mail-gpg 0.4.5 → 0.4.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c21d99f46e1cf61f5f6b528d75189d90dd0543c6937c346d0435ad5dc23b9d25
-  data.tar.gz: a33073e63f6353184d87188a81996147ffcff43a98818fc46c07bcf9ac2e5d7b
+  metadata.gz: 3acca2c34af794c59ff717e0f29d27b26ed1d1e095dd388a6238e0ef31366644
+  data.tar.gz: c1161da992e780ecf3c6bea38977c9b8d0c86b2a5530f2095e398f868e7a70c9
 SHA512:
-  metadata.gz: edc5a48bad65750933dba1cc7d50c157c3c38a96d101e4106af284389199ea74564ed92689583a17a537f357a823dec9c8c301f7aca437c6f5dc9caf3030e109
-  data.tar.gz: e6040cb3fb89303a145a4a5158134437e66b52beca5628e6b154baf41560b53386b3e60bb93b915af4bc228b173b0d8f4f45e9cbbb4185f1387120d2e111159f
+  metadata.gz: ac9858c3c4838fa909cec047658a37945fa37ebf08a6b8a005ca336aab4543caed549f4a4c54a614195084772b9baa728978e2db80f2e1582767ea9a888ac743
+  data.tar.gz: b082facfd7d4c84a62e40bcf3aaba4866121daa0a65d8a962164031f7989eca572b5811187fb8f41dfb4948dbd7191aea4f1cce44d768c488721334d70073223

data/.github/workflows/test.yml

@@ -10,37 +10,20 @@ jobs:
   test:
     runs-on: ubuntu-latest
 
-    strategy:
-      fail-fast: false
-      matrix:
-        ruby-version: ["2.7", "3.0", "3.1", "3.2", "3.3", "3.4"]
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install GPG
-        run: sudo apt-get update && sudo apt-get install -y gnupg
-
-      - name: Set up Ruby ${{ matrix.ruby-version }}
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: ${{ matrix.ruby-version }}
-          bundler-cache: true
-
-      - name: Run tests
-        run: bundle exec rake
-
-  test-with-rails:
-    runs-on: ubuntu-latest
-
     strategy:
       fail-fast: false
       matrix:
         include:
+          - ruby-version: "2.7.8"
+            rails-version: "5.2.8.1"
           - ruby-version: "3.2"
-            rails-version: "7.1"
+            rails-version: "8.0"
           - ruby-version: "3.4"
-            rails-version: "7.2"
+            rails-version: "8.0"
+
+    # picked up by the Gemfile: gem 'actionmailer', "~> #{ENV['RAILS']}"
+    env:
+      RAILS: ${{ matrix.rails-version }}
 
     steps:
       - uses: actions/checkout@v4
@@ -54,7 +37,5 @@ jobs:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: true
 
-      - name: Run tests with Rails ${{ matrix.rails-version }}
-        env:
-          RAILS: ${{ matrix.rails-version }}
-        run: bundle update && bundle exec rake
+      - name: Run tests
+        run: bundle exec rake

data/History.txt

@@ -1,3 +1,17 @@
+== 0.4.6 2026-08-13
+
+* fix double transfer-decoding of inline signed / encrypted mails: the
+  rebuilt message kept the original Content-Transfer-Encoding header while
+  its body was set to the already decoded (verified / decrypted) text, so
+  reading the body would corrupt it (e.g. base64-decode plain text)
+* modernize test setup: RSA 2048 test keys generated without passphrase
+  protection (current GnuPG refuses to sign with the old DSA 1024 keys, and
+  interactive pinentry prompts no longer get in the way); bad passphrase
+  handling is now tested with a dedicated protected key via loopback
+  pinentry
+* CI runs on GitHub Actions with Ruby 2.7.8 / Rails 5.2.8.1 and
+  Ruby 3.2 / 3.4 with Rails 8
+
 == 0.4.5 2026-01-20
 
