[PATCH v2 12/21] cli/show: use decryption policy "auto" by default.

[Daniel Kahn Gillmor]

When showing a message, if the user doesn't specify --decrypt= at all,
but a stashed session key is known to notmuch, notmuch should just go
ahead and try to decrypt the message with the session key (without
bothering the user for access to their asymmetric secret key).

The user can disable this at the command line with --decrypt=false if
they really don't want to look at the e-mail that they've asked
notmuch to show them.

and of course, "notmuch show --decrypt" still works for accessing the
user's secret keys if necessary.
---
 completion/notmuch-completion.bash |  4 ++--
 doc/man1/notmuch-show.rst          |  4 ++++
 notmuch-show.c                     | 17 +++++++++++------
 test/T357-index-decryption.sh      | 14 ++++++++++++++
 4 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/completion/notmuch-completion.bash 
b/completion/notmuch-completion.bash
index 1cd616b3..f94dbeed 100644
--- a/completion/notmuch-completion.bash
+++ b/completion/notmuch-completion.bash
@@ -517,7 +517,7 @@ _notmuch_show()
            COMPREPLY=( $( compgen -W "text json sexp mbox raw" -- "${cur}" ) )
            return
            ;;
-       --exclude|--body)
+       --exclude|--body|--decrypt)
            COMPREPLY=( $( compgen -W "true false" -- "${cur}" ) )
            return
            ;;
@@ -526,7 +526,7 @@ _notmuch_show()
     ! $split &&
     case "${cur}" in
        -*)
-           local options="--entire-thread= --format= --exclude= --body= 
--format-version= --part= --verify --decrypt --include-html 
${_notmuch_shared_options}"
+           local options="--entire-thread= --format= --exclude= --body= 
--format-version= --part= --verify --decrypt= --include-html 
${_notmuch_shared_options}"
            compopt -o nospace
            COMPREPLY=( $(compgen -W "$options" -- ${cur}) )
            ;;
diff --git a/doc/man1/notmuch-show.rst b/doc/man1/notmuch-show.rst
index 7ba091cf..64caa7a6 100644
--- a/doc/man1/notmuch-show.rst
+++ b/doc/man1/notmuch-show.rst
@@ -123,6 +123,10 @@ Supported options for **show** include
         multipart/encrypted part will be replaced by the decrypted
         content.
 
+        If a session key is already known for the message, then it
+        will be decrypted automatically unless the user explicitly
+        sets ``--decrypt=false``.
+
         Decryption expects a functioning **gpg-agent(1)** to provide any
         needed credentials. Without one, the decryption will fail.
 
diff --git a/notmuch-show.c b/notmuch-show.c
index e840a470..591889a9 100644
--- a/notmuch-show.c
+++ b/notmuch-show.c
@@ -1105,13 +1105,14 @@ notmuch_show_command (notmuch_config_t *config, int 
argc, char *argv[])
        .part = -1,
        .omit_excluded = true,
        .output_body = true,
-       .crypto = { .decrypt = NOTMUCH_DECRYPT_FALSE },
+       .crypto = { .decrypt = NOTMUCH_DECRYPT_AUTO },
     };
     int format = NOTMUCH_FORMAT_NOT_SPECIFIED;
     bool exclude = true;
     bool entire_thread_set = false;
     bool single_message;
     bool decrypt = false;
+    bool decrypt_set = false;
 
     notmuch_opt_desc_t options[] = {
        { .opt_keyword = &format, .name = "format", .keywords =
@@ -1126,7 +1127,7 @@ notmuch_show_command (notmuch_config_t *config, int argc, 
char *argv[])
        { .opt_bool = &params.entire_thread, .name = "entire-thread",
          .present = &entire_thread_set },
        { .opt_int = &params.part, .name = "part" },
-       { .opt_bool = &decrypt, .name = "decrypt" },
+       { .opt_bool = &decrypt, .name = "decrypt", .present = &decrypt_set },
        { .opt_bool = &params.crypto.verify, .name = "verify" },
        { .opt_bool = &params.output_body, .name = "body" },
        { .opt_bool = &params.include_html, .name = "include-html" },
@@ -1140,10 +1141,14 @@ notmuch_show_command (notmuch_config_t *config, int 
argc, char *argv[])
 
     notmuch_process_shared_options (argv[0]);
 
-    if (decrypt) {
-       params.crypto.decrypt = NOTMUCH_DECRYPT_TRUE;
-       /* decryption implies verification */
-       params.crypto.verify = true;
+    if (decrypt_set) {
+       if (decrypt) {
+           params.crypto.decrypt = NOTMUCH_DECRYPT_TRUE;
+           /* decryption implies verification */
+           params.crypto.verify = true;
+       } else {
+           params.crypto.decrypt = NOTMUCH_DECRYPT_FALSE;
+       }
     }
 
     /* specifying a part implies single message display */
diff --git a/test/T357-index-decryption.sh b/test/T357-index-decryption.sh
index 06008e81..3157fd8c 100755
--- a/test/T357-index-decryption.sh
+++ b/test/T357-index-decryption.sh
@@ -204,6 +204,20 @@ test_expect_equal \
     "$output" \
     "$expected"
 
+test_begin_subtest "notmuch show should show cleartext if session key is 
present"
+output=$(notmuch show id:simple-encryp...@crypto.notmuchmail.org | awk 
'/^\014part}/{ f=0 }; { if (f) { print $0 } } /^\014part{ ID: 3/{ f=1 }')
+expected='This is a top sekrit message.'
+test_expect_equal \
+    "$output" \
+    "$expected"
+
+test_begin_subtest "notmuch show should show nothing if decryption is 
explicitly disallowed"
+output=$(notmuch show --decrypt=false 
id:simple-encryp...@crypto.notmuchmail.org | awk '/^\014part}/{ f=0 }; { if (f) 
{ print $0 } } /^\014part{ ID: 3/{ f=1 }')
+expected='Non-text part: application/octet-stream'
+test_expect_equal \
+    "$output" \
+    "$expected"
+
 
 # TODO: test removal of a message from the message store between
 # indexing and reindexing.
-- 
2.15.0

_______________________________________________
notmuch mailing list
notmuch@notmuchmail.org
https://notmuchmail.org/mailman/listinfo/notmuch