git.notmuchmail.org Git - notmuch/blob - test/T350-crypto.sh

   1 #!/usr/bin/env bash
   2
   3 # TODO:
   4 # - decryption/verification with signer key not available
   5 # - verification of signatures from expired/revoked keys
   6
   7 test_description='PGP/MIME signature verification and decryption'
   8 . $(dirname "$0")/test-lib.sh || exit 1
   9
  10 ##################################################
  11
  12 add_gnupg_home
  13
  14 test_begin_subtest "emacs delivery of signed message"
  15 test_expect_success \
  16 'emacs_fcc_message \
  17     "test signed message 001" \
  18     "This is a test signed message." \
  19     "(mml-secure-message-sign)"'
  20
  21 test_begin_subtest "signed part content-type indexing"
  22 output=$(notmuch search mimetype:multipart/signed and mimetype:application/pgp-signature | notmuch_search_sanitize)
  23 test_expect_equal "$output" "thread:XXX   2000-01-01 [1/1] Notmuch Test Suite; test signed message 001 (inbox signed)"
  24
  25 test_begin_subtest "signature verification"
  26 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
  27     | notmuch_json_show_sanitize \
  28     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
  29 expected='[[[{"id": "XXXXX",
  30  "match": true,
  31  "excluded": false,
  32  "filename": ["YYYYY"],
  33  "timestamp": 946728000,
  34  "date_relative": "2000-01-01",
  35  "tags": ["inbox","signed"],
  36  "headers": {"Subject": "test signed message 001",
  37  "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
  38  "To": "test_suite@notmuchmail.org",
  39  "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
  40  "body": [{"id": 1,
  41  "sigstatus": [{"status": "good",
  42  "fingerprint": "'$FINGERPRINT'",
  43  "created": 946728000}],
  44  "content-type": "multipart/signed",
  45  "content": [{"id": 2,
  46  "content-type": "text/plain",
  47  "content": "This is a test signed message.\n"},
  48  {"id": 3,
  49  "content-type": "application/pgp-signature",
  50  "content-length": "NONZERO"}]}]},
  51  []]]]'
  52 test_expect_equal_json \
  53     "$output" \
  54     "$expected"
  55
  56 test_begin_subtest "detection of modified signed contents"
  57 emacs_fcc_message \
  58     "bad signed message 001" \
  59     "Incriminating stuff. This is a test signed message." \
  60     "(mml-secure-message-sign)"
  61
  62 file=$(notmuch search --output=files subject:"bad signed message 001")
  63
  64 sed -i 's/Incriminating stuff. //' ${file}
  65
  66 output=$(notmuch show --format=json --verify subject:"bad signed message 001" \
  67     | notmuch_json_show_sanitize \
  68     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
  69 expected='[[[{"id": "XXXXX",
  70  "match": true,
  71  "excluded": false,
  72  "filename": ["YYYYY"],
  73  "timestamp": 946728000,
  74  "date_relative": "2000-01-01",
  75  "tags": ["inbox","signed"],
  76  "headers": {"Subject": "bad signed message 001",
  77  "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
  78  "To": "test_suite@notmuchmail.org",
  79  "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
  80  "body": [{"id": 1,
  81  "sigstatus": [{"status": "bad",
  82  "keyid": "'$(echo $FINGERPRINT | cut -c 25-)'"}],
  83  "content-type": "multipart/signed",
  84  "content": [{"id": 2,
  85  "content-type": "text/plain",
  86  "content": "This is a test signed message.\n"},
  87  {"id": 3,
  88  "content-type": "application/pgp-signature",
  89  "content-length": "NONZERO"}]}]},
  90  []]]]'
  91 test_expect_equal_json \
  92     "$output" \
  93     "$expected"
  94
  95 test_begin_subtest "corrupted pgp/mime signature"
  96 emacs_fcc_message \
  97     "bad signed message 002" \
  98     "Incriminating stuff. This is a test signed message." \
  99     "(mml-secure-message-sign)"
 100
 101 file=$(notmuch search --output=files subject:"bad signed message 002")
 102
 103 awk '/-----BEGIN PGP SIGNATURE-----/{flag=1;print;next} \
 104      /-----END PGP SIGNATURE-----/{flag=0;print;next} \
