display signature verification status in MessageSumary

[pazz]

we need a nice way to display the verification result in a message line.

verification may be done using Message.is_signed and crypto.verify as seen in commands.thread.VerifyCommand.

[ldatura]

Is there a reason why not to tag verified messages? Something like “signed-verified”… If not this could be done during fetch mail process and maybe some themed options for displaying this special tag would suffice.

Hum… however, it is not always possible to verify the message during fetch as one may import new public keys every now and then… alot could check if a message is not verified yet, then verify and tag it. The coding work needed would actually be the same as checking every message every time, I wonder…

Anyway, one question that arises is when to verify a message which is closely related to where the result will be displayed: thread mode (usually it is right?), search mode?

Other than that, would a status bar message or header message suffice? Or maybe a bright red background for the whole interface when not verified… lol!!! Or just an icon/taglike alias in the corner (i like this one)!

Sorry for the non-solution message… I’m just imagining things! =P

[lucc]

Notmuch has some special tag. Those include tags called "signed" and "encrypted" which get applied to messages automatically.

We also have the pseudo header line indicating the signature status (and we even delete any such header from the parsed mail object as we do not want somebody to send us a mail that simply claims to be signed).

For nice displaying I have this in my config:

[tags]
  [[encrypted]]
    translated = #⚷🔒🔑🔐
    normal = '','', 'dark green', '', 'dark green', ''
  [[signed]]
    translated = ✔#✓🗸🗹🖒
    normal = '','', 'dark green', '', 'dark green', ''

So I think the current situation is not so bad. In general I am against displaying such verification information inside the body or header of the mail (the above mentioned signature header is nicely done and can be considered an exception). I was using mutt before and they do something like that but the big problem is always to ensure that nobody can send you a mail which has a line in the body or header which will be displayed in much the same way (or even color!) as the indicator from your MUA.

There are only two points where there could be improvement on this situation IMO: notmuch could introduce different tags for verified/trusted/... signatures and encryption. We could implement some coloring according to the state (verified/trusted/...) of signatures and encryption in the message header that we already have. The first one is outside our control, the second one is linked to #858. If there is interest in coloring this header line I have some code lying around that I can try to bring in shape.

[dcbaker]

On Jan 31, 2017 02:03, "Lucas Hoffmann" <notifications@github.com> wrote: Notmuch has some special tag <https://notmuchmail.org/special-tags/>. Those include tags called "signed" and "encrypted" which get applied to messages automatically. We also have the pseudo header line indicating the signature status (and we even delete any such header from the parsed mail object as we do not want somebody to send us a mail that simply claims to be signed). For nice displaying I have this in my config: [tags] [[encrypted]] translated = #⚷🔒🔑🔐 normal = '','', 'dark green', '', 'dark green', '' [[signed]] translated = ✔#✓🗸🗹🖒 normal = '','', 'dark green', '', 'dark green', '' So I think the current situation is not so bad. In general I am against displaying such verification information inside the body or header of the mail (the above mentioned signature header is nicely done and can be considered an exception). I was using mutt before and they do something like that but the big problem is always to ensure that nobody can send you a mail which has a line in the body or header which will be displayed in much the same way (or even color!) as the indicator from your MUA. There are only two points where there could be improvement on this situation IMO: notmuch could introduce different tags for verified/trusted/... signatures and encryption. Notmuch is the wrong place to solve this because signatures are time sensitive but tags are not. Imagine a key is compromised and revoked. But between the time that key is revoked and you refresh your keys someone sends out bad signed emails. If notmuch tags them as verified it also needs to figure out when the key was revoked and retag as revoked. We could implement some coloring according to the state (verified/trusted/...) of signatures and encryption in the message header that we already have. The first one is outside our control, the second one is linked to #858 <#858>. If there is interest in coloring this header line I have some code lying around that I can try to bring in shape. This is a fairly standard way to handle signatures; kmail (and iirc Thunderbird) use colors. Red and green for invalid and valid respectively.