diff options
| author | Daniel Kahn Gillmor <dkg@fifthhorseman.net> | 2017-12-08 01:24:02 -0500 |
|---|---|---|
| committer | David Bremner <david@tethera.net> | 2017-12-08 08:08:47 -0400 |
| commit | fccebbaeef1e4b6489425afb13f419543d53d285 (patch) | |
| tree | ca92f729931994c2fd6f290c25092b35618cd9c9 /test | |
| parent | 29648a137c5807135ab168917b4a51d5e19e51c2 (diff) | |
crypto: add --decrypt=nostash to avoid stashing session keys
Here's the configuration choice for people who want a cleartext index,
but don't want stashed session keys.
Interestingly, this "nostash" decryption policy is actually the same
policy that should be used by "notmuch show" and "notmuch reply",
since they never modify the index or database when they are invoked
with --decrypt.
We take advantage of this parallel to tune the behavior of those
programs so that we're not requesting session keys from GnuPG during
"show" and "reply" that we would then otherwise just throw away.
Diffstat (limited to 'test')
| -rwxr-xr-x | test/T357-index-decryption.sh | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/test/T357-index-decryption.sh b/test/T357-index-decryption.sh index fcecb1d9..6b8a8261 100755 --- a/test/T357-index-decryption.sh +++ b/test/T357-index-decryption.sh @@ -188,6 +188,29 @@ test_expect_equal \ "$output" \ "$expected" +test_begin_subtest "index cleartext without keeping session keys" +test_expect_success "notmuch reindex --decrypt=nostash tag:blarney" + +test_begin_subtest "Ensure that the indexed terms are present" +output=$(notmuch search wumpus) +test_expect_equal \ + "$output" \ + "$expected" + +test_begin_subtest "show one of the messages with --decrypt" +output=$(notmuch show --decrypt thread:0000000000000001 | awk '/^\014part}/{ f=0 }; { if (f) { print $0 } } /^\014part{ ID: 3/{ f=1 }') +expected='This is a test encrypted message with a wumpus.' +test_expect_equal \ + "$output" \ + "$expected" + +test_begin_subtest "Ensure that we cannot show the message without --decrypt" +output=$(notmuch show thread:0000000000000001 | awk '/^\014part}/{ f=0 }; { if (f) { print $0 } } /^\014part{ ID: 3/{ f=1 }') +expected='Non-text part: application/octet-stream' +test_expect_equal \ + "$output" \ + "$expected" + add_email_corpus crypto test_begin_subtest "indexing message fails when secret key not available" |