mail-gpg 0.4.4 → 0.4.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 96edf0fbe3f22c01808d60328a9d316d4cab6588
-  data.tar.gz: dbe492f6351962e3696eb13a8185bc99f0ded52a
+SHA256:
+  metadata.gz: 3acca2c34af794c59ff717e0f29d27b26ed1d1e095dd388a6238e0ef31366644
+  data.tar.gz: c1161da992e780ecf3c6bea38977c9b8d0c86b2a5530f2095e398f868e7a70c9
 SHA512:
-  metadata.gz: 6ef811441d350386921a18d46d5b4aff71867eacb346565a5a1583eb8e516c3f0643b065cb1e02cca46db7cfa0333b5ed82435aab6da6bed4a9ecf5b34c054aa
-  data.tar.gz: 2588e6bbce89a8dd1fde81c582352c40b694a8a9c1de1b71ec57fbbf50bbf75cb770f75da3b822e25034abace1d210958a557bf7b224e8e305cbcaf2c2e7887f
+  metadata.gz: ac9858c3c4838fa909cec047658a37945fa37ebf08a6b8a005ca336aab4543caed549f4a4c54a614195084772b9baa728978e2db80f2e1582767ea9a888ac743
+  data.tar.gz: b082facfd7d4c84a62e40bcf3aaba4866121daa0a65d8a962164031f7989eca572b5811187fb8f41dfb4948dbd7191aea4f1cce44d768c488721334d70073223

data/.github/workflows/test.yml

@@ -0,0 +1,41 @@
+name: Tests
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - ruby-version: "2.7.8"
+            rails-version: "5.2.8.1"
+          - ruby-version: "3.2"
+            rails-version: "8.0"
+          - ruby-version: "3.4"
+            rails-version: "8.0"
+
+    # picked up by the Gemfile: gem 'actionmailer', "~> #{ENV['RAILS']}"
+    env:
+      RAILS: ${{ matrix.rails-version }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install GPG
+        run: sudo apt-get update && sudo apt-get install -y gnupg
+
+      - name: Set up Ruby ${{ matrix.ruby-version }}
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby-version }}
+          bundler-cache: true
+
+      - name: Run tests
+        run: bundle exec rake

data/History.txt

@@ -1,3 +1,24 @@
+== 0.4.6 2026-08-13
+
+* fix double transfer-decoding of inline signed / encrypted mails: the
+  rebuilt message kept the original Content-Transfer-Encoding header while
+  its body was set to the already decoded (verified / decrypted) text, so
+  reading the body would corrupt it (e.g. base64-decode plain text)
+* modernize test setup: RSA 2048 test keys generated without passphrase
+  protection (current GnuPG refuses to sign with the old DSA 1024 keys, and
+  interactive pinentry prompts no longer get in the way); bad passphrase
+  handling is now tested with a dedicated protected key via loopback
+  pinentry
+* CI runs on GitHub Actions with Ruby 2.7.8 / Rails 5.2.8.1 and
+  Ruby 3.2 / 3.4 with Rails 8
+
+== 0.4.5 2026-01-20
+
+* fix HKP client for Ruby 3.0+ (replaced deprecated URI.escape/decode)
+* change default keyserver from defunct pool.sks-keyservers.net to
+  keyserver.ubuntu.com
+* fix HKP client redirect handling
+
 == 0.4.4 2020-07-30
 
 * preserve Content-ID header of signed parts (relevant for inline images in

data/README.md

@@ -1,4 +1,4 @@
-# Mail::Gpg [![Build Status](https://travis-ci.org/jkraemer/mail-gpg.png?branch=master)](https://travis-ci.org/jkraemer/mail-gpg)
+# Mail::Gpg [![Tests](https://github.com/jkraemer/mail-gpg/actions/workflows/test.yml/badge.svg)](https://github.com/jkraemer/mail-gpg/actions/workflows/test.yml)
 