 * fix HKP client for Ruby 3.0+ (replaced deprecated URI.escape/decode)

data/lib/mail/gpg/inline_decrypted_message.rb

@@ -59,7 +59,9 @@ module Mail
                   else
                     p.content_type part.content_type
                     p.content_transfer_encoding part.content_transfer_encoding
-                    p.body part.body.to_s
+                    # keep the raw (still encoded) body to match the transfer
+                    # encoding copied above - body.to_s would decode it
+                    p.body part.body.raw_source
                   end
                 end
               end
@@ -72,6 +74,10 @@ module Mail
             cipher_mail.header.fields.each do |field|
               header[field.name] = field.value
             end
+            # the decrypted body set below is not transfer encoded, so an
+            # encoding copied over from the original mail would lead to
+            # double decoding
+            header['Content-Transfer-Encoding'] = nil
             body decrypted.to_s
             verify_result decrypted.verify_result if options[:verify] && '' != decrypted
           end

data/lib/mail/gpg/inline_signed_message.rb

@@ -17,6 +17,10 @@ module Mail
                 success, vr = GpgmeHelper.inline_verify(signed_text, options)
                 p = VerifiedPart.new(part)
                 if success
+                  # the body set here is already decoded, so a transfer
+                  # encoding copied over from the original part would lead to
+                  # double decoding
+                  p.header['Content-Transfer-Encoding'] = nil
                   p.body self.class.strip_inline_signature signed_text
                 end
                 p.verify_result vr
@@ -33,6 +37,9 @@ module Mail
             signed_mail.header.fields.each do |field|
               header[field.name] = field.value
             end
+            # the body set below is already decoded, so a transfer encoding
+            # copied over from the original mail would lead to double decoding
+            header['Content-Transfer-Encoding'] = nil
             signed_text = signed_mail.body.to_s
             success, vr = GpgmeHelper.inline_verify(signed_text, options)
             if success

data/lib/mail/gpg/version.rb

@@ -1,5 +1,5 @@
 module Mail
   module Gpg
-    VERSION = "0.4.5"
+    VERSION = "0.4.6"
   end
 end

data/test/inline_decrypted_message_test.rb

@@ -31,6 +31,24 @@ class InlineDecryptedMessageTest < MailGpgTestCase
         assert sig.to_s=~ /Joe/
         assert sig.valid?
       end
+
+      should "decrypt base64 encoded body" do
+        mail = Mail.new(@mail)
+        cipher_text = InlineDecryptedMessageTest.encrypt(mail, mail.body.to_s)
+        mail.content_transfer_encoding 'base64'
+        mail.body Mail::Encodings::Base64.encode(cipher_text)
+        mail = Mail.new(mail.encoded)
+
+        assert !mail.multipart?
+        assert mail.encrypted?
+        assert decrypted = mail.decrypt(:password => 'abc', verify: true)
+        assert_equal 'i am unencrypted', decrypted.body.decoded,
+          "body was double decoded: #{decrypted.body.decoded.inspect}"
+        assert vr = decrypted.verify_result
+        assert sig = vr.signatures.first
+        assert sig.to_s=~ /Joe/
+        assert sig.valid?
+      end
     end
 
     context "multipart/alternative message" do
@@ -77,6 +95,35 @@ class InlineDecryptedMessageTest < MailGpgTestCase
       end
     end
 
+    context "base64 encoded cleartext part and encrypted attachment message" do
+      should "decrypt attachment and not double decode text part" do
+        rakefile = File.open('Rakefile') { |file| file.read }
+        mail = Mail.new(@mail)
+        mail.content_type = 'multipart/mixed'
+        mail.body = ''
+        mail.part do |p|
+          p.content_type 'text/plain'
+          p.content_transfer_encoding 'base64'
+          p.body Mail::Encodings::Base64.encode('i am unencrypted')
+        end
+        mail.part do |p|
+          p.content_type 'application/octet-stream; name=Rakefile.pgp'
+          p.content_transfer_encoding Mail::Encodings::Base64
+          p.content_disposition 'attachment; filename="Rakefile.pgp"'
+          p.body Mail::Encodings::Base64::encode(InlineDecryptedMessageTest.encrypt(mail, rakefile, false))
+        end
+
+        assert mail.multipart?
+        assert mail.encrypted?
+        assert decrypted = mail.decrypt(password: 'abc')
+        assert !decrypted.encrypted?
+        assert_equal 2, decrypted.parts.length
+        assert_equal 'i am unencrypted', decrypted.parts[0].body.decoded,
+          "part was double decoded: #{decrypted.parts[0].body.decoded.inspect}"
+        assert_equal rakefile, decrypted.parts[1].body.decoded
+      end
+    end
+
     context "cleartext body and encrypted attachment message" do
       should "decrypt and verify attachment" do
         rakefile = File.open('Rakefile') { |file| file.read }

