After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 217541 - support for sending in-line pgp
support for sending in-line pgp
Status: RESOLVED OBSOLETE
Product: evolution
Classification: Applications
Component: Mailer
unspecified
Other All
: Normal enhancement
: ---
Assigned To: evolution-mail-maintainers
Evolution QA team
: 210041 213933 215742 216747 219700 222232 222273 224114 224164 226031 227403 227605 230596 233383 237470 249679 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2001-12-17 20:29 UTC by Jeffrey Stedfast
Modified: 2013-07-24 14:39 UTC
See Also:
GNOME target: ---
GNOME version: Unversioned Enhancement



Description Jeffrey Stedfast 2001-12-17 20:29:54 UTC
Since I'm never gonna get my way on this...

need to figure out how to sign and/or encrypt when the user is sending HTML
mail. For those who just don't get it, when we send HTML mail we actually
send:

multipart/alternative
  text/plain
  text/html

so my best guess is that we sign/encrypt both text parts? Will
signing/encrypting a text/html part give us problems displaying? or any
other mailer for that matter? I dunno.
Comment 1 Jeffrey Stedfast 2001-12-17 20:33:18 UTC
*** bug 210041 has been marked as a duplicate of this bug. ***
Comment 2 Dan Winship 2001-12-17 21:57:57 UTC
IMHO, it's like "how do you represent bold text if you're sending
as text/plain?". You don't.

	(!) HTML and inline PGP are incompatible. You need to
	    use PGP/MIME if you want to sign or encrypt an HTML
	    message.

	   [Send as plain text] [Don't use PGP] [Use PGP/MIME]

or something.

There's also the issue of attachments. I think if you try to combine
attachments with inline pgp you should get something like:

	(!) Attachments cannot be signed if you are using
	    inline PGP. You use should use PGP/MIME instead
	    if you need to send attachments

	   [Cancel] [Attach without Signing] [Use PGP/MIME Instead]

and likewise for s/sign/encrypt/.
    
Comment 3 Jeffrey Stedfast 2001-12-17 22:52:11 UTC
ok
Comment 4 Jeffrey Stedfast 2002-02-28 02:39:12 UTC
*** bug 219700 has been marked as a duplicate of this bug. ***
Comment 5 Gerardo Marin 2002-03-25 21:11:47 UTC
*** bug 222232 has been marked as a duplicate of this bug. ***
Comment 6 Gerardo Marin 2002-03-25 21:12:29 UTC
*** bug 222273 has been marked as a duplicate of this bug. ***
Comment 7 Gerardo Marin 2002-04-01 05:21:17 UTC
*** bug 215742 has been marked as a duplicate of this bug. ***
Comment 8 Gerardo Marin 2002-04-07 20:04:13 UTC
*** bug 216747 has been marked as a duplicate of this bug. ***
Comment 9 Jeffrey Stedfast 2002-05-03 05:31:43 UTC
looks like Outlook signs both text parts (I don't think it signs them
individually though, which is broken..hah).

Anyways, there's no possibly way to verify the text/html part because
the "---- BEGIN PGP SIGNED MESSAGE -----" string isn't on a line by
itself like it's supposed to be... instead Outlook does this:

<FONT blah blah blah>----- BEGIN PGP SIGNED MESSAGE -----</FONT>

There might have been a <PRE> in there too, I forget. The point is
there is a ton of HTML crap around it so there's no way to verify it.

same goes for encrypted stuff.

this is why inline pgp is inherantly broken at a fundamental level :-)
Comment 10 Jeffrey Stedfast 2002-05-03 05:35:08 UTC
*** bug 213933 has been marked as a duplicate of this bug. ***
Comment 11 Gerardo Marin 2002-05-03 16:58:47 UTC
*** bug 224164 has been marked as a duplicate of this bug. ***
Comment 12 Jeffrey Stedfast 2002-05-03 17:00:28 UTC
*** bug 224114 has been marked as a duplicate of this bug. ***
Comment 13 Gerardo Marin 2002-05-08 16:34:17 UTC
*** bug 224397 has been marked as a duplicate of this bug. ***
Comment 14 Gerardo Marin 2002-06-10 15:40:02 UTC
*** bug 226031 has been marked as a duplicate of this bug. ***
Comment 15 Gerardo Marin 2002-07-04 15:40:58 UTC
*** bug 227403 has been marked as a duplicate of this bug. ***
Comment 16 Jeffrey Stedfast 2002-07-10 18:26:53 UTC
*** bug 227605 has been marked as a duplicate of this bug. ***
Comment 17 Gerardo Marin 2002-08-01 16:58:53 UTC
*** bug 228453 has been marked as a duplicate of this bug. ***
Comment 18 Gerardo Marin 2002-09-19 23:39:59 UTC
*** bug 230596 has been marked as a duplicate of this bug. ***
Comment 19 Gerardo Marin 2002-09-24 15:29:34 UTC