 This gem adds GPG/MIME encryption capabilities to the [Ruby Mail
 Library](https://github.com/mikel/mail)

data/lib/hkp.rb

@@ -49,7 +49,16 @@ class Hkp
           if redirect_depth >= MAX_REDIRECTS
             raise TooManyRedirects
           else
-            http_get response['location'], redirect_depth + 1
+            location = URI.parse(response['location'])
+            if location.host && (location.host != @host || location.port != @port)
+              # Cross-host redirect - create new client for the target server
+              redirect_client = Client.new(response['location'], ssl_verify_mode: @ssl_verify_mode)
+              return redirect_client.get(location.request_uri, redirect_depth + 1)
+            else
+              # Same-host redirect (relative path or same host)
+              redirect_path = location.respond_to?(:request_uri) ? location.request_uri : response['location']
+              return get(redirect_path, redirect_depth + 1)
+            end
           end
         else
           raise InvalidResponse, response.code
@@ -65,7 +74,7 @@ class Hkp
     if String === options
       options = { keyserver: options }
     end
-    @keyserver = options.delete(:keyserver) || lookup_keyserver || 'http://pool.sks-keyservers.net:11371'
+    @keyserver = options.delete(:keyserver) || lookup_keyserver || 'hkp://keyserver.ubuntu.com'
     @options = { raise_errors: true }.merge options
   end
 
@@ -83,7 +92,7 @@ class Hkp
   # and what info they return besides the key id
   def search(name)
     [].tap do |results|
-      result = hkp_client.get "/pks/lookup?options=mr&search=#{URI.escape name}"
+      result = hkp_client.get "/pks/lookup?op=index&options=mr&search=#{URI.encode_www_form_component(name)}"
 
       result.each_line do |l|
         components = l.strip.split(':')
@@ -101,7 +110,7 @@ class Hkp
 
   # returns the key data as returned from the server as a string
   def fetch(id)
-    result = hkp_client.get "/pks/lookup?options=mr&op=get&search=0x#{URI.escape id}"
+    result = hkp_client.get "/pks/lookup?op=get&options=mr&search=0x#{URI.encode_www_form_component(id)}"
     return clean_key(result) if result
 
   rescue Exception
@@ -142,7 +151,7 @@ class Hkp
   def lookup_keyserver
     url = nil
     if res = exec_cmd("gpgconf --list-options gpgs 2>&1 | grep keyserver 2>&1")
-      url = URI.decode(res.split(":").last.split("\"").last.strip)
+      url = URI.decode_www_form_component(res.split(":").last.split("\"").last.strip)
     elsif res = exec_cmd("gpg --gpgconf-list 2>&1 | grep gpgconf-gpg.conf 2>&1")
       conf_file = res.split(":").last.split("\"").last.strip
       if res = exec_cmd("cat #{conf_file} 2>&1 | grep ^keyserver 2>&1")

data/lib/mail/gpg/inline_decrypted_message.rb

@@ -59,7 +59,9 @@ module Mail
                   else
                     p.content_type part.content_type
                     p.content_transfer_encoding part.content_transfer_encoding
-                    p.body part.body.to_s
+                    # keep the raw (still encoded) body to match the transfer
+                    # encoding copied above - body.to_s would decode it
+                    p.body part.body.raw_source
                   end
                 end
               end
@@ -72,6 +74,10 @@ module Mail
             cipher_mail.header.fields.each do |field|
               header[field.name] = field.value
             end
+            # the decrypted body set below is not transfer encoded, so an
+            # encoding copied over from the original mail would lead to
+            # double decoding
+            header['Content-Transfer-Encoding'] = nil
             body decrypted.to_s
             verify_result decrypted.verify_result if options[:verify] && '' != decrypted
           end

