3 months agotest: add known broken for n_m_get_flag on closed db
David Bremner [Sat, 4 Jul 2020 14:22:25 +0000 (11:22 -0300)]
test: add known broken for n_m_get_flag on closed db

Exception caught in next commit. Note that FLAG_GHOST is the only one
that triggers the I/O code path.

3 months agolib: catch exceptions in n_m_get_filenames
David Bremner [Sat, 4 Jul 2020 14:09:09 +0000 (11:09 -0300)]
lib: catch exceptions in n_m_get_filenames

This is essentially copied from the change to notmuch_message_get_filename

3 months agotest: add known broken test for n_m_get_filenames
David Bremner [Sat, 4 Jul 2020 14:06:37 +0000 (11:06 -0300)]
test: add known broken test for n_m_get_filenames

This will be fixed in the next commit

3 months agolib/n_m_g_filename: catch Xapian exceptions, document NULL return
David Bremner [Sat, 4 Jul 2020 12:20:31 +0000 (09:20 -0300)]
lib/n_m_g_filename: catch Xapian exceptions, document NULL return

This is the same machinery as applied for


3 months agolib: add known broken test for notmuch_message_get_filename
David Bremner [Sat, 4 Jul 2020 12:16:30 +0000 (09:16 -0300)]
lib: add known broken test for notmuch_message_get_filename

This will be fixed in the next commit

3 months agolib/n_m_get_replies: doc return, initial regression test
David Bremner [Sat, 4 Jul 2020 12:09:09 +0000 (09:09 -0300)]
lib/n_m_get_replies: doc return, initial regression test

We need to to set a query and retrieve the threads to meaningfully
test this function.

3 months agotest: add regression test for n_m_get_header
David Bremner [Sat, 4 Jul 2020 11:35:08 +0000 (08:35 -0300)]
test: add regression test for n_m_get_header

This function already catches Xapian exceptions, and we want to make
sure it stays that way.

3 months agolib/message: use LOG_XAPIAN_EXCEPTION in n_m_get_header
David Bremner [Sat, 4 Jul 2020 11:33:41 +0000 (08:33 -0300)]
lib/message: use LOG_XAPIAN_EXCEPTION in n_m_get_header

This is just for consistency, and a small reduction in the amount of

3 months agotest: drop use of assert in closed db tests
David Bremner [Sat, 4 Jul 2020 12:29:41 +0000 (09:29 -0300)]
test: drop use of assert in closed db tests

Instead of printing the same static string for each test, can replace
the assert with something simpler (or at least easier to integrate
into the test suite).

3 months agotest: remove unused backup_database calls
David Bremner [Sat, 4 Jul 2020 11:12:21 +0000 (08:12 -0300)]
test: remove unused backup_database calls

Since these backups are never restored, they should be safe to remove.

3 months agodebian: drop ValueRangeProcessor symbols
David Bremner [Sat, 11 Jul 2020 22:52:21 +0000 (19:52 -0300)]
debian: drop ValueRangeProcessor symbols

These are not used since b90d852

3 months agotest: drop upgrade from v1 tests
David Bremner [Tue, 7 Jul 2020 10:56:47 +0000 (07:56 -0300)]
test: drop upgrade from v1 tests

These are less crucial since we stopped generating new database
versions and relied primarily on features. They also rely on a
pre-generated v1 database which happens to be chert format. This
backend is not supported by Xapian 1.5.

Also drop the tool, which is currently broken, due to
changes in the testing infrastructure.

3 months agolib: migrate from Xapian ValueRangeProcessor to RangeProcessor
David Bremner [Tue, 7 Jul 2020 10:56:46 +0000 (07:56 -0300)]
lib: migrate from Xapian ValueRangeProcessor to RangeProcessor

This will be mandatory as of Xapian 1.5.  The API is also more
consistent with the FieldProcessor API, which helps code re-use a bit.

Note that this switches to using the built-in Xapian support for
prefixes on ranges (i.e. deleted code at beginning of
ParseTimeRangeProcessor::operator(), added prefix to constructor).

Another side effect of the migration is that we are generating smaller
queries, using one OP_VALUE_RANGE instead of an AND of two OP_VALUE_*

3 months agolib: migrate to post Xapian 1.3.4 compact support
David Bremner [Tue, 7 Jul 2020 10:56:45 +0000 (07:56 -0300)]
lib: migrate to post Xapian 1.3.4 compact support

The old API was deprecated in Xapian 1.3.4 and (will be) removed in 1.5.0

3 months agodoc: make gzipped man pages reproducible
Jonas Witschel [Sat, 11 Jul 2020 16:04:35 +0000 (18:04 +0200)]
doc: make gzipped man pages reproducible

gzip includes the name of the uncompressed file and its modification
timestamp into the compressed archive. The latter makes it hard to
reproduce the generated files bit for bit at a later time, so omit this
information from the archive using the "--no-name" option. This is a
reproducibility best practice, see