data/test/inline_signed_message_test.rb

@@ -54,9 +54,54 @@ class InlineSignedMessageTest < MailGpgTestCase
         assert !sig.valid?
       end
 
+      should "verify base64 encoded body" do
+        mail = Mail.new(@mail)
+        signed_text = self.class.inline_sign(mail, mail.body.to_s)
+        mail.content_transfer_encoding 'base64'
+        mail.body Mail::Encodings::Base64.encode(signed_text)
+        mail = Mail.new(mail.encoded)
+        assert !mail.multipart?
+        assert mail.signed?
+        assert verified = mail.verify
+        assert verified.signature_valid?
+        assert verified.body.decoded.include?('i am unencrypted'),
+          "body was double decoded: #{verified.body.decoded.inspect}"
+      end
+
+      should "keep base64 encoded body readable when signature is invalid" do
+        mail = Mail.new(@mail)
+        signed_text = self.class.inline_sign(mail, mail.body.to_s).gsub /i am/, 'i was'
+        mail.content_transfer_encoding 'base64'
+        mail.body Mail::Encodings::Base64.encode(signed_text)
+        mail = Mail.new(mail.encoded)
+        assert !mail.multipart?
+        assert mail.signed?
+        assert verified = mail.verify
+        assert !verified.signature_valid?
+        assert verified.body.decoded.include?('i was unencrypted'),
+          "body was double decoded: #{verified.body.decoded.inspect}"
+      end
+
     end
 
     context "message with signed attachment" do
+      should "check base64 encoded attachment signature" do
+        mail = Mail.new(@mail)
+        mail.body = 'foobar'
+        signed_text = self.class.inline_sign(mail, 'sign me!')
+        mail.part do |p|
+          p.content_transfer_encoding 'base64'
+          p.body Mail::Encodings::Base64.encode(signed_text)
+        end
+        mail = Mail.new(mail.encoded)
+        assert mail.multipart?
+        assert mail.signed?
+        assert verified = mail.verify
+        assert verified.signature_valid?
+        assert verified.parts.last.body.decoded.include?('sign me!'),
+          "part was double decoded: #{verified.parts.last.body.decoded.inspect}"
+      end
+
       should "check attachment signature" do
         mail = Mail.new(@mail)
         mail.body = 'foobar'

data/test/message_test.rb

@@ -298,24 +298,26 @@ class MessageTest < MailGpgTestCase
         end
 
         should "raise bad passphrase on decrypt" do
-          assert_equal 1, @mails.size
-          assert m = @mails.first
+          # patty's key is passphrase protected; loopback pinentry keeps
+          # gpg-agent from prompting interactively
+          mail = Mail.new do
+            from 'joe@foo.bar'
+            to 'patty@foo.bar'
+            subject 'test'
+            body 'i am unencrypted'
+            gpg encrypt: true
+          end
+          mail.deliver
+          assert m = @mails.last
           assert_equal 'test', m.subject
+          assert m.encrypted?
           # incorrect passphrase
-          if @gpg_utils.preset_passphrases?
-            set_passphrase('incorrect')
-            # expected_exception = GPGME::Error::DecryptFailed
-            # I dont know why.
-            expected_exception = EOFError
-          else
-            expected_exception = GPGME::Error::BadPassphrase
-          end
-          assert_raises(expected_exception){
-            m.decrypt(:password => 'incorrect')
+          assert_raises(GPGME::Error::BadPassphrase){
+            m.decrypt(password: 'incorrect', pinentry_mode: GPGME::PINENTRY_MODE_LOOPBACK)
           }
-          # no passphrase
-          assert_raises(expected_exception){
-            m.decrypt
+          # no passphrase - gpg gets no data from the loopback pinentry
+          assert_raises(GPGME::Error::NoData){
+            m.decrypt(pinentry_mode: GPGME::PINENTRY_MODE_LOOPBACK)
           }
         end
       end