data/lib/mail/gpg/inline_signed_message.rb

@@ -17,6 +17,10 @@ module Mail
                 success, vr = GpgmeHelper.inline_verify(signed_text, options)
                 p = VerifiedPart.new(part)
                 if success
+                  # the body set here is already decoded, so a transfer
+                  # encoding copied over from the original part would lead to
+                  # double decoding
+                  p.header['Content-Transfer-Encoding'] = nil
                   p.body self.class.strip_inline_signature signed_text
                 end
                 p.verify_result vr
@@ -33,6 +37,9 @@ module Mail
             signed_mail.header.fields.each do |field|
               header[field.name] = field.value
             end
+            # the body set below is already decoded, so a transfer encoding
+            # copied over from the original mail would lead to double decoding
+            header['Content-Transfer-Encoding'] = nil
             signed_text = signed_mail.body.to_s
             success, vr = GpgmeHelper.inline_verify(signed_text, options)
             if success

data/lib/mail/gpg/version.rb

@@ -1,5 +1,5 @@
 module Mail
   module Gpg
-    VERSION = "0.4.4"
+    VERSION = "0.4.6"
   end
 end

data/mail-gpg.gemspec

@@ -26,4 +26,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "actionmailer", ">= 3.2.0"
   spec.add_development_dependency "byebug"
   spec.add_development_dependency "shoulda-context", '~> 1.1'
+  spec.add_development_dependency "webmock", '~> 3.0'
 end

data/test/hkp_test.rb

@@ -4,7 +4,7 @@ require 'hkp'
 
 class HkpTest < MailGpgTestCase
 
-  context "hpk client" do
+  context "hkp client" do
     {
       "http://pool.sks-keyservers.net:11371" => {
         host: 'pool.sks-keyservers.net',
@@ -99,4 +99,222 @@ class HkpTest < MailGpgTestCase
 