 105      flag{gsub(/[A-Za-z]/,"0");print}!flag{print}' $file > $file.new
 106
 107 rm $file
 108 mv $file.new $file
 109
 110 output=$(notmuch show --format=json --verify subject:"bad signed message 002" \
 111     | notmuch_json_show_sanitize \
 112     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
 113 expected='[[[{"id": "XXXXX",
 114  "match": true,
 115  "excluded": false,
 116  "filename": ["YYYYY"],
 117  "timestamp": 946728000,
 118  "date_relative": "2000-01-01",
 119  "tags": ["inbox","signed"],
 120  "headers": {"Subject": "bad signed message 002",
 121  "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
 122  "To": "test_suite@notmuchmail.org",
 123  "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
 124  "body": [{"id": 1,
 125  "sigstatus": [],
 126  "content-type": "multipart/signed",
 127  "content": [{"id": 2,
 128  "content-type": "text/plain",
 129  "content": "Incriminating stuff. This is a test signed message.\n"},
 130  {"id": 3,
 131  "content-type": "application/pgp-signature",
 132  "content-length": "NONZERO"}]}]},
 133  []]]]'
 134 test_expect_equal_json \
 135     "$output" \
 136     "$expected"
 137
 138 test_begin_subtest "signature verification with full owner trust"
 139 # give the key full owner trust
 140 echo "${FINGERPRINT}:6:" | gpg --no-tty --import-ownertrust >>"$GNUPGHOME"/trust.log 2>&1
 141 gpg --no-tty --check-trustdb >>"$GNUPGHOME"/trust.log 2>&1
 142 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
 143     | notmuch_json_show_sanitize \
 144     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
 145 expected='[[[{"id": "XXXXX",
 146  "match": true,
 147  "excluded": false,
 148  "filename": ["YYYYY"],
 149  "timestamp": 946728000,
 150  "date_relative": "2000-01-01",
 151  "tags": ["inbox","signed"],
 152  "headers": {"Subject": "test signed message 001",
 153  "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
 154  "To": "test_suite@notmuchmail.org",
 155  "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
 156  "body": [{"id": 1,
 157  "sigstatus": [{"status": "good",
 158  "fingerprint": "'$FINGERPRINT'",
 159  "created": 946728000,
 160  "userid": "Notmuch Test Suite <test_suite@notmuchmail.org> (INSECURE!)"}],
 161  "content-type": "multipart/signed",
 162  "content": [{"id": 2,
 163  "content-type": "text/plain",
 164  "content": "This is a test signed message.\n"},
 165  {"id": 3,
 166  "content-type": "application/pgp-signature",
 167  "content-length": "NONZERO"}]}]},
 168  []]]]'
 169 test_expect_equal_json \
 170     "$output" \
 171     "$expected"
 172
 173 test_begin_subtest "signature verification with signer key unavailable"
 174 # move the gnupghome temporarily out of the way
 175 mv "${GNUPGHOME}"{,.bak}
 176 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
 177     | notmuch_json_show_sanitize \
 178     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
 179 expected='[[[{"id": "XXXXX",
 180  "match": true,
 181  "excluded": false,
 182  "filename": ["YYYYY"],
 183  "timestamp": 946728000,
 184  "date_relative": "2000-01-01",
 185  "tags": ["inbox","signed"],
 186  "headers": {"Subject": "test signed message 001",
 187  "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
 188  "To": "test_suite@notmuchmail.org",
 189  "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
 190  "body": [{"id": 1,
 191  "sigstatus": [{"status": "error",
 192  "keyid": "'$(echo $FINGERPRINT | cut -c 25-)'",
 193  "errors": {"key-missing": true}}],
 194  "content-type": "multipart/signed",
 195  "content": [{"id": 2,
 196  "content-type": "text/plain",
 197  "content": "This is a test signed message.\n"},
 198  {"id": 3,
 199  "content-type": "application/pgp-signature",
 200  "content-length": "NONZERO"}]}]},
 201  []]]]'
 202 test_expect_equal_json \
 203     "$output" \
 204     "$expected"
 205 mv "${GNUPGHOME}"{.bak,}
 206
 207 test_begin_subtest "emacs delivery of encrypted message with attachment"