3 months agoMerge branch 'release'
David Bremner [Sat, 11 Jul 2020 02:24:41 +0000 (23:24 -0300)]
Merge branch 'release'

3 months agoNEWS: update date for release 0.30 archive/debian/0.30-1 debian/0.30-1
David Bremner [Sat, 11 Jul 2020 01:25:04 +0000 (22:25 -0300)]
NEWS: update date for release

3 months agodebian: changelog for 0.30
David Bremner [Sat, 11 Jul 2020 01:24:41 +0000 (22:24 -0300)]
debian: changelog for 0.30

3 months agoversion: set to 0.30
David Bremner [Sat, 11 Jul 2020 01:21:19 +0000 (22:21 -0300)]
version: set to 0.30

3 months agolib/message: catch exception in n_m_get_thread_id
David Bremner [Tue, 30 Jun 2020 01:14:11 +0000 (22:14 -0300)]
lib/message: catch exception in n_m_get_thread_id

This allows us to return an error value from the library.

3 months agotest: add known broken test for n_m_get_thread_id on closed db
David Bremner [Tue, 30 Jun 2020 01:14:10 +0000 (22:14 -0300)]
test: add known broken test for n_m_get_thread_id on closed db

This will be fixed in the next commit.

3 months agolib: catch error from closed db in n_m_get_message_id
David Bremner [Tue, 30 Jun 2020 01:14:09 +0000 (22:14 -0300)]
lib: catch error from closed db in n_m_get_message_id

By catching it at the library top level, we can return an error value.

3 months agotest: add known broken test for error handling on closed database
David Bremner [Tue, 30 Jun 2020 01:14:08 +0000 (22:14 -0300)]
test: add known broken test for error handling on closed database

Based on

3 months agobuild: produce signatures for release candidate tarballs. 0.30_rc3 debian/0.30_rc3-1
David Bremner [Tue, 16 Jun 2020 14:17:55 +0000 (11:17 -0300)]
build: produce signatures for release candidate tarballs.

Today Defalos on #notmuch asked for a signed tarball for
0.30~rc2. This is a minimal change to support this in the future.  The
question of automagically uploading will need more thought; currently
I like the fact that tags from pre-releases are only pushed manually.

3 months agotest: fix python 3.8.4 related regression in T210-raw
David Bremner [Fri, 3 Jul 2020 10:23:32 +0000 (07:23 -0300)]
test: fix python 3.8.4 related regression in T210-raw

It seems (at least in 3.8.4~rc1-1 on Debian) that set_content requires
at least one line.

3 months agodebian: changelog fo 0.30~rc3-1
David Bremner [Fri, 3 Jul 2020 09:50:16 +0000 (06:50 -0300)]
debian: changelog fo 0.30~rc3-1

3 months agoversion: bump to 0.30~rc3
David Bremner [Fri, 3 Jul 2020 09:45:17 +0000 (06:45 -0300)]
version: bump to 0.30~rc3

3 months agobindings/python-cffi: copy version file into bindings dir
David Bremner [Tue, 30 Jun 2020 00:22:47 +0000 (21:22 -0300)]
bindings/python-cffi: copy version file into bindings dir

Attempt to avoid breaking "pip install ."

As far as I can tell, we need to have a copy (not just a relative
symlink) of the version file.

3 months agodoc: update install suggestions for fedora derivatives
David Bremner [Fri, 26 Jun 2020 11:11:00 +0000 (08:11 -0300)]
doc: update install suggestions for fedora derivatives

Fedora still has an old gmime-devel which is 2.6.x. This is no longer
supported by notmuch. Also apparently dnf is a better choice than yum.

3 months agotests: mark sig verification known-broken with session keys on buggy gpgme
Daniel Kahn Gillmor [Thu, 2 Jul 2020 18:00:49 +0000 (14:00 -0400)]
tests: mark sig verification known-broken with session keys on buggy gpgme

We make use of the just-introduced configure test.

Signed-off-by: Daniel Kahn Gillmor <>
3 months agoconfigure: can gpgme can verify signatures when decrypting with a session key?
Daniel Kahn Gillmor [Thu, 2 Jul 2020 18:00:48 +0000 (14:00 -0400)]
configure: can gpgme can verify signatures when decrypting with a session key?

If is unresolved in the version of gpgme
we are testing against, then we should know about it, because it
affects the behavior of notmuch.

Signed-off-by: Daniel Kahn Gillmor <>
3 months agotest: mark two tests broken on machines with 32 bit time_t
David Bremner [Wed, 24 Jun 2020 14:32:34 +0000 (11:32 -0300)]
test: mark two tests broken on machines with 32 bit time_t

I haven't traced the code path as exhaustively for the SMIME test, but
the expiry date in question is larger then representable in a signed
32 bit integer.

3 months agoconfigure: detect 64 bit time_t
David Bremner [Wed, 24 Jun 2020 14:32:33 +0000 (11:32 -0300)]
configure: detect 64 bit time_t

Certain tests involving timestamps > 32 bits cannot pass with the
current libnotmuch API. We will avoid this issue for now by disabling
those tests on "old" architectures with 32 bit time_t.