   end
 
+  context 'with mocked server' do
+    setup do
+      WebMock.disable_net_connect!
+      @keyserver = 'hkp://keys.example.com'
+      @hkp = Hkp.new(keyserver: @keyserver)
+    end
+
+    teardown do
+      WebMock.allow_net_connect!
+    end
+
+    context 'search' do
+      should 'include op=index parameter in request' do
+        stub_request(:get, "http://keys.example.com:11371/pks/lookup")
+          .with(query: hash_including('op' => 'index'))
+          .to_return(status: 200, body: "info:1:1\npub:ABC123:1:2048:1234567890::\nuid:Test User <test@example.com>:1234567890::")
+
+        result = @hkp.search('test@example.com')
+        assert_requested :get, "http://keys.example.com:11371/pks/lookup",
+          query: hash_including('op' => 'index', 'search' => 'test@example.com')
+      end
+
+      should 'properly encode special characters in search query' do
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 200, body: "info:1:1\npub:ABC123:1:2048:1234567890::\n")
+
+        @hkp.search('test+user@example.com')
+
+        # Should use proper URL encoding, + should become %2B
+        assert_requested :get, "http://keys.example.com:11371/pks/lookup",
+          query: hash_including('search' => 'test+user@example.com')
+      end
+
+      should 'parse machine readable response' do
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 200, body: <<~RESPONSE)
+            info:1:2
+            pub:ABC123DEF456:1:2048:1234567890::
+            uid:Test User <test@example.com>:1234567890::
+            pub:789GHI012JKL:1:4096:1234567891::
+            uid:Another User <another@example.com>:1234567891::
+          RESPONSE
+
+        result = @hkp.search('example.com')
+
+        assert_equal 2, result.size
+        assert_equal 'ABC123DEF456', result[0][0]
+        assert_equal '789GHI012JKL', result[1][0]
+      end
+
+      should 'return empty array when no keys found' do
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 200, body: "info:1:0\n")
+
+        result = @hkp.search('nonexistent@example.com')
+
+        assert_equal [], result
+      end
+
+      should 'raise error on server error when raise_errors is true' do
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 500, body: "Internal Server Error")
+
+        assert_raises(Hkp::InvalidResponse) do
+          @hkp.search('test@example.com')
+        end
+      end
+
+      should 'return nil on server error when raise_errors is false' do
+        hkp = Hkp.new(keyserver: @keyserver, raise_errors: false)
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 500, body: "Internal Server Error")
+
+        result = hkp.search('test@example.com')
+
+        assert_nil result
+      end
+    end
+
+    context 'fetch' do
+      should 'include op=get parameter in request' do
+        stub_request(:get, "http://keys.example.com:11371/pks/lookup")
+          .with(query: hash_including('op' => 'get'))
+          .to_return(status: 200, body: <<~KEY)
+            -----BEGIN PGP PUBLIC KEY BLOCK-----
+            mQENBFxxxxxxx
+            -----END PGP PUBLIC KEY BLOCK-----
+          KEY
+
+        result = @hkp.fetch('ABC123')
+        assert_requested :get, "http://keys.example.com:11371/pks/lookup",
+          query: hash_including('op' => 'get', 'search' => '0xABC123')
+      end
+
+      should 'properly encode key id with special characters' do
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 200, body: <<~KEY)
+            -----BEGIN PGP PUBLIC KEY BLOCK-----
+            mQENBFxxxxxxx
+            -----END PGP PUBLIC KEY BLOCK-----
+          KEY
+
+        # Key IDs shouldn't normally have special chars, but testing encoding anyway
+        @hkp.fetch('ABC+123')
+
+        assert_requested :get, "http://keys.example.com:11371/pks/lookup",
+          query: hash_including('search' => '0xABC+123')
+      end
+
+      should 'extract key from response' do
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 200, body: <<~RESPONSE)
+            Some header text
+            -----BEGIN PGP PUBLIC KEY BLOCK-----
+
+            mQENBFxxxxxxx
+            =xxxx
+            -----END PGP PUBLIC KEY BLOCK-----
+            Some footer text
+          RESPONSE
+
+        result = @hkp.fetch('ABC123')
+
+        assert result.start_with?('-----BEGIN PGP PUBLIC KEY BLOCK-----')
+        assert result.end_with?('-----END PGP PUBLIC KEY BLOCK-----')
+        refute result.include?('Some header text')
+        refute result.include?('Some footer text')
+      end
+
+      should 'return nil when key not found' do
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 404, body: "Not Found")
+
+        hkp = Hkp.new(keyserver: @keyserver, raise_errors: false)
+        result = hkp.fetch('NONEXISTENT')
+
+        assert_nil result
+      end
+
+      should 'return nil when response has no valid key block' do
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 200, body: "No key here")
+
+        result = @hkp.fetch('ABC123')
+
+        assert_nil result
+      end
+    end
+
+    context 'redirects' do
+      should 'follow same-host redirects' do
+        stub_request(:get, "http://keys.example.com:11371/pks/lookup")
+          .with(query: hash_including('op' => 'index', 'search' => 'test'))
+          .to_return(status: 302, headers: { 'Location' => '/pks/lookup?op=index&options=mr&search=test&new=1' })
+
+        stub_request(:get, "http://keys.example.com:11371/pks/lookup")
+          .with(query: hash_including('op' => 'index', 'new' => '1'))
+          .to_return(status: 200, body: "info:1:1\npub:ABC123:1:2048:1234567890::\n")
+
+        result = @hkp.search('test')
+        assert_equal 1, result.size
+        assert_equal 'ABC123', result[0][0]
+      end
+
+      should 'follow cross-host redirects' do
+        stub_request(:get, "http://keys.example.com:11371/pks/lookup")
+          .with(query: hash_including('op' => 'index'))
+          .to_return(status: 302, headers: { 'Location' => 'http://keys2.example.com/pks/lookup?op=index&options=mr&search=test' })
+
+        stub_request(:get, "http://keys2.example.com:80/pks/lookup")
+          .with(query: hash_including('op' => 'index'))
+          .to_return(status: 200, body: "info:1:1\npub:DEF456:1:2048:1234567890::\n")
+
+        result = @hkp.search('test')
+        assert_equal 1, result.size
+        assert_equal 'DEF456', result[0][0]
+      end
+
+      should 'raise TooManyRedirects after MAX_REDIRECTS' do
+        stub_request(:get, /keys\.example\.com/)
+          .to_return(status: 302, headers: { 'Location' => 'http://keys.example.com:11371/pks/lookup?op=index&search=test' })
+
+        assert_raises(Hkp::TooManyRedirects) do
+          @hkp.search('test')
+        end
+      end
+    end
+  end
+
+  context 'lookup_keyserver' do
+    setup do
+      WebMock.disable_net_connect!
+    end
+
+    teardown do
+      WebMock.allow_net_connect!
+    end
+
+    should 'decode percent-encoded keyserver URL from gpgconf' do
+      # Create a testable subclass that stubs exec_cmd
+      hkp_class = Class.new(Hkp) do
+        def exec_cmd(cmd)
+          if cmd.include?('gpgconf --list-options')
+            # Simulated gpgconf output with percent-encoded URL
+            # Format: name:flags:value (value may be quoted)
+            "keyserver:0:hkp%3A%2F%2Fkeys.example.com\n"
+          else
+            nil
+          end
+        end
+      end
+
+      hkp = hkp_class.new
+      keyserver = hkp.instance_variable_get('@keyserver')
+      assert_equal 'hkp://keys.example.com', keyserver
+    end
+  end
+
 end

