Debian Bug report logs - #244673
Mailman breaks certain message signatures

version graph

Package: mailman; Maintainer for mailman is Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>; Source for mailman is src:mailman.

Reported by: Bernhard Reiter <bernhard@intevation.de>

Date: Mon, 19 Apr 2004 13:03:02 UTC

Severity: important

Tags: upstream

Found in version 2.1.4-4

Fixed in version mailman/2.1.6-1

Done: Lionel Elie Mamane <lmamane@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Tollef Fog Heen <tfheen@debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Bernhard Reiter <bernhard@intevation.de>:
New Bug report received and forwarded. Copy sent to Tollef Fog Heen <tfheen@debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Bernhard Reiter <bernhard@intevation.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: mailman: apply important fixes
Date: Mon, 19 Apr 2004 14:59:30 +0200
Package: mailman
Version: 2.1.4-4
Severity: important
Tags: security

Mailman 2.1.4 has several important bugs:
	Security relevant: Mailman breaks message signatures
		           for S/MIME and OpenPGP cases.
			   This is a security problem, because
			   users will learn this and are more likely
			   to attribute real manipulation to Mailman
			   instead noticing them.

	Important, because data loss possible.:
	Mailman scrubs some text message parts under certain conditions
	when archiving.  The data cannot be seen in the HTML archive 
	and might also not be in the mbox archive, it is lost.

	Important: Mailman List-ID might violate the standard RFC.
	And the List-ID should not change much, users will be annoyed.

I wrote two patches and put them together with the third one on:
ftp.intevation.de/users/bernhard/mailman

(Each patch has its own description in the top
including the corresponding updstream bug numbers.)

Yes I am running this combination of patches successfully
with on a site with Debian (internal packaging name 2.1.4-4ber1).

	Bernhard




Tags removed: security Request was from Matt Zimmerman <mdz@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Tags removed: security Request was from Siggy Brentrup <bsb@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Bug 244673 cloned as bug 244699. Request was from Siggy Brentrup <bsb@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Bug 244673 cloned as bug 244700. Request was from Siggy Brentrup <bsb@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Changed Bug title. Request was from Siggy Brentrup <bsb@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Message sent on to Bernhard Reiter <bernhard@intevation.de>:
Bug#244673. Full text and rfc822 format available.

Message #18 received at 244673-submitter@bugs.debian.org (full text, mbox):

From: Siggy Brentrup <bsb@debian.org>
To: control@bugs.debian.org
Cc: 244673-submitter@bugs.debian.org
Subject: mailman: splitting #244673
Date: Mon, 19 Apr 2004 18:00:46 +0200
[Message part 1 (text/plain, inline)]
package mailman
tags 244673 -security
clone 244673 -1
clone 244673 -2
retitle 244673 Mailman breaks certain message signatures
retitle -1 Possible data loss in archives
retitle -2 List-ID might violate the standard RFC
thanks

Hi Bernhard,

thanks for reporting.

The security tag is meant for system security issues,
which are not involved here.

You are addressing 3 separate issues warranting separate reports.
I'll follow up to each of them.

Thanks
 . Siggy
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Tollef Fog Heen <tfheen@debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Siggy Brentrup <bsb@debian.org>:
Extra info received and forwarded to list. Copy sent to Tollef Fog Heen <tfheen@debian.org>. Full text and rfc822 format available.

Message #23 received at 244673@bugs.debian.org (full text, mbox):

From: Siggy Brentrup <bsb@debian.org>
To: Bernhard Reiter <bernhard@intevation.de>, 244673@bugs.debian.org
Subject: Re: Bug#244673: mailman: apply important fixes
Date: Mon, 19 Apr 2004 18:18:38 +0200
[Message part 1 (text/plain, inline)]
Hi Bernhard,

thanks for reporting, the fix for the S/MIME OpenPGP issue
is greatly appreciated.

On Mon, Apr 19, 2004 at 02:59:30PM +0200, you wrote:
> Package: mailman
> Version: 2.1.4-4
> Severity: important
> Tags: security

> Mailman 2.1.4 has several important bugs:
> 	Security relevant: Mailman breaks message signatures
> 		           for S/MIME and OpenPGP cases.
> 			   This is a security problem, because
> 			   users will learn this and are more likely
> 			   to attribute real manipulation to Mailman
> 			   instead noticing them.

Agreed, but this doesn't compromise system security.