3 months drop -std=gnu99. C11 (or later) compiler required
Tomi Ollila [Wed, 24 Jun 2020 20:11:20 +0000 (23:11 +0300)] drop -std=gnu99. C11 (or later) compiler required

Since October 2018 building notmuch has actually required compiler
that knows C11.

Also this -std=gnu99 was not used in code compiled by configure,
so in theory this could have caused problems...

...but no related reports have been sent, perhaps ever.

Both gcc and clang has been shipping compilers supporting C11
(or later) by default for more than four years now.

Therefore, just dropping -std=gnu99 (and not checking C11
compatibility for now, for simplicity) is easiest to do,
and removes inconsistency between configure and build time

4 months agopython-cffi: read version from notmuch version file
Floris Bruynooghe [Fri, 19 Jun 2020 09:46:28 +0000 (11:46 +0200)]
python-cffi: read version from notmuch version file

This keeps it in sync with the main notmuch version which is less
confusing to users.

4 months agodebian: changelog stanza for 0.30~rc2-1 archive/debian/0.30_rc2-1 debian/0.30_rc2-1
David Bremner [Tue, 16 Jun 2020 11:32:51 +0000 (08:32 -0300)]
debian: changelog stanza for 0.30~rc2-1

4 months agoversion: update to 0.30~rc2
David Bremner [Tue, 16 Jun 2020 11:29:39 +0000 (08:29 -0300)]
version: update to 0.30~rc2

4 months agodebian/copyright: update to match AUTHORS
David Bremner [Tue, 16 Jun 2020 11:28:08 +0000 (08:28 -0300)]
debian/copyright: update to match AUTHORS

4 months agoupdate AUTHORS
David Bremner [Tue, 16 Jun 2020 11:26:55 +0000 (08:26 -0300)]
update AUTHORS

Yay, we gained a new author, thanks Anton.

4 months agoSupport aborting the atomic context
Floris Bruynooghe [Sun, 14 Jun 2020 15:23:19 +0000 (17:23 +0200)]
Support aborting the atomic context

Since it is possible to use an atomic context to abort a number of
changes support this usage.  Because the only way to actually abort
the transaction is to close the database this must also do so.

Amended by db: Note the limitation requiring close is a limitation of
the underlying notmuch API, which should be fixed in a future notmuch

4 months agoMake messages returned by Thread objects owned
Floris Bruynooghe [Mon, 15 Jun 2020 20:58:50 +0000 (22:58 +0200)]
Make messages returned by Thread objects owned

This reverses the logic of StandaloneMessage to instead create a
OwnedMessage.  Only the Thread class allows retrieving messages more
then once so it can explicitly create such messages.

The added test fails with SIGABRT without the fix for the message
re-use in threads being present.

4 months agopython/notmuch2: do not destroy messages owned by a query
Anton Khirnov [Mon, 15 Jun 2020 20:58:49 +0000 (22:58 +0200)]
python/notmuch2: do not destroy messages owned by a query

Any messages retrieved from a query - either directly via
search_messages() or indirectly via thread objects - are owned by that
query. Retrieving the same message (i.e. corresponding to the same
message ID / database object) several times will always yield the same
C object.

The caller is allowed to destroy message objects owned by a query before
the query itself - which can save memory for long-lived queries.
However, that message must then never be retrieved again from that

The python-notmuch2 bindings will currently destroy every message object
in Message._destroy(), which will lead to an invalid free if the same
message is then retrieved again. E.g. the following python program leads
to libtalloc abort()ing:

import notmuch2
db   = notmuch2.Database(mode = notmuch2.Database.MODE.READ_ONLY)
t    = next(db.threads('*'))
msgs = list(zip(t.toplevel(), t.toplevel()))
msgs = list(zip(t.toplevel(), t.toplevel()))

Fix this issue by creating a subclass of Message, which is used for
"standalone" message which have to be freed by the caller. Message class
is then used only for messages descended from a query, which do not need
to be freed by the caller.

4 months agopython config access: fix style and KeyError bug
Floris Bruynooghe [Mon, 15 Jun 2020 21:55:53 +0000 (23:55 +0200)]
python config access: fix style and KeyError bug

This fixes some minor style/pep8 things and adds tests for the new
config support.  Also fixes a bug where KeyError was never raised
on a missing key.

4 months agopython/notmuch2: add bindings for the database config strings
Anton Khirnov [Mon, 15 Jun 2020 21:55:52 +0000 (23:55 +0200)]
python/notmuch2: add bindings for the database config strings

4 months agoUpdate tox.ini for python3.8 and fix pypy3.6
Floris Bruynooghe [Sun, 14 Jun 2020 19:25:46 +0000 (21:25 +0200)]
Update tox.ini for python3.8 and fix pypy3.6

Python 3.8 has been released for a while now, make sure we keep
supporting it correctly.

PyPy 3.6 wasn not configured correctly.