data/test/inline_decrypted_message_test.rb

@@ -31,6 +31,24 @@ class InlineDecryptedMessageTest < MailGpgTestCase
         assert sig.to_s=~ /Joe/
         assert sig.valid?
       end
+
+      should "decrypt base64 encoded body" do
+        mail = Mail.new(@mail)
+        cipher_text = InlineDecryptedMessageTest.encrypt(mail, mail.body.to_s)
+        mail.content_transfer_encoding 'base64'
+        mail.body Mail::Encodings::Base64.encode(cipher_text)
+        mail = Mail.new(mail.encoded)
+
+        assert !mail.multipart?
+        assert mail.encrypted?
+        assert decrypted = mail.decrypt(:password => 'abc', verify: true)
+        assert_equal 'i am unencrypted', decrypted.body.decoded,
+          "body was double decoded: #{decrypted.body.decoded.inspect}"
+        assert vr = decrypted.verify_result
+        assert sig = vr.signatures.first
+        assert sig.to_s=~ /Joe/
+        assert sig.valid?
+      end
     end
 
     context "multipart/alternative message" do
@@ -77,6 +95,35 @@ class InlineDecryptedMessageTest < MailGpgTestCase
       end
     end
 
+    context "base64 encoded cleartext part and encrypted attachment message" do
+      should "decrypt attachment and not double decode text part" do
+        rakefile = File.open('Rakefile') { |file| file.read }
+        mail = Mail.new(@mail)
+        mail.content_type = 'multipart/mixed'
+        mail.body = ''
+        mail.part do |p|
+          p.content_type 'text/plain'
+          p.content_transfer_encoding 'base64'
+          p.body Mail::Encodings::Base64.encode('i am unencrypted')
+        end
+        mail.part do |p|
+          p.content_type 'application/octet-stream; name=Rakefile.pgp'
+          p.content_transfer_encoding Mail::Encodings::Base64
+          p.content_disposition 'attachment; filename="Rakefile.pgp"'
+          p.body Mail::Encodings::Base64::encode(InlineDecryptedMessageTest.encrypt(mail, rakefile, false))
+        end
+
+        assert mail.multipart?
+        assert mail.encrypted?
+        assert decrypted = mail.decrypt(password: 'abc')
+        assert !decrypted.encrypted?
+        assert_equal 2, decrypted.parts.length
+        assert_equal 'i am unencrypted', decrypted.parts[0].body.decoded,
+          "part was double decoded: #{decrypted.parts[0].body.decoded.inspect}"
+        assert_equal rakefile, decrypted.parts[1].body.decoded
+      end
+    end
+
     context "cleartext body and encrypted attachment message" do
       should "decrypt and verify attachment" do
         rakefile = File.open('Rakefile') { |file| file.read }

data/test/inline_signed_message_test.rb

@@ -54,9 +54,54 @@ class InlineSignedMessageTest < MailGpgTestCase
         assert !sig.valid?
       end
 