We are currently in the process of splitting mailman into
arch-dependent and arch-indep packages, so I an not yet
decided if this bug warrants an intermediate upload.

Regards
 . Siggy

ps: I'll address the other issues when I get the bug #s.
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Tollef Fog Heen <tfheen@debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Bernhard Reiter <bernhard@intevation.de>:
Extra info received and forwarded to list. Copy sent to Tollef Fog Heen <tfheen@debian.org>. Full text and rfc822 format available.

Message #28 received at 244673@bugs.debian.org (full text, mbox):

From: Bernhard Reiter <bernhard@intevation.de>
To: Siggy Brentrup <bsb@debian.org>
Cc: 244673@bugs.debian.org
Subject: Re: Bug#244673: mailman: apply important fixes
Date: Mon, 19 Apr 2004 18:45:56 +0200
[Message part 1 (text/plain, inline)]
Hi Siggy,

On Mon, Apr 19, 2004 at 06:18:38PM +0200, Siggy Brentrup wrote:
> thanks for reporting, the fix for the S/MIME OpenPGP issue
> is greatly appreciated.

Thanks for responding. 
Upstream is not really responsive these days.

> On Mon, Apr 19, 2004 at 02:59:30PM +0200, you wrote:
> > Package: mailman
> > Version: 2.1.4-4
> > Severity: important
> > Tags: security
> 
> > Mailman 2.1.4 has several important bugs:
> > 	Security relevant: Mailman breaks message signatures
> > 		           for S/MIME and OpenPGP cases.
> > 			   This is a security problem, because
> > 			   users will learn this and are more likely
> > 			   to attribute real manipulation to Mailman
> > 			   instead noticing them.
> 
> Agreed, but this doesn't compromise system security.

I tend to disagree, coming from sligthly wider view of security.
To me security is a process and we need to look at a group of computers. 
If the process has a flaw, it also reduces security for each single computer.

I'll try to make an example for this case:

Think about Alice's and Bob's computers.
Alice sends signed instructions over a Debian mailman list 
on Bob's machine and Bob follows them to upgrade his system.
Bob trusts Alice to know what to do as root on his machine.
Having the buggy mailman he get's used that mailman breaks
the signature once in a while. Now Curd slips in a forged email
with bad signature when he knows Alice to be away.
Bod believes the email because he thinks Mailman has broken the
signature. He cannot reach Alice for confirmation so he just follows
Curd instructions and open the backdoor to his computer...

> We are currently in the process of splitting mailman into
> arch-dependent and arch-indep packages, so I an not yet
> decided if this bug warrants an intermediate upload.

This is for you to decide.
	Bernhard
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Tollef Fog Heen <tfheen@debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Siggy Brentrup <bsb@debian.org>:
Extra info received and forwarded to list. Copy sent to Tollef Fog Heen <tfheen@debian.org>. Full text and rfc822 format available.

Message #33 received at 244673@bugs.debian.org (full text, mbox):

From: Siggy Brentrup <bsb@debian.org>
To: 244673@bugs.debian.org, control@bugs.debian.org
Cc: Bernhard Reiter <bernhard@intevation.de>
Subject: Re: Bug#244699: Possible data loss in archives
Date: Mon, 19 Apr 2004 22:33:19 +0200
[Message part 1 (text/plain, inline)]
package mailman
tags 244699 +patch
thanks

On Mon, Apr 19, 2004 at 02:59:30PM +0200, Bernhard Reiter wrote:
> Package: mailman
> Version: 2.1.4-4
> Severity: important

> 	Important, because data loss possible.:
> 	Mailman scrubs some text message parts under certain conditions
> 	when archiving.  The data cannot be seen in the HTML archive 
> 	and might also not be in the mbox archive, it is lost.

> I wrote two patches and put them together with the third one on:
> ftp.intevation.de/users/bernhard/mailman

Given the size of your patches, please include them as attachments
next time and use the patch tag.

Regards
 . Siggy
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Tollef Fog Heen <tfheen@debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Bernhard Reiter <bernhard@intevation.de>:
Extra info received and forwarded to list. Copy sent to Tollef Fog Heen <tfheen@debian.org>. Full text and rfc822 format available.