 208 # create a test encrypted message with attachment
 209 cat <<EOF >TESTATTACHMENT
 210 This is a test file.
 211 EOF
 212 test_expect_success \
 213 'emacs_fcc_message \
 214     "test encrypted message 001" \
 215     "This is a test encrypted message.\n" \
 216     "(mml-attach-file \"TESTATTACHMENT\") (mml-secure-message-encrypt)"'
 217
 218 test_begin_subtest "encrypted part content-type indexing"
 219 output=$(notmuch search mimetype:multipart/encrypted and mimetype:application/pgp-encrypted and mimetype:application/octet-stream | notmuch_search_sanitize)
 220 test_expect_equal "$output" "thread:XXX   2000-01-01 [1/1] Notmuch Test Suite; test encrypted message 001 (encrypted inbox)"
 221
 222 test_begin_subtest "decryption, --format=text"
 223 output=$(notmuch show --format=text --decrypt=true subject:"test encrypted message 001" \
 224     | notmuch_show_sanitize_all \
 225     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
 226 expected='\fmessage{ id:XXXXX depth:0 match:1 excluded:0 filename:XXXXX
 227 \fheader{
 228 Notmuch Test Suite <test_suite@notmuchmail.org> (2000-01-01) (encrypted inbox)
 229 Subject: test encrypted message 001
 230 From: Notmuch Test Suite <test_suite@notmuchmail.org>
 231 To: test_suite@notmuchmail.org
 232 Date: Sat, 01 Jan 2000 12:00:00 +0000
 233 \fheader}
 234 \fbody{
 235 \fpart{ ID: 1, Content-type: multipart/encrypted
 236 \fpart{ ID: 2, Content-type: application/pgp-encrypted
 237 Non-text part: application/pgp-encrypted
 238 \fpart}
 239 \fpart{ ID: 3, Content-type: multipart/mixed
 240 \fpart{ ID: 4, Content-type: text/plain
 241 This is a test encrypted message.
 242 \fpart}
 243 \fattachment{ ID: 5, Filename: TESTATTACHMENT, Content-type: application/octet-stream
 244 Non-text part: application/octet-stream
 245 \fattachment}
 246 \fpart}
 247 \fpart}
 248 \fbody}
 249 \fmessage}'
 250 test_expect_equal \
 251     "$output" \
 252     "$expected"
 253
 254 test_begin_subtest "decryption, --format=json"
 255 output=$(notmuch show --format=json --decrypt=true subject:"test encrypted message 001" \
 256     | notmuch_json_show_sanitize \
 257     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
 258 expected='[[[{"id": "XXXXX",
 259  "match": true,
 260  "excluded": false,
 261  "filename": ["YYYYY"],
 262  "timestamp": 946728000,
 263  "date_relative": "2000-01-01",
 264  "tags": ["encrypted","inbox"],
 265  "headers": {"Subject": "test encrypted message 001",
 266  "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
 267  "To": "test_suite@notmuchmail.org",
 268  "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
 269  "body": [{"id": 1,
 270  "encstatus": [{"status": "good"}],
 271  "content-type": "multipart/encrypted",
 272  "content": [{"id": 2,
 273  "content-type": "application/pgp-encrypted",
 274  "content-length": "NONZERO"},
 275  {"id": 3,
 276  "content-type": "multipart/mixed",
 277  "content": [{"id": 4,
 278  "content-type": "text/plain",
 279  "content": "This is a test encrypted message.\n"},
 280  {"id": 5,
 281  "content-type": "application/octet-stream",
 282  "content-disposition": "attachment",
 283  "content-length": "NONZERO",
 284  "content-transfer-encoding": "base64",
 285  "filename": "TESTATTACHMENT"}]}]}]},
 286  []]]]'
 287 test_expect_equal_json \
 288     "$output" \
 289     "$expected"
 290
 291 test_begin_subtest "decryption, --format=json, --part=4"
 292 output=$(notmuch show --format=json --part=4 --decrypt=true subject:"test encrypted message 001" \
 293     | notmuch_json_show_sanitize \
 294     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
 295 expected='{"id": 4,
 296  "content-type": "text/plain",