4 months agoAdd missing set methods to tagsets
Floris Bruynooghe [Sun, 14 Jun 2020 18:33:55 +0000 (20:33 +0200)]
Add missing set methods to tagsets

Even though we use which implements all these
methods under their operator names, the actual named variations of
these methods are shockingly missing.  So let's add them manually.

4 months agoconfigure: use cffi.FFI().verify() to test buildability of CFFI bindings
Tomi Ollila [Tue, 9 Jun 2020 12:32:27 +0000 (15:32 +0300)]
configure: use cffi.FFI().verify() to test buildability of CFFI bindings

Checking existence of pyconfig.h to determine whether CFFI-based
notmuch bindings are buildable is not enough; for example Fedora 32
ships pyconfig.h in python3-libs package, but python3-devel is required
to be installed for the bindings to build.

Executing cffi.FFI().verify() is pretty close to what is done in
bindings/python-cffi/notmuch2/ to get the c code part of the
bindings built.

4 months agodebian: changelog stanza for 0.30~rc1-1 0.30_rc1 archive/debian/0.30_rc1-1 debian/0.30_rc1-1
David Bremner [Sat, 6 Jun 2020 11:03:25 +0000 (08:03 -0300)]
debian: changelog stanza for 0.30~rc1-1

4 months agoversion: bump to 0.30~rc1
David Bremner [Sat, 6 Jun 2020 11:02:16 +0000 (08:02 -0300)]
version: bump to 0.30~rc1

4 months agoemacs docstrings: consistent indentation, newlines, periods
Tomi Ollila [Sun, 24 May 2020 19:17:56 +0000 (22:17 +0300)]
emacs docstrings: consistent indentation, newlines, periods

Fixed emacs docstrings to be consistent. No functional change.

- removed some (accidental) indentation
- removed some trailing newlines
- added trailing periods where missing (some exclusions)

4 months agodoc: field processor support now always included, adjust manual pages
Tomi Ollila [Tue, 2 Jun 2020 20:21:59 +0000 (23:21 +0300)]
doc: field processor support now always included, adjust manual pages

The features that require field processor support, are now just
documented w/o mentioning **Xapian Field Processors**' is needed
for those.

Replaced "compact" and "field_processor" with "retry_lock" in
build_with config option, as it is currently the only one that
is optionally excluded. The former 2 are now documented as
features always included.

Dropped one 'we' "passive" in notmuch-search-terms.rst. It was the
only one, and inconsistent with rest of the documentation in that

Dropped message about conditional open-ended ranges support, as
those are now always supported.

4 months agoconfigure: require python 3.5 for CFFI-based notmuch bindings
Tomi Ollila [Fri, 5 Jun 2020 21:57:55 +0000 (00:57 +0300)]
configure: require python 3.5 for CFFI-based notmuch bindings

Also tell users what the consequences of a "No" answer is when
python version is less than 3.5, cffi or setuptools is missing,
or no pytest >= 3.0 is available.

4 months agodebian: update debian/copyright
David Bremner [Thu, 4 Jun 2020 11:53:27 +0000 (08:53 -0300)]
debian: update debian/copyright

This is based on the updated AUTHORS file.

4 months agodoc: update AUTHORS file
David Bremner [Thu, 4 Jun 2020 11:36:39 +0000 (08:36 -0300)]
doc: update AUTHORS file

I tried to be inclusive, and did not delete anyone from Carl's
original file. I also reworded the acknowledgement of Google LLC.

4 months agodevel: script to calculate a list of authors.
David Bremner [Wed, 3 Jun 2020 16:05:12 +0000 (13:05 -0300)]
devel: script to calculate a list of authors.

As an initial heuristic, report anyone with at least 15 lines of code
in the current source tree. Test corpora are excluded, although
probabably this doesn't change much about the list of authors

4 months agotweaks to NEWS suggest by Tomi
David Bremner [Fri, 5 Jun 2020 09:58:31 +0000 (06:58 -0300)]
tweaks to NEWS suggest by Tomi


4 months agoNEWS: The minimum supported version of Xapian is now 1.4.0
Tomi Ollila [Thu, 4 Jun 2020 19:38:35 +0000 (22:38 +0300)]
NEWS: The minimum supported version of Xapian is now 1.4.0

4 months agoadd NEWS for 0.30
Daniel Kahn Gillmor [Tue, 2 Jun 2020 01:54:56 +0000 (21:54 -0400)]
add NEWS for 0.30

Signed-off-by: Daniel Kahn Gillmor <>
4 months agodebian: bump debian revision archive/debian/0.30_rc0-2 debian/0.30_rc0-2
David Bremner [Tue, 2 Jun 2020 02:16:09 +0000 (23:16 -0300)]
debian: bump debian revision

second, with binaries upload

4 months agodebian: Add build dependency on doxygen 0.30_rc0 archive/debian/0.30_rc0-1 debian/0.30_rc0-1
David Bremner [Tue, 2 Jun 2020 00:38:02 +0000 (21:38 -0300)]
debian: Add build dependency on doxygen