+      should "verify base64 encoded body" do
+        mail = Mail.new(@mail)
+        signed_text = self.class.inline_sign(mail, mail.body.to_s)
+        mail.content_transfer_encoding 'base64'
+        mail.body Mail::Encodings::Base64.encode(signed_text)
+        mail = Mail.new(mail.encoded)
+        assert !mail.multipart?
+        assert mail.signed?
+        assert verified = mail.verify
+        assert verified.signature_valid?
+        assert verified.body.decoded.include?('i am unencrypted'),
+          "body was double decoded: #{verified.body.decoded.inspect}"
+      end
+
+      should "keep base64 encoded body readable when signature is invalid" do
+        mail = Mail.new(@mail)
+        signed_text = self.class.inline_sign(mail, mail.body.to_s).gsub /i am/, 'i was'
+        mail.content_transfer_encoding 'base64'
+        mail.body Mail::Encodings::Base64.encode(signed_text)
+        mail = Mail.new(mail.encoded)
+        assert !mail.multipart?
+        assert mail.signed?
+        assert verified = mail.verify
+        assert !verified.signature_valid?
+        assert verified.body.decoded.include?('i was unencrypted'),
+          "body was double decoded: #{verified.body.decoded.inspect}"
+      end
+
     end
 
     context "message with signed attachment" do
+      should "check base64 encoded attachment signature" do
+        mail = Mail.new(@mail)
+        mail.body = 'foobar'
+        signed_text = self.class.inline_sign(mail, 'sign me!')
+        mail.part do |p|
+          p.content_transfer_encoding 'base64'
+          p.body Mail::Encodings::Base64.encode(signed_text)
+        end
+        mail = Mail.new(mail.encoded)
+        assert mail.multipart?
+        assert mail.signed?
+        assert verified = mail.verify
+        assert verified.signature_valid?
+        assert verified.parts.last.body.decoded.include?('sign me!'),
+          "part was double decoded: #{verified.parts.last.body.decoded.inspect}"
+      end
+
       should "check attachment signature" do
         mail = Mail.new(@mail)
         mail.body = 'foobar'

data/test/message_test.rb

@@ -53,8 +53,6 @@ class MessageTest < MailGpgTestCase
         @mail.deliver
         @signed = Mail.new @mails.first.to_s
         @verified = @signed.verify
-        # Mail gem from 2.7.1 onwards converts "\n" to "\r\n"
-        @body = Mail::Utilities.to_crlf(@body)
       end
 
       should 'keep body unchanged' do
@@ -88,7 +86,7 @@ class MessageTest < MailGpgTestCase
             body "and\nanother part euro €"
           end
           @mail.add_part p
-          # if we do not force it to binary, the line ending is changed to CRLF. WTF?
+          # attachment bodies are returned as binary
           @attachment_data = "this is\n € not an image".force_encoding(Encoding::BINARY)
           @mail.attachments['test.jpg'] = { mime_type: 'image/jpeg',
                                             content: @attachment_data }
@@ -106,7 +104,7 @@ class MessageTest < MailGpgTestCase
         should 'have original three parts' do
           assert_equal 3, @verified.parts.size
           assert_equal 'i am unencrypted', @verified.parts[0].body.to_s
-          assert_equal "and\r\nanother part euro €", @verified.parts[1].body.to_s.force_encoding('UTF-8')
+          assert_equal "and\nanother part euro €", @verified.parts[1].body.to_s.force_encoding('UTF-8')
           assert attachment = @verified.parts[2]
           assert attachment.attachment?
           assert_equal "attachment; filename=test.jpg", attachment.content_disposition
@@ -141,8 +139,8 @@ class MessageTest < MailGpgTestCase
           assert_equal 3, @mail.parts.size
           assert_equal 3, @verified.parts.size
           assert_equal 'i am unencrypted', @verified.parts[0].body.to_s
-          assert_equal "and\r\nanother part euro €", @verified.parts[1].body.to_s.force_encoding('UTF-8')
-          assert_equal "and an\r\nHTML part €", @verified.parts[2].body.to_s.force_encoding('UTF-8')
+          assert_equal "and\nanother part euro €", @verified.parts[1].body.to_s.force_encoding('UTF-8')
+          assert_equal "and an\nHTML part €", @verified.parts[2].body.to_s.force_encoding('UTF-8')
         end
       end
 