 297  "content": "This is a test encrypted message.\n"}'
 298 test_expect_equal_json \
 299     "$output" \
 300     "$expected"
 301
 302 test_begin_subtest "decrypt attachment (--part=5 --format=raw)"
 303 notmuch show \
 304     --format=raw \
 305     --part=5 \
 306     --decrypt=true \
 307     subject:"test encrypted message 001" >OUTPUT
 308 test_expect_equal_file TESTATTACHMENT OUTPUT
 309
 310 test_begin_subtest "decryption failure with missing key"
 311 mv "${GNUPGHOME}"{,.bak}
 312 output=$(notmuch show --format=json --decrypt=true subject:"test encrypted message 001" \
 313     | notmuch_json_show_sanitize \
 314     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
 315 expected='[[[{"id": "XXXXX",
 316  "match": true,
 317  "excluded": false,
 318  "filename": ["YYYYY"],
 319  "timestamp": 946728000,
 320  "date_relative": "2000-01-01",
 321  "tags": ["encrypted","inbox"],
 322  "headers": {"Subject": "test encrypted message 001",
 323  "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
 324  "To": "test_suite@notmuchmail.org",
 325  "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
 326  "body": [{"id": 1,
 327  "encstatus": [{"status": "bad"}],
 328  "content-type": "multipart/encrypted",
 329  "content": [{"id": 2,
 330  "content-type": "application/pgp-encrypted",
 331  "content-length": "NONZERO"},
 332  {"id": 3,
 333  "content-type": "application/octet-stream",
 334  "content-length": "NONZERO"}]}]},
 335  []]]]'
 336 test_expect_equal_json \
 337     "$output" \
 338     "$expected"
 339 mv "${GNUPGHOME}"{.bak,}
 340
 341 test_begin_subtest "emacs delivery of encrypted + signed message"
 342 test_expect_success \
 343 'emacs_fcc_message \
 344     "test encrypted message 002" \
 345     "This is another test encrypted message.\n" \
 346     "(mml-secure-message-sign-encrypt)"'
 347
 348 test_begin_subtest "decryption + signature verification"
 349 output=$(notmuch show --format=json --decrypt=true subject:"test encrypted message 002" \
 350     | notmuch_json_show_sanitize \
 351     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
 352 expected='[[[{"id": "XXXXX",
 353  "match": true,
 354  "excluded": false,
 355  "filename": ["YYYYY"],
 356  "timestamp": 946728000,
 357  "date_relative": "2000-01-01",
 358  "tags": ["encrypted","inbox"],
 359  "headers": {"Subject": "test encrypted message 002",
 360  "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
 361  "To": "test_suite@notmuchmail.org",
 362  "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
 363  "body": [{"id": 1,
 364  "encstatus": [{"status": "good"}],
 365  "sigstatus": [{"status": "good",
 366  "fingerprint": "'$FINGERPRINT'",
 367  "created": 946728000,
 368  "userid": "Notmuch Test Suite <test_suite@notmuchmail.org> (INSECURE!)"}],
 369  "content-type": "multipart/encrypted",
 370  "content": [{"id": 2,
 371  "content-type": "application/pgp-encrypted",
 372  "content-length": "NONZERO"},
 373  {"id": 3,
 374  "content-type": "text/plain",
 375  "content": "This is another test encrypted message.\n"}]}]},
 376  []]]]'
 377 test_expect_equal_json \
 378     "$output" \
 379     "$expected"
 380
 381 test_begin_subtest "reply to encrypted message"
 382 output=$(notmuch reply --decrypt=true subject:"test encrypted message 002" \
 383     | notmuch_drop_mail_headers In-Reply-To References)
 384 expected='From: Notmuch Test Suite <test_suite@notmuchmail.org>
 385 Subject: Re: test encrypted message 002
 386 To: test_suite@notmuchmail.org
 387
 388 On 01 Jan 2000 12:00:00 -0000, Notmuch Test Suite <test_suite@notmuchmail.org> wrote:
 389 > This is another test encrypted message.'