4 months agodebian: add desktop-file-utils dependency
David Bremner [Tue, 2 Jun 2020 00:32:23 +0000 (21:32 -0300)]
debian: add desktop-file-utils dependency

This enables installation of notmuch-emacs-mua.desktop

4 months agoNEWS: stub for 0.30
David Bremner [Tue, 2 Jun 2020 00:09:28 +0000 (21:09 -0300)]
NEWS: stub for 0.30

4 months agodebian: add changelog for release candidate
David Bremner [Tue, 2 Jun 2020 00:03:06 +0000 (21:03 -0300)]
debian: add changelog for release candidate

4 months agoversion: bump to 0.30~rc0
David Bremner [Tue, 2 Jun 2020 00:00:04 +0000 (21:00 -0300)]
version: bump to 0.30~rc0

4 months agobump date in documentation
David Bremner [Mon, 1 Jun 2020 23:58:52 +0000 (20:58 -0300)]
bump date in documentation

4 months agodoc: fix for out-of-tree builds of notmuch-emacs docs
David Bremner [Sun, 31 May 2020 16:15:03 +0000 (13:15 -0300)]
doc: fix for out-of-tree builds of notmuch-emacs docs

The sphinx-doc include directive does not have the ability to include
files from the build tree, so we replace the include with reading the
files in The non-trivial downside of this is that the emacs
docstrings are now defined for every rst source file. They are
namespaced with docstring::, so hopefully there will not be any
surprises. One thing that is noticable is a small (absolute) time
penalty in running sphinx-doc.

4 months agoconfigure: check existence of python3 setuptools and dev package
Tomi Ollila [Mon, 1 Jun 2020 05:31:42 +0000 (08:31 +0300)]
configure: check existence of python3 setuptools and dev package

The notmuch2 CFFI-based Python interface is not buildable unless
python3 dev package and python3 setuptools are installed.

Check that these exist in configure (and disable notmuch2 bindings
build if not) so that build of these bindings don't fail when make(1)
is executed.

4 months agoemacs: Respect `load-prefer-newer` when loading `notmuch-init-file'
Sean Whitton [Mon, 1 Jun 2020 06:17:04 +0000 (23:17 -0700)]
emacs: Respect `load-prefer-newer` when loading `notmuch-init-file'

Before this change, `load-prefer-newer' was ignored.

Set NOERROR and MUST-SUFFIX arguments of `load' to t, and NOSUFFIX
argument to nil, to preserve the behaviour of the deleted `let' form.

4 months agotests/ruby: Ensure that test works for out-of-tree builds
Daniel Kahn Gillmor [Tue, 26 May 2020 17:06:02 +0000 (13:06 -0400)]
tests/ruby: Ensure that test works for out-of-tree builds

4 months agopython-cffi: enable out-of-tree builds
Daniel Kahn Gillmor [Fri, 22 May 2020 01:03:59 +0000 (21:03 -0400)]
python-cffi: enable out-of-tree builds

This is a simple hack to enable out-of-tree builds, a concern raised
by Tomi in

This change at least enables "make check" to complete without error,
but I'm sure it could be improved.  I am not expert enough in
setuptools to know how.

Signed-off-by: Daniel Kahn Gillmor <>
Amended by db per

4 months agotest/ fix two out of tree test issues
Tomi Ollila [Thu, 23 Apr 2020 21:26:43 +0000 (00:26 +0300)]
test/ fix two out of tree test issues exists in source tree, not in out of tree
build tree. Added -B to the execution so source tree is not
"polluted" by a .pyc file when is executed.

When creating make it load .elc files from out of
tree build tree, not from source tree if such files existed.
If existed, those may be outdated, or even created by some other
emacs than the one that was used to build .elc files in out of
tree build dir.

4 months agoemacs: Use `dolist' instead of `mapcar' for side-effects
Jonas Bernoulli [Sat, 25 Apr 2020 20:18:09 +0000 (22:18 +0200)]
emacs: Use `dolist' instead of `mapcar' for side-effects

As recommended by the byte-compiler.

5 months agosmime: Index cleartext of envelopedData when requested
Daniel Kahn Gillmor [Tue, 12 May 2020 22:29:39 +0000 (18:29 -0400)]
smime: Index cleartext of envelopedData when requested

Signed-off-by: Daniel Kahn Gillmor <>
5 months agosmime: Pass PKCS#7 envelopedData to node_decrypt_and_verify
Daniel Kahn Gillmor [Tue, 12 May 2020 22:29:38 +0000 (18:29 -0400)]
smime: Pass PKCS#7 envelopedData to node_decrypt_and_verify

This change means we can support "notmuch show --decrypt=true" for
S/MIME encrypted messages, resolving several outstanding broken tests,
including all the remaining S/MIME protected header examples.

