Re: [PATCH] crypto: signature verification reports valid User IDs

2017-12-08 Thread Daniel Kahn Gillmor
On Fri 2017-12-08 14:36:04 -0400, David Bremner wrote: > Daniel Kahn Gillmor writes: > >> @@ -478,9 +478,10 @@ fi >> # we need to have a version >= 2.6.5 to avoid a crypto bug. We need >> # 2.6.7 for permissive "From " header handling. >> GMIME_MINVER=2.6.7 >> +GMIME3_MINVER=3.0.3 > > Does this

Re: [PATCH] crypto: signature verification reports valid User IDs

2017-12-08 Thread David Bremner
Daniel Kahn Gillmor writes: > @@ -478,9 +478,10 @@ fi > # we need to have a version >= 2.6.5 to avoid a crypto bug. We need > # 2.6.7 for permissive "From " header handling. > GMIME_MINVER=2.6.7 > +GMIME3_MINVER=3.0.3 Does this change mean notmuch won't build at all for people with gmime-3 <

Re: [PATCH] crypto: signature verification reports valid User IDs

2017-12-07 Thread Daniel Kahn Gillmor
On Wed 2017-11-29 23:20:35 -0500, Daniel Kahn Gillmor wrote: > When i'm trying to understand a message signature, i care that i know > who it came from (the "validity" of the identity associated with the > key), *not* whether i'm willing to accept the keyholder's other > identity assertions (the "t

[PATCH] crypto: signature verification reports valid User IDs

2017-11-29 Thread Daniel Kahn Gillmor
When i'm trying to understand a message signature, i care that i know who it came from (the "validity" of the identity associated with the key), *not* whether i'm willing to accept the keyholder's other identity assertions (the "trust" associated with the certificate). We've been reporting User ID