Message #38 received at 244673@bugs.debian.org (full text, mbox):

From: Bernhard Reiter <bernhard@intevation.de>
To: Siggy Brentrup <bsb@debian.org>
Cc: 244673@bugs.debian.org
Subject: Re: Bug#244699: Possible data loss in archives
Date: Mon, 19 Apr 2004 22:35:38 +0200
[Message part 1 (text/plain, inline)]
On Mon, Apr 19, 2004 at 10:33:19PM +0200, Siggy Brentrup wrote:
> package mailman
> tags 244699 +patch
> thanks
> 
> On Mon, Apr 19, 2004 at 02:59:30PM +0200, Bernhard Reiter wrote:
> > Package: mailman
> > Version: 2.1.4-4
> > Severity: important
> 
> > 	Important, because data loss possible.:
> > 	Mailman scrubs some text message parts under certain conditions
> > 	when archiving.  The data cannot be seen in the HTML archive 
> > 	and might also not be in the mbox archive, it is lost.
> 
> > I wrote two patches and put them together with the third one on:
> > ftp.intevation.de/users/bernhard/mailman
> 
> Given the size of your patches, please include them as attachments
> next time and use the patch tag.

Will do.
I was pressed for time to actual file at least one report. 
[Message part 2 (application/pgp-signature, inline)]

Tags added: patch Request was from Siggy Brentrup <bsb@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Tollef Fog Heen <tfheen@debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Lionel Elie Mamane <lionel@mamane.lu>:
Extra info received and forwarded to list. Copy sent to Tollef Fog Heen <tfheen@debian.org>. Full text and rfc822 format available.

Message #45 received at 244673@bugs.debian.org (full text, mbox):

From: Lionel Elie Mamane <lionel@mamane.lu>
To: 244673@bugs.debian.org, 244673-submitter@bugs.debian.org, 244699@bugs.debian.org, 244699-submitter@bugs.debian.org
Cc: control@bugs.debian.org
Subject: Your Mailman Debian bug
Date: Sun, 13 Nov 2005 18:33:05 +0100
tags 244673 =upstream
tags 244699 =upstream
thanks

I can't find a patch that seems to address one of these issues only
(or both issues) on your FTP directory. Which one are you referring
to?

Additionally, that's an upstream issue. Could you please take that up
with upstream? (I'll gladly apply a patch to the Debian package once
we get upstream's take on it.) Feel free to CC us
(mm-deb@lists.xlab.net) or the bugs on any communication with upstream
on this.


Thanks,

-- 
Lionel



Tags set to: upstream Request was from Lionel Elie Mamane <lionel@mamane.lu> to control@bugs.debian.org. Full text and rfc822 format available.

Message sent on to Bernhard Reiter <bernhard@intevation.de>:
Bug#244673. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Tollef Fog Heen <tfheen@debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Bernhard Reiter <bernhard@intevation.de>:
Extra info received and forwarded to list. Copy sent to Tollef Fog Heen <tfheen@debian.org>. Full text and rfc822 format available.

Message #55 received at 244673@bugs.debian.org (full text, mbox):

From: Bernhard Reiter <bernhard@intevation.de>
To: 244673@bugs.debian.org, mm-deb@lists.xlab.net
Subject: Re: Bug#244673: Your Mailman Debian bug
Date: Sat, 26 Nov 2005 16:06:42 +0100
[Message part 1 (text/plain, inline)]
Hi Lionel,

thanks for looking at this, I still consider it an important bug.

On Sun, Nov 13, 2005 at 06:33:05PM +0100, Lionel Elie Mamane wrote:
> tags 244673 =upstream

> I can't find a patch that seems to address one of these issues only
> (or both issues) on your FTP directory. Which one are you referring to?

As I wrote in my first submision:
	(Each patch has its own description in the top
	including the corresponding updstream bug numbers.)

I can quote from the patches:
	http://ftp.intevation.de/users/bernhard/mailman/mailman-2.1.4-avoid-headerfolding-python21.diff
	Attempt to make Mailman leave signatures intact.
	Submessage parts will not get headers folded if the new 
	Mailman.Generator.Generator class is used.
	Hopefully fixes, Mailman SF Bug:
		[ 815297 ] Breaking signatures in message/rfc822
	attachement!

> Additionally, that's an upstream issue. Could you please take that up
> with upstream? 

I did a long while ago, as written before, see upstream bug number above.

> (I'll gladly apply a patch to the Debian package once
> we get upstream's take on it.) 

Upstream did not refute the priority "8" of the bug, 
but also did not react so far. As this is an obvious security 
issues in setting with signed emails I hope that others see the points.
The patch improves the behavious, but does not completely solve all cases.
A real fix will need to change the underlying library, so this is
the bst I could do.

