4 # - decryption/verification with signer key not available
5 # - verification of signatures from expired/revoked keys
7 test_description='PGP/MIME signature verification and decryption'
13 [ -d ${GNUPGHOME} ] && return
14 mkdir -m 0700 "$GNUPGHOME"
15 gpg --no-tty --import <$TEST_DIRECTORY/gnupg-secret-key.asc >"$GNUPGHOME"/import.log 2>&1
16 test_debug "cat $GNUPGHOME/import.log"
17 if (gpg --quick-random --version >/dev/null 2>&1) ; then
18 echo quick-random >> "$GNUPGHOME"/gpg.conf
19 elif (gpg --debug-quick-random --version >/dev/null 2>&1) ; then
20 echo debug-quick-random >> "$GNUPGHOME"/gpg.conf
24 ##################################################
28 FINGERPRINT=$(gpg --no-tty --list-secret-keys --with-colons --fingerprint | grep '^fpr:' | cut -d: -f10)
30 # for some reason this is needed for emacs_deliver_message to work,
31 # although I can't figure out why
34 test_expect_success 'emacs delivery of signed message' \
35 'emacs_deliver_message \
36 "test signed message 001" \
37 "This is a test signed message." \
38 "(mml-secure-message-sign)"'
40 test_begin_subtest "signature verification"
41 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
42 | notmuch_json_show_sanitize \
43 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
44 expected='[[[{"id": "XXXXX",
48 "timestamp": 946728000,
49 "date_relative": "2000-01-01",
50 "tags": ["inbox","signed"],
51 "headers": {"Subject": "test signed message 001",
52 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
53 "To": "test_suite@notmuchmail.org",
54 "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
56 "sigstatus": [{"status": "good",
57 "fingerprint": "'$FINGERPRINT'",
58 "created": 946728000}],
59 "content-type": "multipart/signed",
61 "content-type": "text/plain",
62 "content": "This is a test signed message.\n"},
64 "content-type": "application/pgp-signature",
65 "content-length": 315}]}]},
67 test_expect_equal_json \
71 test_begin_subtest "signature verification with full owner trust"
72 # give the key full owner trust
73 echo "${FINGERPRINT}:6:" | gpg --no-tty --import-ownertrust >>"$GNUPGHOME"/trust.log 2>&1
74 gpg --no-tty --check-trustdb >>"$GNUPGHOME"/trust.log 2>&1
75 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
76 | notmuch_json_show_sanitize \
77 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
78 expected='[[[{"id": "XXXXX",
82 "timestamp": 946728000,
83 "date_relative": "2000-01-01",
84 "tags": ["inbox","signed"],
85 "headers": {"Subject": "test signed message 001",
86 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
87 "To": "test_suite@notmuchmail.org",
88 "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
90 "sigstatus": [{"status": "good",
91 "fingerprint": "'$FINGERPRINT'",
93 "userid": " Notmuch Test Suite <test_suite@notmuchmail.org> (INSECURE!)"}],
94 "content-type": "multipart/signed",
96 "content-type": "text/plain",
97 "content": "This is a test signed message.\n"},
99 "content-type": "application/pgp-signature",
100 "content-length": 315}]}]},
102 test_expect_equal_json \
106 test_begin_subtest "signature verification with signer key unavailable"
107 # move the gnupghome temporarily out of the way
108 mv "${GNUPGHOME}"{,.bak}
109 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
110 | notmuch_json_show_sanitize \
111 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
112 expected='[[[{"id": "XXXXX",
116 "timestamp": 946728000,
117 "date_relative": "2000-01-01",
118 "tags": ["inbox","signed"],
119 "headers": {"Subject": "test signed message 001",
120 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
121 "To": "test_suite@notmuchmail.org",
122 "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
124 "sigstatus": [{"status": "error",
125 "keyid": "'$(echo $FINGERPRINT | cut -c 25-)'",
127 "content-type": "multipart/signed",
128 "content": [{"id": 2,
129 "content-type": "text/plain",
130 "content": "This is a test signed message.\n"},
132 "content-type": "application/pgp-signature",
133 "content-length": 315}]}]},
135 test_expect_equal_json \
138 mv "${GNUPGHOME}"{.bak,}
140 # create a test encrypted message with attachment
141 cat <<EOF >TESTATTACHMENT
144 test_expect_success 'emacs delivery of encrypted message with attachment' \
145 'emacs_deliver_message \
146 "test encrypted message 001" \
147 "This is a test encrypted message.\n" \
148 "(mml-attach-file \"TESTATTACHMENT\") (mml-secure-message-encrypt)"'
150 test_begin_subtest "decryption, --format=text"
151 output=$(notmuch show --format=text --decrypt subject:"test encrypted message 001" \
152 | notmuch_show_sanitize_all \
153 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
154 expected='
