
55 "Date": "01 Jan 2000 12:00:00 -0000"},
57 "sigstatus": [{"status": "good",
58 "fingerprint": "'$FINGERPRINT'",
59 "created": 946728000}],
60 "content-type": "multipart/signed",
62 "content-type": "text/plain",
63 "content": "This is a test signed message.\n"},
65 "content-type": "application/pgp-signature"}]}]},
71 test_begin_subtest "signature verification with full owner trust"
72 # give the key full owner trust
73 echo "${FINGERPRINT}:6:" | gpg --no-tty --import-ownertrust >>"$GNUPGHOME"/trust.log 2>&1
74 gpg --no-tty --check-trustdb >>"$GNUPGHOME"/trust.log 2>&1
75 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
76 | notmuch_json_show_sanitize \
77 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
78 expected='[[[{"id": "XXXXX",
81 "timestamp": 946728000,
82 "date_relative": "2000-01-01",
83 "tags": ["inbox","signed"],
84 "headers": {"Subject": "test signed message 001",
85 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
86 "To": "test_suite@notmuchmail.org",
89 "Date": "01 Jan 2000 12:00:00 -0000"},
91 "sigstatus": [{"status": "good",
92 "fingerprint": "'$FINGERPRINT'",
94 "userid": " Notmuch Test Suite <test_suite@notmuchmail.org> (INSECURE!)"}],
95 "content-type": "multipart/signed",
97 "content-type": "text/plain",
98 "content": "This is a test signed message.\n"},
100 "content-type": "application/pgp-signature"}]}]},
106 test_begin_subtest "signature verification with signer key unavailable"
107 # this is broken with current versions of gmime-2.6
108 (ldd $(which notmuch) | grep -Fq gmime-2.6) && test_subtest_known_broken
109 # move the gnupghome temporarily out of the way
110 mv "${GNUPGHOME}"{,.bak}
111 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
112 | notmuch_json_show_sanitize \
113 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
114 expected='[[[{"id": "XXXXX",
117 "timestamp": 946728000,
118 "date_relative": "2000-01-01",
119 "tags": ["inbox","signed"],
120 "headers": {"Subject": "test signed message 001",
121 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
122 "To": "test_suite@notmuchmail.org",
125 "Date": "01 Jan 2000 12:00:00 -0000"},
127 "sigstatus": [{"status": "error",
128 "keyid": "'$(echo $FINGERPRINT | cut -c 25-)'",
130 "content-type": "multipart/signed",
131 "content": [{"id": 2,
132 "content-type": "text/plain",
133 "content": "This is a test signed message.\n"},
135 "content-type": "application/pgp-signature"}]}]},
140 mv "${GNUPGHOME}"{.bak,}
142 # create a test encrypted message with attachment
143 cat <<EOF >TESTATTACHMENT
146 test_expect_success 'emacs delivery of encrypted message with attachment' \
147 'emacs_deliver_message \
148 "test encrypted message 001" \
149 "This is a test encrypted message.\n" \
150 "(mml-attach-file \"TESTATTACHMENT\") (mml-secure-message-encrypt)"'
152 test_begin_subtest "decryption, --format=text"
153 output=$(notmuch show --format=text --decrypt subject:"test encrypted message 001" \
154 | notmuch_show_sanitize_all \
155 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
156 expected='