We do not yet handle indexing the cleartext of S/MIME encrypted
messages, though.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agocrypto: handle PKCS#7 envelopedData in _notmuch_crypto_decrypt
Daniel Kahn Gillmor [Tue, 12 May 2020 22:29:37 +0000 (18:29 -0400)]
crypto: handle PKCS#7 envelopedData in _notmuch_crypto_decrypt

In the two places where _notmuch_crypto_decrypt handles
multipart/encrypted messages (PGP/MIME), we should also handle PKCS#7
envelopedData (S/MIME).

This is insufficient for fully handling S/MIME encrypted data because
_notmuch_crypto_decrypt isn't yet actually invoked for envelopedData
parts, but that will happen in the following changes.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agocrypto: Make _notmuch_crypto_decrypt take a GMimeObject
Daniel Kahn Gillmor [Tue, 12 May 2020 22:29:36 +0000 (18:29 -0400)]
crypto: Make _notmuch_crypto_decrypt take a GMimeObject

As we prepare to handle S/MIME-encrypted PKCS#7 EnvelopedData (which
is not multipart), we don't want to be limited to passing only
GMimeMultipartEncrypted MIME parts to _notmuch_crypto_decrypt.

There is no functional change here, just a matter of adjusting how we
pass arguments internally.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agocli/reply: Ignore PKCS#7 wrapper parts when replying
Daniel Kahn Gillmor [Tue, 12 May 2020 22:29:35 +0000 (18:29 -0400)]
cli/reply: Ignore PKCS#7 wrapper parts when replying

When composing a reply, no one wants to see this line in the proposed

    Non-text part: application/pkcs7-mime

So we hide it, the same way we hide PGP/MIME cruft.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agocli/show: If a leaf part has children, show them instead of omitting
Daniel Kahn Gillmor [Tue, 12 May 2020 22:29:34 +0000 (18:29 -0400)]
cli/show: If a leaf part has children, show them instead of omitting

Until we did PKCS#7 unwrapping, no leaf MIME part could have a child.

Now, we treat the unwrapped MIME part as the child of the PKCS#7
SignedData object.  So in that case, we want to show it instead of
deliberately omitting the content.

This fixes the test of the protected subject in

Signed-off-by: Daniel Kahn Gillmor <>
5 months agocli: include wrapped part of PKCS#7 SignedData in the MIME tree
Daniel Kahn Gillmor [Tue, 12 May 2020 22:29:33 +0000 (18:29 -0400)]
cli: include wrapped part of PKCS#7 SignedData in the MIME tree

Unwrap a PKCS#7 SignedData part unconditionally when the cli is
traversing the MIME tree, and return it as a "child" of what would
otherwise be a leaf in the tree.

Unfortunately, this also breaks the JSON output.  We will fix that

Signed-off-by: Daniel Kahn Gillmor <>
5 months agosmime: Identify encrypted S/MIME parts during indexing
Daniel Kahn Gillmor [Tue, 12 May 2020 22:29:32 +0000 (18:29 -0400)]
smime: Identify encrypted S/MIME parts during indexing

We don't handle them correctly yet, but we can at least mark them as
being encrypted.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agolib: index PKCS7 SignedData parts
Daniel Kahn Gillmor [Tue, 12 May 2020 22:29:31 +0000 (18:29 -0400)]
lib: index PKCS7 SignedData parts

When we are indexing, we should treat SignedData parts the same way
that we treat a multipart object, indexing the wrapped part as a
distinct MIME object.

Unfortunately, this means doing some sort of cryptographic
verification whose results we throw away, because GMime doesn't offer
us any way to unwrap without doing signature verification.

I've opened to request
the capability from GMime but for now, we'll just accept the
additional performance hit.

As we do this indexing, we also apply the "signed" tag, by analogy
with how we handle multipart/signed messages.  These days, that kind
of change should probably be done with a property instead, but that's
a different set of changes.  This one is just for consistency.

Note that we are currently *only* handling signedData parts, which are
basically clearsigned messages.  PKCS#7 parts can also be
envelopedData and authEnvelopedData (which are effectively encryption
layers), and compressedData (which afaict isn't implemented anywhere,
i've never encountered it).  We're laying the groundwork for indexing
these other S/MIME types here, but we're only dealing with signedData
for now.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agoconfigure: report GMime minimum version in ./configure output
Daniel Kahn Gillmor [Tue, 12 May 2020 21:17:09 +0000 (17:17 -0400)]
configure: report GMime minimum version in ./configure output

We already report the minimum version for Glib, zlib, and Xapian
development libraries.  For consistency, report it for GMime as well.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agosmime: tests of X.509 certificate validity are known-broken on GMime < 3.2.7
Daniel Kahn Gillmor [Fri, 22 May 2020 00:42:41 +0000 (20:42 -0400)]
smime: tests of X.509 certificate validity are known-broken on GMime < 3.2.7

When checking cryptographic signatures, Notmuch relies on GMime to
tell it whether the certificate that signs a message has a valid User
ID or not.

If the User ID is not valid, then notmuch does not report the signer's
User ID to the user.  This means that the consumer of notmuch's
cryptographic summary of a message (or of its protected headers) can
be confident in relaying the reported identity to the user.