\fmessage{ id:XXXXX depth:0 match:1 excluded:0 filename:XXXXX
156 Notmuch Test Suite <test_suite@notmuchmail.org> (2000-01-01) (encrypted inbox)
157 Subject: test encrypted message 001
158 From: Notmuch Test Suite <test_suite@notmuchmail.org>
159 To: test_suite@notmuchmail.org
160 Date: Sat, 01 Jan 2000 12:00:00 +0000
163 \fpart{ ID: 1, Content-type: multipart/encrypted
164 \fpart{ ID: 2, Content-type: application/pgp-encrypted
165 Non-text part: application/pgp-encrypted
167 \fpart{ ID: 3, Content-type: multipart/mixed
168 \fpart{ ID: 4, Content-type: text/plain
169 This is a test encrypted message.
171 \fattachment{ ID: 5, Filename: TESTATTACHMENT, Content-type: application/octet-stream
172 Non-text part: application/octet-stream
182 test_begin_subtest "decryption, --format=json"
183 output=$(notmuch show --format=json --decrypt subject:"test encrypted message 001" \
184 | notmuch_json_show_sanitize \
185 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
186 expected='[[[{"id": "XXXXX",
190 "timestamp": 946728000,
191 "date_relative": "2000-01-01",
192 "tags": ["encrypted","inbox"],
193 "headers": {"Subject": "test encrypted message 001",
194 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
195 "To": "test_suite@notmuchmail.org",
196 "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
198 "encstatus": [{"status": "good"}],
200 "content-type": "multipart/encrypted",
201 "content": [{"id": 2,
202 "content-type": "application/pgp-encrypted",
203 "content-length": 11},
205 "content-type": "multipart/mixed",
206 "content": [{"id": 4,
207 "content-type": "text/plain",
208 "content": "This is a test encrypted message.\n"},
210 "content-type": "application/octet-stream",
211 "content-length": 28,
212 "content-transfer-encoding": "base64",
213 "filename": "TESTATTACHMENT"}]}]}]},
215 test_expect_equal_json \
219 test_begin_subtest "decryption, --format=json, --part=4"
220 output=$(notmuch show --format=json --part=4 --decrypt subject:"test encrypted message 001" \
221 | notmuch_json_show_sanitize \
222 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
224 "content-type": "text/plain",
225 "content": "This is a test encrypted message.\n"}'
226 test_expect_equal_json \
230 test_begin_subtest "decrypt attachment (--part=5 --format=raw)"
235 subject:"test encrypted message 001" >OUTPUT
236 test_expect_equal_file OUTPUT TESTATTACHMENT
238 test_begin_subtest "decryption failure with missing key"
239 mv "${GNUPGHOME}"{,.bak}
240 # The length of the encrypted attachment varies so must be normalized.
241 output=$(notmuch show --format=json --decrypt subject:"test encrypted message 001" \
242 | notmuch_json_show_sanitize \
243 | sed -e 's|"created": [1234567890]*|"created": 946728000|' \
244 | sed -e 's|"content-length": 6[1234567890]*|"content-length": 652|')
245 expected='[[[{"id": "XXXXX",
249 "timestamp": 946728000,
250 "date_relative": "2000-01-01",
251 "tags": ["encrypted","inbox"],
252 "headers": {"Subject": "test encrypted message 001",
253 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
254 "To": "test_suite@notmuchmail.org",
255 "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
257 "encstatus": [{"status": "bad"}],
258 "content-type": "multipart/encrypted",
259 "content": [{"id": 2,
260 "content-type": "application/pgp-encrypted",
261 "content-length": 11},
263 "content-type": "application/octet-stream",
264 "content-length": 652}]}]},
266 test_expect_equal_json \
269 mv "${GNUPGHOME}"{.bak,}
271 test_expect_success 'emacs delivery of encrypted + signed message' \
272 'emacs_deliver_message \
273 "test encrypted message 002" \
274 "This is another test encrypted message.\n" \
275 "(mml-secure-message-sign-encrypt)"'
277 test_begin_subtest "decryption + signature verification"
278 output=$(notmuch show --format=json --decrypt subject:"test encrypted message 002" \
279 | notmuch_json_show_sanitize \
280 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
281 expected='[[[{"id": "XXXXX",
285 "timestamp": 946728000,
286 "date_relative": "2000-01-01",
287 "tags": ["encrypted","inbox"],
288 "headers": {"Subject": "test encrypted message 002",
289 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
290 "To": "test_suite@notmuchmail.org",
291 "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
293 "encstatus": [{"status": "good"}],
294 "sigstatus": [{"status": "good",
295 "fingerprint": "'$FINGERPRINT'",
296 "created": 946728000,
297 "userid": " Notmuch Test Suite <test_suite@notmuchmail.org> (INSECURE!)"}],
298 "content-type": "multipart/encrypted",
299 "content": [{"id": 2,
300 "content-type": "application/pgp-encrypted",
301 "content-length": 11},
303 "content-type": "text/plain",
304 "content": "This is another test encrypted message.\n"}]}]},
306 test_expect_equal_json \
310 test_begin_subtest "reply to encrypted message"
311 output=$(notmuch reply --decrypt subject:"test encrypted message 002" \
312 | grep -v -e '^In-Reply-To:' -e '^References:')
313 expected='From: Notmuch Test Suite <test_suite@notmuchmail.org>
314 Subject: Re: test encrypted message 002
316 On 01 Jan 2000 12:00:00 -0000, Notmuch Test Suite <test_suite@notmuchmail.org> wrote:
317 > This is another test encrypted message.'
322 test_begin_subtest "signature verification with revoked key"
323 # generate revocation certificate and load it to revoke key
326 Notmuch Test Suite key revocation (automated) $(date '+%F_%T%z')
331 | gpg --no-tty --quiet --command-fd 0 --armor --gen-revoke "0x${FINGERPRINT}!" 2>/dev/null \
332 | gpg --no-tty --quiet --import
333 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
334 | notmuch_json_show_sanitize \
335 | sed -e 's|"created": [1234567890]*|"created": 946728000|')
336 expected='[[[{"id": "XXXXX",
340 "timestamp": 946728000,
341 "date_relative": "2000-01-01",
342 "tags": ["inbox","signed"],
343 "headers": {"Subject": "test signed message 001",
344 "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
345 "To": "test_suite@notmuchmail.org",
346 "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
348 "sigstatus": [{"status": "error",
349 "keyid": "6D92612D94E46381",
351 "content-type": "multipart/signed",
352 "content": [{"id": 2,
353 "content-type": "text/plain",
354 "content": "This is a test signed message.\n"},
356 "content-type": "application/pgp-signature",
357 "content-length": 315}]}]},
359 test_expect_equal_json \