@@ -227,7 +225,7 @@ class MessageTest < MailGpgTestCase
         assert decrypted = m.decrypt(:password => 'abc', verify: true)
         assert_equal 'test', decrypted.subject
         assert decrypted == @mail
-        assert_equal "one\r\neuro €", decrypted.body.to_s.force_encoding('UTF-8')
+        assert_equal "one\neuro €", decrypted.body.to_s.force_encoding('UTF-8')
         assert decrypted.signature_valid?
         assert_equal 1, decrypted.signatures.size
       end
@@ -300,24 +298,26 @@ class MessageTest < MailGpgTestCase
         end
 
         should "raise bad passphrase on decrypt" do
-          assert_equal 1, @mails.size
-          assert m = @mails.first
+          # patty's key is passphrase protected; loopback pinentry keeps
+          # gpg-agent from prompting interactively
+          mail = Mail.new do
+            from 'joe@foo.bar'
+            to 'patty@foo.bar'
+            subject 'test'
+            body 'i am unencrypted'
+            gpg encrypt: true
+          end
+          mail.deliver
+          assert m = @mails.last
           assert_equal 'test', m.subject
+          assert m.encrypted?
           # incorrect passphrase
-          if @gpg_utils.preset_passphrases?
-            set_passphrase('incorrect')
-            # expected_exception = GPGME::Error::DecryptFailed
-            # I dont know why.
-            expected_exception = EOFError
-          else
-            expected_exception = GPGME::Error::BadPassphrase
-          end
-          assert_raises(expected_exception){
-            m.decrypt(:password => 'incorrect')
+          assert_raises(GPGME::Error::BadPassphrase){
+            m.decrypt(password: 'incorrect', pinentry_mode: GPGME::PINENTRY_MODE_LOOPBACK)
           }
-          # no passphrase
-          assert_raises(expected_exception){
-            m.decrypt
+          # no passphrase - gpg gets no data from the loopback pinentry
+          assert_raises(GPGME::Error::NoData){
+            m.decrypt(pinentry_mode: GPGME::PINENTRY_MODE_LOOPBACK)
           }
         end
       end

data/test/test_helper.rb

@@ -1,11 +1,15 @@
 require 'open3'
 require 'test/unit'
 require 'shoulda/context'
+require 'webmock/test_unit'
 require 'mail-gpg'
 require 'action_mailer'
 require 'securerandom'
 require 'byebug'
 
+# Allow real connections by default, individual tests can disable
+WebMock.allow_net_connect!
+
 Mail.defaults do
   delivery_method :test
 end
@@ -67,31 +71,46 @@ class GPGTestUtils
   def gen_keys
     puts "setting up keydir #{@home}"
     FileUtils.mkdir_p @home
-    (File.open(File.join(@home, "gpg-agent.conf"), "wb") << "allow-preset-passphrase\nbatch\n").close
+    (File.open(File.join(@home, "gpg-agent.conf"), "wb") << "allow-preset-passphrase\n").close
     GPGME::Ctx.new do |gpg|
       gpg.generate_key <<-END
 <GnupgKeyParms format="internal">
-  Key-Type: DSA
-  Key-Length: 1024
-  Subkey-Type: ELG-E
-  Subkey-Length: 1024
+  %no-protection
+  Key-Type: RSA
+  Key-Length: 2048
+  Subkey-Type: RSA
+  Subkey-Length: 2048
   Name-Real: Joe Tester
   Name-Comment: with stupid passphrase
   Name-Email: joe@foo.bar
   Expire-Date: 0
-  Passphrase: abc
 </GnupgKeyParms>
 END
       gpg.generate_key <<-END
 <GnupgKeyParms format="internal">
-  Key-Type: DSA
-  Key-Length: 1024
-  Subkey-Type: ELG-E
-  Subkey-Length: 1024
+  %no-protection
+  Key-Type: RSA
+  Key-Length: 2048
+  Subkey-Type: RSA
+  Subkey-Length: 2048
   Name-Real: Jane Doe
   Name-Comment: with stupid passphrase
   Name-Email: jane@foo.bar
   Expire-Date: 0
+</GnupgKeyParms>
+END
+      # passphrase protected key for testing bad passphrase handling with
+      # loopback pinentry
+      gpg.generate_key <<-END
+<GnupgKeyParms format="internal">
+  Key-Type: RSA
+  Key-Length: 2048
+  Subkey-Type: RSA
+  Subkey-Length: 2048
+  Name-Real: Patty Protected
+  Name-Comment: with stupid passphrase
+  Name-Email: patty@foo.bar
+  Expire-Date: 0
   Passphrase: abc
 </GnupgKeyParms>
 END