However, some versions of GMime before 3.2.7 cannot report Certificate
validity for X.509 certificates.  This is resolved upstream in GMime

We adapt to this by marking tests of reported User IDs for
S/MIME-signed messages as known-broken if GMime is older than 3.2.7
and has not been patched.

If GMime >= 3.2.7 and certificate validity still doesn't work for
X.509 certs, then there has likely been a regression in GMime and we
should fail early, during ./configure.

To break out these specific User ID checks from other checks, i had to
split some tests into two parts, and reuse $output across the two

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotest-lib: mark function variables as local
Daniel Kahn Gillmor [Fri, 8 May 2020 23:24:38 +0000 (19:24 -0400)]
test-lib: mark function variables as local

Several functions in test/ used variable names that are
also used outside of those functions (e.g. $output and $expected are
used in many of the test scripts), but they are not expected to
communicate via those variables.

We mark those variables "local" within so that they do not
get clobbered when used outside test-lib.

We also move the local variable declarations to beginning of each
function, to avoid weird gotchas with local variable declarations as
described in

Signed-off-by: Daniel Kahn Gillmor <>
5 months agonotmuch(1): clarify documentation about --option/value separators
Daniel Kahn Gillmor [Thu, 7 May 2020 19:26:45 +0000 (15:26 -0400)]
notmuch(1): clarify documentation about --option/value separators
started a thread of discussion that showed that the cli's current
idiosyncrasies around dealing with boolean options were not

This attempts to improve the documentation at least (actual changes to
the API might be better, but have not reached consensus).

Note that no one in the discussion thread identified any other
(non-boolean) command-line options that cannot use space as a
separator.  If such an option is identified (or introduced in the
future), it should be added explicitly to this part of the manual.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agolib: replace STRNCMP_LITERAL in __message_remove_indexed_terms
David Bremner [Mon, 4 May 2020 13:55:43 +0000 (10:55 -0300)]
lib: replace STRNCMP_LITERAL in __message_remove_indexed_terms

strncmp looks for a prefix that matches, which is very much not what
we want here. This fixes the bug reported by Franz Fellner in

5 months agotest: known broken test for reindex tag preservation
David Bremner [Mon, 4 May 2020 13:49:43 +0000 (10:49 -0300)]
test: known broken test for reindex tag preservation

In id:1588595993-ner-8.651@TPL520 Franz Fellner reported that tags
starting with 'attachment' are removed by 'notmuch reindex'. This is
probably related to the use of STRNCMP_LITERAL in

5 months agotests: disable CRL checks from gpgsm
Daniel Kahn Gillmor [Thu, 19 Mar 2020 04:15:08 +0000 (00:15 -0400)]
tests: disable CRL checks from gpgsm

GPGME has a strange failure mode when it is in offline mode, and/or
when certificates don't have any CRLs: in particular, it refuses to
accept the validity of any certificate other than a "root" cert.

This can be worked around by setting the `disable-crl-checks`
configuration variable for gpgsm.

I've reported this to the GPGME upstream at, but I have no idea how it will be
resolved.  In the meantime, we'll just work around it.

Note that this fixes the test for verification of
id:smime-multipart-signed@protected-headers.example, because
multipart/signed messages are already handled correctly (one-part
PKCS#7 messages will get fixed later).

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotest/protected-headers: Add tests for S/MIME protected headers
Daniel Kahn Gillmor [Tue, 28 Apr 2020 18:57:22 +0000 (14:57 -0400)]
test/protected-headers: Add tests for S/MIME protected headers

Recognize the protected subject for S/MIME example protected header

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotests/smime: add tests for S/MIME SignedData
Daniel Kahn Gillmor [Tue, 28 Apr 2020 18:57:21 +0000 (14:57 -0400)]
tests/smime: add tests for S/MIME SignedData

Add a simple S/MIME SignedData message, taken from an upcoming draft

RFC 8551 describes a SignedData, a one-part clearsigned object that is
more resistant to common patterns of MTA message munging than
multipart/signed (but has the downside that it is only readable by
clients that implement S/MIME).

To make sure sure notmuch can handle this kind of object, we want to
know a few things:

Already working:

 - Is the content of the SignedData object indexed?  It actually is
   right now because of dumb luck -- i think we're indexing the raw
   CMS object and it happens to contain the cleartext of the message
   in a way that we can consume it before passing it on to Xapian.
 - Are we accidentally indexing the embedded PKCS#7 certificates? We
   don't want to, and for some reason I don't understand, our indexing
   is actually skipping the embedded certificates already.  That's

Still need fixing:
 - do we know the MIME type of the embedded part?
 - do we know that the message is signed?
 - can notmuch-show read its content?
 - can notmuch-show indicate the signature validity?
 - can notmuch-reply properly quote and attribute content?