 390 test_expect_equal \
 391     "$output" \
 392     "$expected"
 393
 394 test_begin_subtest "Reply within emacs to an encrypted message"
 395 test_emacs "(let ((message-hidden-headers '())
 396       (notmuch-crypto-process-mime 't))
 397   (notmuch-show \"subject:test.encrypted.message.002\")
 398   (notmuch-show-reply)
 399   (test-output))"
 400 grep -v -e '^In-Reply-To:' -e '^References:' -e '^Fcc:' < OUTPUT > OUTPUT.clean
 401 cat <<EOF >EXPECTED
 402 From: Notmuch Test Suite <test_suite@notmuchmail.org>
 403 To: test_suite@notmuchmail.org
 404 Subject: Re: test encrypted message 002
 405 --text follows this line--
 406 <#secure method=pgpmime mode=signencrypt>
 407 Notmuch Test Suite <test_suite@notmuchmail.org> writes:
 408
 409 > This is another test encrypted message.
 410 EOF
 411 test_expect_equal_file EXPECTED OUTPUT.clean
 412
 413 test_begin_subtest "signature verification with revoked key"
 414 # generate revocation certificate and load it to revoke key
 415 echo "y
 416 1
 417 Notmuch Test Suite key revocation (automated) $(date '+%F_%T%z')
 418
 419 y
 420
 421 " \
 422     | gpg --no-tty --quiet --command-fd 0 --armor --gen-revoke "0x${FINGERPRINT}!" 2>/dev/null \
 423     | gpg --no-tty --quiet --import
 424 output=$(notmuch show --format=json --verify subject:"test signed message 001" \
 425     | notmuch_json_show_sanitize \
 426     | sed -e 's|"created": [1234567890]*|"created": 946728000|')
 427 expected='[[[{"id": "XXXXX",
 428  "match": true,
 429  "excluded": false,
 430  "filename": ["YYYYY"],
 431  "timestamp": 946728000,
 432  "date_relative": "2000-01-01",
 433  "tags": ["inbox","signed"],
 434  "headers": {"Subject": "test signed message 001",
 435  "From": "Notmuch Test Suite <test_suite@notmuchmail.org>",
 436  "To": "test_suite@notmuchmail.org",
 437  "Date": "Sat, 01 Jan 2000 12:00:00 +0000"},
 438  "body": [{"id": 1,
 439  "sigstatus": [{"status": "error",
 440  "keyid": "6D92612D94E46381",
 441  "errors": {"key-revoked": true}}],
 442  "content-type": "multipart/signed",
 443  "content": [{"id": 2,
 444  "content-type": "text/plain",
 445  "content": "This is a test signed message.\n"},
 446  {"id": 3,
 447  "content-type": "application/pgp-signature",
 448  "content-length": "NONZERO"}]}]},
 449  []]]]'
 450 test_expect_equal_json \
 451     "$output" \
 452     "$expected"
 453
 454 test_done