\fmessage{ id:XXXXX depth:0 match:1 filename:XXXXX
158 Notmuch Test Suite <test_suite@notmuchmail.org> (2000-01-01) (encrypted inbox)
159 Subject: test encrypted message 001
160 From: Notmuch Test Suite <test_suite@notmuchmail.org>
161 To: test_suite@notmuchmail.org
162 Date: 01 Jan 2000 12:00:00 -0000
165 \fpart{ ID: 1, Content-type: multipart/encrypted
166 \fpart{ ID: 2, Content-type: application/pgp-encrypted
167 Non-text part: application/pgp-encrypted
169 \fpart{ ID: 3, Content-type: multipart/mixed
170 \fpart{ ID: 4, Content-type: text/plain
171 This is a test encrypted message.
173 \fattachment{ ID: 5, Filename: TESTATTACHMENT, Content-type: application/octet-stream
174 Non-text part: application/octet-stream
184 test_begin_subtest "decryption, --format=json"
185 output=$(notmuch show --format=json --decrypt subject:"test encrypted message 001" \
186 | notmuch_json_show_sanitize \
187 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
188 expected='[[[{"id": "XXXXX",
191 "timestamp": 946728000,
192 "date_relative": "2000-01-01",
193 "tags": ["encrypted","inbox"],
194 "headers": {"Subject": "test encrypted message 001",
195 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
196 "To": "test_suite@notmuchmail.org",
199 "Date": "01 Jan 2000 12:00:00 -0000"},
201 "encstatus": [{"status": "good"}],
203 "content-type": "multipart/encrypted",
204 "content": [{"id": 2,
205 "content-type": "application/pgp-encrypted"},
207 "content-type": "multipart/mixed",
208 "content": [{"id": 4,
209 "content-type": "text/plain",
210 "content": "This is a test encrypted message.\n"},
212 "content-type": "application/octet-stream",
213 "filename": "TESTATTACHMENT"}]}]}]},
219 test_begin_subtest "decryption, --format=json, --part=4"
220 output=$(notmuch show --format=json --part=4 --decrypt subject:"test encrypted message 001" \
221 | notmuch_json_show_sanitize \
222 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
224 "content-type": "text/plain",
225 "content": "This is a test encrypted message.\n"}'
230 test_begin_subtest "decrypt attachment (--part=5 --format=raw)"
235 subject:"test encrypted message 001" >OUTPUT
236 test_expect_equal_file OUTPUT TESTATTACHMENT
238 test_begin_subtest "decryption failure with missing key"
239 mv "${GNUPGHOME}"{,.bak}
240 output=$(notmuch show --format=json --decrypt subject:"test encrypted message 001" \
241 | notmuch_json_show_sanitize \
242 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
243 expected='[[[{"id": "XXXXX",
246 "timestamp": 946728000,
247 "date_relative": "2000-01-01",
248 "tags": ["encrypted","inbox"],
249 "headers": {"Subject": "test encrypted message 001",
250 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
251 "To": "test_suite@notmuchmail.org",
254 "Date": "01 Jan 2000 12:00:00 -0000"},
256 "encstatus": [{"status": "bad"}],
257 "content-type": "multipart/encrypted",
258 "content": [{"id": 2,
259 "content-type": "application/pgp-encrypted"},
261 "content-type": "application/octet-stream"}]}]},
266 mv "${GNUPGHOME}"{.bak,}
268 test_expect_success 'emacs delivery of encrypted + signed message' \
269 'emacs_deliver_message \
270 "test encrypted message 002" \
271 "This is another test encrypted message.\n" \
272 "(mml-secure-message-sign-encrypt)"'
274 test_begin_subtest "decryption + signature verification"
275 output=$(notmuch show --format=json --decrypt subject:"test encrypted message 002" \
276 | notmuch_json_show_sanitize \
277 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
278 expected='[[[{"id": "XXXXX",
281 "timestamp": 946728000,
282 "date_relative": "2000-01-01",
283 "tags": ["encrypted","inbox"],
284 "headers": {"Subject": "test encrypted message 002",
285 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
286 "To": "test_suite@notmuchmail.org",
289 "Date": "01 Jan 2000 12:00:00 -0000"},
291 "encstatus": [{"status": "good"}],
292 "sigstatus": [{"status": "good",
293 "fingerprint": "'$FINGERPRINT'",
294 "created": 946728000,
295 "userid": " Notmuch Test Suite <test_suite@notmuchmail.org> (INSECURE!)"}],
296 "content-type": "multipart/encrypted",
297 "content": [{"id": 2,
298 "content-type": "application/pgp-encrypted"},
300 "content-type": "text/plain",
301 "content": "This is another test encrypted message.\n"}]}]},
307 test_begin_subtest "reply to encrypted message"
308 output=$(notmuch reply --decrypt subject:"test encrypted message 002" \
309 | grep -v -e '^In-Reply-To:' -e '^References:')
310 expected='From: Notmuch Test Suite <test_suite@notmuchmail.org>
311 Subject: Re: test encrypted message 002
313 On 01 Jan 2000 12:00:00 -0000, Notmuch Test Suite <test_suite@notmuchmail.org> wrote:
314 > This is another test encrypted message.'
319 test_begin_subtest "signature verification with revoked key"
320 # generate revocation certificate and load it to revoke key
323 Notmuch Test Suite key revocation (automated) $(date '+%F_%T%z')
328 | gpg --no-tty --quiet --command-fd 0 --armor --gen-revoke "0x${FINGERPRINT}!" 2>/dev/null \
329 | gpg --no-tty --quiet --import
330 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
331 | notmuch_json_show_sanitize \
332 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
333 expected='[[[{"id": "XXXXX",
336 "timestamp": 946728000,
337 "date_relative": "2000-01-01",
338 "tags": ["inbox","signed"],
339 "headers": {"Subject": "test signed message 001",
340 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
341 "To": "test_suite@notmuchmail.org",
344 "Date": "01 Jan 2000 12:00:00 -0000"},
346 "sigstatus": [{"status": "error",
347 "keyid": "6D92612D94E46381",
349 "content-type": "multipart/signed",
350 "content": [{"id": 2,
351 "content-type": "text/plain",
352 "content": "This is a test signed message.\n"},
354 "content-type": "application/pgp-signature"}]}]},