Signed-off-by: Daniel Kahn Gillmor <>
5 months add test_valid_json
Daniel Kahn Gillmor [Tue, 28 Apr 2020 18:57:20 +0000 (14:57 -0400)] add test_valid_json

This test does exactly what it says on the tin.  It expects JSON data
to be parseable by Python, at least.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotests/smime: Test indexing cleartext of envelopedData
Daniel Kahn Gillmor [Tue, 28 Apr 2020 18:57:19 +0000 (14:57 -0400)]
tests/smime: Test indexing cleartext of envelopedData

These tests describe some simple behavior we would expect to work if
we were to correctly index the cleartext of encrypted S/MIME messages
(PKCS#7 envelopedData).

Of course, they don't currently pass, so we mark them known-broken.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotests/smime: Verify cryptographic message status
Daniel Kahn Gillmor [Tue, 28 Apr 2020 18:57:18 +0000 (14:57 -0400)]
tests/smime: Verify cryptographic message status

When consuming a signed+encrypted S/MIME message generated by emacs,
we expect to see the same cryptographic properties for the message as
a whole.  This is not done correctly yet, so the test is marked as
known broken.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotests: Add S/MIME messages to protected-headers corpus
Daniel Kahn Gillmor [Tue, 28 Apr 2020 18:57:17 +0000 (14:57 -0400)]
tests: Add S/MIME messages to protected-headers corpus

These sample messages are taken directly from the Protected Headers

Note that this commit doesn't strictly pass the common git pre-commit
hook due to introducing some trailing whitespace.  That's just the
nature of the corpus, though.  We should have that trailing
whitespace, so I've made this commit with --no-verify.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotests/smime: include secret key material for Bob
Daniel Kahn Gillmor [Thu, 30 Apr 2020 19:35:21 +0000 (15:35 -0400)]
tests/smime: include secret key material for Bob

This is taken from the same Internet Draft that test/smime/ca.crt
comes from.  See that draft for more details.

We don't use it yet, but it will be used to decrypt other messages in
the test suite.

Note that we include it here with an empty passphrase, rather than
with the passphrase "bob" that it is supplied with in the I-D.  The
underlying cryptographic material is the same, but this way we can
import cleanly into gpgsm without having a passphrase set on it (gpgsm
converts an empty-string passphrase into no passphrase at all on

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotest: Allow tests to have both gpg and gpgsm active at once
Daniel Kahn Gillmor [Thu, 30 Apr 2020 19:34:21 +0000 (15:34 -0400)]
test: Allow tests to have both gpg and gpgsm active at once

Without this fix, we couldn't run both add_gnupg_home and
add_gpgsm_home in the same test script.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotests/smime: avoid copying the key+cert.pem around
Daniel Kahn Gillmor [Tue, 28 Apr 2020 18:57:14 +0000 (14:57 -0400)]
tests/smime: avoid copying the key+cert.pem around

No functional change.

We no longer need to identify the key and cert to mml-mode when
sending an S/MIME message, so making a copy of key+cert.pem to
test_suite.pem is superfluous.  Get rid of the extra file.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotests/smime: Use gpgsm instead of openssl for mml creation of S/MIME msgs
Daniel Kahn Gillmor [Tue, 28 Apr 2020 18:57:13 +0000 (14:57 -0400)]
tests/smime: Use gpgsm instead of openssl for mml creation of S/MIME msgs

The documentation for message mode clearly states that EasyPG (which
uses GnuPG) is the default and recommended way to use S/MIME with


To ensure that this mode works, we just need to import the secret key
in question into gpgsm in addition to the public key.  gpgsm should be
able pick the right keys+certificates to use based on To/From headers,
so we don't have to specify anything manually in the #secure mml tag.

The import process from the OpenSSL-preferred form (cert+secretkey) is
rather ugly, because gpgsm wants to see a PKCS#12 object when
importing secret keys.

Note that EasyPG generates the more modern Content-Type:
application/pkcs7-signature instead of application/x-pkcs7-signature
for the detached signature.

We are also obliged to manually set gpgsm's include-certs setting to 1
because gpgsm defaults to send "everything but the root cert".  In our
weird test case, the certificate we're using is self-signed, so it
*is* the root cert, which means that gpgsm doesn't include it by
default.  Setting it to 1 forces inclusion of the signer's cert, which
satisfies openssl's smime subcommand. See
for more details.

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotests/smime: consistently quote $GNUPGHOME
Daniel Kahn Gillmor [Tue, 28 Apr 2020 18:57:12 +0000 (14:57 -0400)]
tests/smime: consistently quote $GNUPGHOME

Signed-off-by: Daniel Kahn Gillmor <>
5 months agotests/smime: Include the Sample LAMPS Certificate Authority
Daniel Kahn Gillmor [Thu, 30 Apr 2020 19:33:29 +0000 (15:33 -0400)]
tests/smime: Include the Sample LAMPS Certificate Authority

This CA is useful for test suites and the like, but is not an
actually-secure CA, because its secret key material is also published.

I plan to use it for its intended purpose in the notmuch test suite.

It was copied from this Internet Draft:

Signed-off-by: Daniel Kahn Gillmor <>