data/test/test_helper.rb

@@ -71,31 +71,46 @@ class GPGTestUtils
   def gen_keys
     puts "setting up keydir #{@home}"
     FileUtils.mkdir_p @home
-    (File.open(File.join(@home, "gpg-agent.conf"), "wb") << "allow-preset-passphrase\nbatch\n").close
+    (File.open(File.join(@home, "gpg-agent.conf"), "wb") << "allow-preset-passphrase\n").close
     GPGME::Ctx.new do |gpg|
       gpg.generate_key <<-END
 <GnupgKeyParms format="internal">
-  Key-Type: DSA
-  Key-Length: 1024
-  Subkey-Type: ELG-E
-  Subkey-Length: 1024
+  %no-protection
+  Key-Type: RSA
+  Key-Length: 2048
+  Subkey-Type: RSA
+  Subkey-Length: 2048
   Name-Real: Joe Tester
   Name-Comment: with stupid passphrase
   Name-Email: joe@foo.bar
   Expire-Date: 0
-  Passphrase: abc
 </GnupgKeyParms>
 END
       gpg.generate_key <<-END
 <GnupgKeyParms format="internal">
-  Key-Type: DSA
-  Key-Length: 1024
-  Subkey-Type: ELG-E
-  Subkey-Length: 1024
+  %no-protection
+  Key-Type: RSA
+  Key-Length: 2048
+  Subkey-Type: RSA
+  Subkey-Length: 2048
   Name-Real: Jane Doe
   Name-Comment: with stupid passphrase
   Name-Email: jane@foo.bar
   Expire-Date: 0
+</GnupgKeyParms>
+END
+      # passphrase protected key for testing bad passphrase handling with
+      # loopback pinentry
+      gpg.generate_key <<-END
+<GnupgKeyParms format="internal">
+  Key-Type: RSA
+  Key-Length: 2048
+  Subkey-Type: RSA
+  Subkey-Length: 2048
+  Name-Real: Patty Protected
+  Name-Comment: with stupid passphrase
+  Name-Email: patty@foo.bar
+  Expire-Date: 0
   Passphrase: abc
 </GnupgKeyParms>
 END

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mail-gpg
 version: !ruby/object:Gem::Version
-  version: 0.4.5
+  version: 0.4.6
 platform: ruby
 authors:
 - Jens Kraemer
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-01-20 00:00:00.000000000 Z
+date: 2026-08-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mail
@@ -190,11 +190,6 @@ files:
 - test/decrypted_part_test.rb
 - test/encrypted_part_test.rb
 - test/gpg_test.rb
-- test/gpghome/gpg-agent.conf
-- test/gpghome/pubring.gpg
-- test/gpghome/pubring.gpg~
-- test/gpghome/secring.gpg
-- test/gpghome/trustdb.gpg
 - test/gpgme_helper_test.rb
 - test/hkp_test.rb
 - test/inline_decrypted_message_test.rb
@@ -231,11 +226,6 @@ test_files:
 - test/decrypted_part_test.rb
 - test/encrypted_part_test.rb
 - test/gpg_test.rb
-- test/gpghome/gpg-agent.conf
-- test/gpghome/pubring.gpg
-- test/gpghome/pubring.gpg~
-- test/gpghome/secring.gpg
-- test/gpghome/trustdb.gpg
 - test/gpgme_helper_test.rb
 - test/hkp_test.rb
 - test/inline_decrypted_message_test.rb

data/test/gpghome/gpg-agent.conf

@@ -1,2 +0,0 @@
-allow-preset-passphrase
-batch