From lurker-index@localhost Fri Sep 23 17:44:26 2016 Return-Path: Received: from lin16.mojsite.com (178.218.164.164:993) by g0n.xdwgrp with IMAP4-SSL; 23 Sep 2016 15:44:26 -0000 Envelope-to: miro.rovis@croatiafidelis.hr Delivery-date: Fri, 23 Sep 2016 17:20:18 +0200 Received: from shtjevan.gbnet.net ([194.70.142.36]:52050 helo=gbnet.net) by lin16.mojsite.com with esmtps (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.87) (envelope-from ) id 1bnSGr-0006cY-5h for miro.rovis@croatiafidelis.hr; Fri, 23 Sep 2016 17:20:13 +0200 Received: (qmail 13020 invoked by uid 611); 23 Sep 2016 15:17:35 -0000 Received: (qmail 12919 invoked from network); 23 Sep 2016 15:16:19 -0000 Received: from mail-1.fido.net (84.246.192.5) by shtjevan.gbnet.net with ESMTPS (DHE-RSA-AES256-SHA encrypted); 23 Sep 2016 15:16:19 -0000 Received: from seditious.adversary.org ([59.167.194.34] helo=nefarious.adversary.org) by mail-1.fido.net with esmtp (Exim 4.86) (envelope-from ) id 1bnSD1-0002km-UJ for mutt-users@mutt.org; Fri, 23 Sep 2016 16:16:18 +0100 Received: by nefarious.adversary.org (Postfix, from userid 501) id 1D325652974B; Sat, 24 Sep 2016 01:16:09 +1000 (AEST) Date: Sat, 24 Sep 2016 01:16:09 +1000 From: Ben McGinnes To: mutt-users@mutt.org Subject: Re: [SPAM?] Re: [SPAM?] Re: PGP sigs fail verification Message-ID: <20160923151609.GE57075@adversary.org> References: <20160919141105.GF31779@g0n.xdwgrp> <20160919145833.uqsypbawzolll3ro@darac.org.uk> <20160919202536.GA31772@g0n.xdwgrp> <20160919225636.3870.1E81EEA4@matica.foolinux.mooo.com> <20160921024026.3334.07EDFD85@matica.foolinux.mooo.com> <20160921060257.GB29391@minitel.priv.enst-bretagne.fr> <20160921065025.6939.1A051757@matica.foolinux.mooo.com> <20160921191202.GB18462@lovelace.schplaf> <20160921193520.GA20438@x2.esmtp.org> <20160921195336.GD18462@lovelace.schplaf> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="UBnjLfzoMQYIXCvq" Content-Disposition: inline In-Reply-To: <20160921195336.GD18462@lovelace.schplaf> User-Agent: Mutt/1.7.0 (2016-08-17) Received-SPF: pass (mail-1.fido.net: domain of adversary.org designates 59.167.194.34 as permitted sender) client-ip=59.167.194.34; envelope-from=ben@adversary.org; helo=nefarious.adversary.org; X-SPF-Result: mail-1.fido.net: domain of adversary.org designates 59.167.194.34 as permitted sender X-Filter-ID: s0sct1PQhAABKnZB5plbIdZIQllgAaFZah5UYvbbt+NaLI2rqoACMhULk4u6nCydNMAlA+Rmt2HG gqbkHADIyo411Ms0E5bt7/al3iJQV32H8OIuapHbdulippicZyXgHrVJfFkyKr2eCIJhDKSPnytE LhwKoSU6wmK17fLgw12micHWY+si53Ro7tHTuF287QsnEG/a/l5scf1Fs/ttQVR2wLR4mbd3+/H0 1XUCY2XKps5oXosC32pD9pLz14sFUV8ShebT8U8Xw9HTDfreWYSQ/SLs0hfSR76a7WJtWBBGJWOt eWaoXFvbbwb3Cge72jFzs5Bu7E1Y/gY6WS7godtLi1QVVyztjxnWvpW5S+MuxQywq7iW+3N2ZKz4 kxaY9muV1lBR0blKP/p9h87jdzl0E08wSgZouacoB2x/GGSQAEErZ6BfD4/W227/VzHg+l5ZnOoq S85+o/HqXSJ34L1TzOfBFM7Er/7n1KQSkHuxOWnp1UaerA3HM1DGPLa9aseSo+eTNO7G/rUMG+AW yn7GSOGo5AhqxuJQMN+Ull1jlvMIu+sRZOzqnbOGnKMP X-Report-Abuse-To: spam@master.fido.net Authentication-Results: fido.net; spf=pass smtp.mailfrom=ben@adversary.org X-FidoGuard-Class: ham X-FidoGuard-Evidence: Combined (0.17) X-Recommended-Action: accept List-Post: List-Unsubscribe: send mail to majordomo@mutt.org, body only "unsubscribe