GNOME Bugzilla – Bug 748567
silently mangles my attachments
Last modified: 2021-05-19 12:27:03 UTC
Hi there, yesterday, Evolution insisted on silently mangling two files that I meant to attach to an email, which turned out into a rather awkward moment for me when I repeatedly resent the message stating that the files will be attached now for sure. :/ The two files in question were a short shell script and a GPG signed text file: The shell script was entirely removed from the attachment and the text file had its GPG signature detached. (1) I don't know what the reason for the first case may be, probably security concerns. But if Evolution ever has such concerns about my email attachments, it should (a) leave me the choice to send that mail as I want it regardless of its concerns and (b) at least inform me that it found it necessary to mangle my attachments. This silent removal is a no-go! (2) I somehow understand that Evolution wants to do me a favor my detaching the GPg signature from the text file. But in my case at hand it was necessary to send a signed text file, not a text file and a signature. TLDR: If I select files as email attachments, Evolution should attach these files in pristine and not mangle them at all -- regardless of what good intentions may be behind this. Should I decide to attach spurious files, I expect Evolution to inform me, but not silently touch my data. Thank you! - Fabian
Thanks for a bug report. Evolution really isn't mean to change your attachments. There is some code to prevent attaching private files (like public GPG keys and similar), but that does inform the user about its intention to not allow it. Could you state your exact evolution version, please? Does the attachment bar show both files before sending, only the sent message had them missing? What if you right-click the attachment in the attachment bar and save it, will it be the same file as the attachment "source" file?
> Could you state your exact evolution version, please? That's evolution 3.12.9~git20141130.241663-1+b1 and evolution-data-server 3.12.9~git20141128.5242b0-2+deb8u2 from Debian jessie. > Does the attachment bar show both files before sending, only the sent message had them missing? Yes, both files show up in the attachment bar before sending. > What if you right-click the attachment in the attachment bar and save it, will it be the same file as the attachment "source" file? Saving the files from the attachment bar before sending results in the exact same files as the originals.
Thanks for the update. Then the question is what is the transport part, is it SMTP or other kind of transport, like evolution-ews? I do not think it's composer breaking the message, could you switch evolution to offline mode (File->Work Offline) and then send the message, which will not send it, but will save it into On This Computer/Outbox folder instead, where you'll be able to examine its content. Do not forget to switch evolution back to the online mode.
Mails are sent via SMTP. I did as you told me, switched Evolution to offline mode, created a new mail, added the two attachments and sent the messages. Of course, it wasn't really sent and I found it in my Outbox folder. There, the shell script was removed from the mail and the signature detached from the signed text file.
Good, that means it broken within Evolution. Could I ask for a path and name of the script, together with its attributes? I suppose you didn't change any attachment properties after attaching it, did you? Could you also paste a snippet of the signed attachment, please? I'm not interested in the whole content, just its header and footer, thus I have an idea of its structure. I suppose it looks like this: -----BEGIN PGP MESSAGE----- Version: GnuPG v1 owGbwMvMwCT4W8Ku7vPhLF7GNbJJHCWpxSV6JRUlofa3dUFsLgTR4cbCIMjEwMbK BJJk4OIUgOn8Fcowh8t6Out2s+h8SZvJFrwnr06M2Mq8nmGehdNX6U3VRf1r9q3Y Km/8gjVp40ERAA== =qIA/ -----END PGP MESSAGE-----
Sure, I hope this helps: $ ls -l ~/checkpkg.sh -rwxr-xr-x 1 greffrath greffrath 646 Apr 27 07:48 /home/greffrath/checkpkg.sh $ head ~/hello_2.10-1_amd64.changes -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sun, 22 Mar 2015 11:56:00 +0100 Source: hello Binary: hello Architecture: source amd64 Version: 2.10-1 Distribution: unstable $ tail ~/hello_2.10-1_amd64.changes I+7PFUyniI+BhrKt6VOCPzHjcs8UKu6+6csY49+L7vmJvTMCisbIlGoBIoMb+wE3 hATaYHMSdLSnd0SaY1IWvGC0orvB7CQiEzrlEFw2ks/ftc0+k6vKMXGjB84fcbAW zQ3XKmY7nOn33EknBab75BmADljuDiuawU7oK9k3WoDyH6SalPvM9eU7SZKcJAP9 OTlW1A8FgEdsbwqKnXuBvMVgEvDOnGCkl2opIkadXCDT/l+fCnOObaG/z30qk2h/ o7LXuV44PgB+rzS/BN/JP0sNQDG1+6QS9UNC/WsCOy/A+FS5Ni+ol9ZKj/AVLEp0 rEYIVzE0tKbp2rg7uhBRobEMCAvakqoOEU2SGBMLo5n6QB1T1sV3bZTWbTx0tozk FIa5QgFCunFqIhJAzu+wm5vA9amxZ58WpY9c9gDM53bzPr3i9QGhaUv5tQnmkKKs uOieOIWBuMxVki+nBOp/ =ton4 -----END PGP SIGNATURE-----
Thanks. I tried to reproduce this and then I only realized what's going on. The first issue with the missing script attachment, despite it being there (check the message source with Ctrl+U) is bug #745742. The second part, "detached" signature, again, the message source shows correct data, the file is attached as it is, the "problem" is that evolution processes the attachment through an inline filter which searches for several text markers which can denote encrypted, signed, and other parts within text documents and it interprets them accordingly. I can disable inline filtering for attachments, then it'll show them as they were attached, without trying to interpret any part of it.
GNOME is going to shut down bugzilla.gnome.org in favor of gitlab.gnome.org. As part of that, we are mass-closing older open tickets in bugzilla.gnome.org (resources are unfortunately quite limited so not every ticket can get handled). If you can still reproduce the situation described in this ticket in a recent and supported software version, then please follow https://wiki.gnome.org/Community/GettingInTouch/BugReportingGuidelines and create a new bug report ticket at https://gitlab.gnome.org/GNOME/evolution/-/issues/ Thank you for your understanding and your help.