*** This bug has been marked as a duplicate of 217540 ***
Comment 20 Gerardo Marin 2002-09-24 15:31:10 UTC
Silly me
Comment 21 Brian Vancil 2002-10-24 19:38:47 UTC
I'd like to see this bug fixed.  I'm not promising a fix any time
soon, but I am studying the source code to get a feel for how things
work.  My motivation, in case you are curious, is that some mailers
separate messages from attachments, which go to some attachment
folder, making archiving of PGP/Mime messages problematic.

From the user experience, I propose to add an "inline PGP" checkbox to
the Security menu (and then in the account preferences as well). 
Implementation could be as simple as adding a pgp_inline boolean to
the necessary data structures, carrying it around in the least clunky
way as a function parameter, and branching where appropriate.  This is
all very abstract, but I didn't want to fill in all the details here.
 (An alternative would be to create a whole inline context, and I
wouldn't mind doing this, but I'd like to try the former idea first.)
 I don't think it would be too bad to send inline without receiving
capability; it wouldn't be any worse than now.  And receiving could be
added later, if at all.

As for the HTML mail problems, I have two ideas for solutions.
(1)  Make HTML and inline PGP mutually exclusive by setting plain text
mode when inline PGP is checked, etc.  This would require only a small
number of changes.
(2)  Turn the text/html part of the multipart/alternative into
text/plain, for it would no longer be text/html.  Just encrypt/sign
them both.  Chances are that mailers wouldn't be able to handle it,
but it's an easy solution, and decryption/verification could be done
manually.

Both are lamentable.  In my opinion, however, #2 is kinder to users
who want to do something stupid on purpose and so would be my first
choice.

I'd like to hear other opinions on this.  If I have naively glossed
over some fundamental problems, please let me know.  Mail client
programming is not exactly my specialty.
Comment 22 Gerardo Marin 2002-11-06 19:52:11 UTC
*** bug 233383 has been marked as a duplicate of this bug. ***
Comment 23 Jeffrey Stedfast 2003-02-05 17:57:34 UTC
*** bug 237470 has been marked as a duplicate of this bug. ***
Comment 24 William Denniss 2003-10-21 02:09:17 UTC
I also would like to be able to send emails with in-line pgp
signing/encryption.  Signing especially is useful if the message will
be archived in a text format (i.e. a mailing list).
Comment 25 aigarius 2003-11-26 02:11:32 UTC
Well about text/plain & text/html issue, it is simple:
sign text/plain part inline and sign text/html part in mime format.

This is only logical. As already said, inline signed html is absurd,
so it cann't be signed inline. Plain text must be signed inline
(because we are asked to do so). And html can be signed in mime format
as there are already two mime parts, so the third mime part will no
tinterfere much with the message.

This should be quite easy to implement.
Comment 26 Dan Winship 2003-11-26 13:54:33 UTC
Coming up with a clever way to combine html and inline pgp isn't
going to do any good if other clients can't read it. The way inline
pgp is defined is incompatible with MIME. You cannot mix the two.
(My earlier comment about inline pgp and attachments was wrong.
You cannot attach things to an inline-pgp-signed message
[unless you want to uuencode them as part of the signed body].)
Comment 27 Jeffrey Stedfast 2004-01-15 21:27:17 UTC
*** bug 249679 has been marked as a duplicate of this bug. ***
Comment 28 André Klapper 2005-02-07 12:49:51 UTC
adding security keyword for better finding
Comment 29 Jeffrey Stedfast 2008-02-10 17:32:49 UTC
I don't think this is worth implementing... it's also been several years since the last request for this feature.
Comment 30 Dan Winship 2008-02-10 20:13:00 UTC
(In reply to comment #29)
> it's also been several years since the last request for this feature.

Woo! The swift adoption of email standards marches on! Maybe in another 6 years it will be safe to assume that all SMTP servers support "EHLO"...
Comment 31 Jeffrey Stedfast 2008-02-10 20:23:20 UTC
One can hope :)
Comment 32 Yves-Alexis Perez 2012-06-25 12:26:49 UTC
What is the reason for marking this one obsolete?