mutt-users" Precedence: bulk Sender: owner-mutt-users@mutt.org X-PlusHosting-MailScanner-Information: Please contact the ISP for more information X-PlusHosting-MailScanner-ID: 1bnSGr-0006cY-5h X-PlusHosting-MailScanner: Found to be clean X-PlusHosting-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-6.298, required 5, autolearn=not spam, BAYES_00 -5.00, HEADER_FROM_DIFFERENT_DOMAINS 0.00, KAM_LAZY_DOMAIN_SECURITY 1.00, RCVD_IN_DNSWL_MED -2.30, WEIRD_PORT 0.00) X-PlusHosting-MailScanner-From: owner-mutt-users-m24793@mutt.org X-Spam-Status: No X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= --UBnjLfzoMQYIXCvq Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Sep 21, 2016 at 09:53:36PM +0200, Jean-Christophe Bach wrote: > * Claus Assmann [21.09.2016. @12:35:20 -0700]: >=20 > > Your mail failed to verify. > >=20 > > However, after I removed your X-Header gpg can verify it. So > > whatever you use to generate that is broken (maybe it is added after > > signing?) > >=20 > > I'm attaching a tar file with m4{,.sig}: (modified) message body > > and signature, so others can check it locally. >=20 > OK, thank you: I am totally lost :) >=20 > I do not know how it is possible, and why it happened: I have configured > my_hdr long time ago. Then I updated (or not) my system. >=20 > FYI, my_hdr configuration is the following (in .muttrc): >=20 > my_hdr X-PGP-Key: http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0= xE9324BDEC124FF27 > my_hdr X-IM-Jabber: jcb@im.schplaf.org > my_hdr X-WebSite: http://www.schplaf.org > my_hdr X-Operating-System: A real one: Gentoo Linux > my_hdr X-Clacks-Overhead: GNU Terry Pratchett >=20 > It comes just after source ~/.mutt/.gnupg.mutt Your system is clearly doing something else there and it is very strange. I just replicated the above configuration and here it did what everyone would expect: it inserted all those X-headers into the mail headers and loaded the text editor. That *included* the Pratchett one. Which is where they stay when the message is sent (user-agent being appended, of course). How that last custom header gets moved from being a proper header into the MIME part header is the main thing to look at. It could be something with whatever text editor is used or it could be some script running on the message after it's saved, but before it is sent. I suspect the latter since the change must be made after the signature is made, since that would explain why editing your messages to remove that line then makes the messages verify. Regards, Ben --UBnjLfzoMQYIXCvq Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGcBAABCgAGBQJX5Uc4AAoJEH/y03E1x1U8/gAL/0Ex7Cdb5QVegsXo/AZFt1xy TseEnoav9Yb2bx5LKtQ94UtxATCQFl4wrBu5F1cED8KtBu/WpmY243fYlG3fuM2Z RT2RfgnNZczC/vD9iVRTmxR71XkTiL5MP1PMV3aN+y2I8vyomsFGrLjoTyiem5l7 wIdY5/gui2zt+lGtouCHcXeQN/v3GYE4PVCS/jEX8lNCVrc9gVXc3CbVEwTLFJj+ uifnLvcQUcVp1fMQ/AWbARZVxzy2VwgdEyKGI2xPP17UMb2ZfktyLyjLEEi9fPp4 NaEn2Q0Bu4VgTa/xksw96phsikBAMGatqf5UmC6xIRRUTlNPtTh3O9UlVamh/mtk 1tZtm2qQuqSWjEkwzPbABRYEkXEZro4f5YMVtpgiE8fAV0t7OwBRP1nlWYYWb15F nyf+hMs0OctFjEw2jD1OG0gY4xSbX3etBQ7DJ326xwmb8UmTjfuW8poC3h+Yiam3 ZLmXdgFGzeHwzPHyv77TWeSe/ebi4Ku9R7TEcqdeWw== =TKSQ -----END PGP SIGNATURE----- --UBnjLfzoMQYIXCvq--