Tickets :: Comment on [#12142] GPG signature verification broken

* Your Email Address
* Spam protection	Enter the letters below: .__ .___. __ ._..__ [__) \| / ` \| [ __ [__) \| \__._\|_[_./
Comment	>> I can't reproduce. Signature verification works fine for me. > > now i'm embarassed. i can't either. sorry if i wasted your time! > >>> this piece of code from line 287 to 299 looks really wrong to me, >>> since there should be 4 possible cases (mime: yes/no, stream: yes/no) >>> but the code has only 3 different execution paths. >> >> So? The one missing case is not used in the PGP code. So not sure >> what that has to do with this ticket. > > ehm nothing, i was just guessing, since i didn't really understand > the code... > > so now there is only one special case, that is somewhat missing: > > mails created with enigmail don't have a detached signature. so the > signature verification is done in Horde_Crypt_Pgp::_decryptMessage. > since in this method the pubkeyring consists only my own pubkey, this > will always yield "Can't check signature: No public key" (opposed to > the detached signatures which are verified in > IMP_Crypt_Pgp::verifySignature which automatically tries to fetch the > correct key....) > > (see Mime/Viewer/Pgp.php under /* Check for combined > encryption/signature data. */ for the beginning of this call path) > > but i don't yet see an easy solution to this problem. because all the > signature logic is in the mime viewer, the key fetching logic is in > IMP_Crypt_Pgp and the decryption in Horde_Crypt_Pgp. the signature > keyid is in the encrypted container, so somehow you would need to > first decrypt it, then fetch the key, then decrypt it again, with the > fetched key in the keyring... >
Attachment
Watch this ticket

Saved Queries