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mail-gpg
 version: !ruby/object:Gem::Version
-  version: 0.4.4
+  version: 0.4.6
 platform: ruby
 authors:
 - Jens Kraemer
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-07-30 00:00:00.000000000 Z
+date: 2026-08-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mail
@@ -134,6 +134,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.1'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 description: |-
   GPG/MIME encryption plugin for the Ruby Mail Library
   This tiny gem adds GPG capabilities to Mail::Message and ActionMailer::Base. Because privacy matters.
@@ -143,8 +157,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/test.yml"
 - ".gitignore"
-- ".travis.yml"
 - Gemfile
 - History.txt
 - LICENSE.txt
@@ -176,12 +190,6 @@ files:
 - test/decrypted_part_test.rb
 - test/encrypted_part_test.rb
 - test/gpg_test.rb
-- test/gpghome/gpg-agent.conf
-- test/gpghome/pubring.gpg
-- test/gpghome/pubring.gpg~
-- test/gpghome/random_seed
-- test/gpghome/secring.gpg
-- test/gpghome/trustdb.gpg
 - test/gpgme_helper_test.rb
 - test/hkp_test.rb
 - test/inline_decrypted_message_test.rb
@@ -194,7 +202,7 @@ homepage: https://github.com/jkraemer/mail-gpg
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -209,9 +217,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.14.4
-signing_key: 
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: GPG/MIME encryption plugin for the Ruby Mail Library
 test_files:
@@ -219,12 +226,6 @@ test_files:
 - test/decrypted_part_test.rb
 - test/encrypted_part_test.rb
 - test/gpg_test.rb
-- test/gpghome/gpg-agent.conf
-- test/gpghome/pubring.gpg
-- test/gpghome/pubring.gpg~
-- test/gpghome/random_seed
-- test/gpghome/secring.gpg
-- test/gpghome/trustdb.gpg
 - test/gpgme_helper_test.rb
 - test/hkp_test.rb
 - test/inline_decrypted_message_test.rb

data/.travis.yml

@@ -1,21 +0,0 @@
-language: ruby
-rvm:
-  - 2.6.3
-  - 2.5.5
-  - 2.4.6
-env:
-  - RAILS=4.2.11.1 GPG_BIN=/usr/bin/gpg2
-  - RAILS=4.2.11.1 GPG_BIN=/usr/bin/gpg
-  - RAILS=5.2.3 GPG_BIN=/usr/bin/gpg2
-  - RAILS=5.2.3 GPG_BIN=/usr/bin/gpg
-matrix:
-  exclude:
-before_install:
-  - gem install bundler -v "~> 2.0"
-  - sudo apt install -y gnupg gnupg2
-cache: bundler
-dist: xenial
-addons:
-  apt:
-    update: true
-

data/test/gpghome/gpg-agent.conf

@@ -1,2 +0,0 @@
-allow-preset-passphrase
-batch