I am running the patch in a few production sites,
and I am acknowledged for Mailman development:
http://cvs.sourceforge.net/viewcvs.py/mailman/mailman/ACKNOWLEDGMENTS?rev=HEAD

	Bernhard (Reiter)
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Lionel Elie Mamane <lionel@mamane.lu>:
Extra info received and forwarded to list. Copy sent to Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #60 received at 244673@bugs.debian.org (full text, mbox):

From: Lionel Elie Mamane <lionel@mamane.lu>
To: Bernhard Reiter <bernhard@intevation.de>
Cc: 244673@bugs.debian.org
Subject: Re: Bug#244673: Your Mailman Debian bug
Date: Mon, 28 Nov 2005 21:46:22 +0100
On Sat, Nov 26, 2005 at 04:06:42PM +0100, Bernhard Reiter wrote:
> On Sun, Nov 13, 2005 at 06:33:05PM +0100, Lionel Elie Mamane wrote:

>> I can't find a patch that seems to address one of these issues only
>> (or both issues) on your FTP directory. Which one are you referring to?

> http://ftp.intevation.de/users/bernhard/mailman/mailman-2.1.4-avoid-headerfolding-python21.diff

I'm not sure how I missed it, I think I saw "2.1.4" and unconsciously
treated it as obsolete stuff.

I took a look at the patch. In the class "Generator" you define, you
completely ignore the argument mangle_from to __init__. If it is not
used, I would expect it not to be taken as an argument of __init__ at
all. Or, on the contrary, to be used and passed to the
email.Generator.Generator.__init__ call. It is probably best to pass
it to email.Generator.Generator.__init__, and set it to "False" in all
instances where one writes to a one-message file or to a string
(nearly everywhere) and to "True" when one writes to a mailbox (in
Mailman/Mailbox.py). Current OpenPGP implementations do
'From '-mangling themselves anyway before clearsigning. I dunno
whether S/MIME implementations do, too.

Same story for the max_header_len argument; shouldn't we rather put
the default value to 0 and pass the argument to
email.Generator.Generator.__init__? This would avoid overwriting
_write_headers.

Could you please comment on that? Thanks.

-- 
Lionel



Information forwarded to debian-bugs-dist@lists.debian.org, Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Lionel Elie Mamane <lionel@mamane.lu>:
Extra info received and forwarded to list. Copy sent to Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #65 received at 244673@bugs.debian.org (full text, mbox):

From: Lionel Elie Mamane <lionel@mamane.lu>
To: 244673@bugs.debian.org
Cc: Bernhard Reiter <bernhard@intevation.de>
Subject: Mailman Debian bug: Breaks signatures
Date: Sun, 11 Dec 2005 12:21:46 +0100
[Message part 1 (text/plain, inline)]
I changed your patch to do things slightly differently. Here's a
copy. It will be part of my next upload.

-- 
Lionel
[77_header_folding_in_attachments.dpatch (text/plain, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Bernhard Reiter <bernhard@intevation.de>:
Extra info received and forwarded to list. Copy sent to Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #70 received at 244673@bugs.debian.org (full text, mbox):

From: Bernhard Reiter <bernhard@intevation.de>
To: Lionel Elie Mamane <lionel@mamane.lu>
Cc: 244673@bugs.debian.org
Subject: Re: Mailman Debian bug: Breaks signatures
Date: Mon, 12 Dec 2005 11:56:16 +0100
[Message part 1 (text/plain, inline)]
Lionel,

On Sun, Dec 11, 2005 at 12:21:46PM +0100, Lionel Elie Mamane wrote:
> I changed your patch to do things slightly differently. Here's a
> copy. It will be part of my next upload.

thanks for the patch!
A change to my patch should be no problem as long
as the folding does not happen on subsequent parts.
Unfortunately I currently cannot test,
so I am slow to really comment.

	Bernhard


> +# Author: Bernhard Reiter <bernhard@gnu.org>
> +# Changed by Lionel Elie Mamane December 2005 from version on
> +# http://ftp.intevation.de/users/bernhard/mailman/mailman-2.1.4-avoid-headerfolding-python21.diff
> +# to use clone/children_maxheaderlen trick instead of _write_headers/mangle_from_
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Bernhard Reiter <bernhard@intevation.de>:
Extra info received and forwarded to list. Copy sent to Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #75 received at 244673@bugs.debian.org (full text, mbox):

From: Bernhard Reiter <bernhard@intevation.de>
To: Lionel Elie Mamane <lionel@mamane.lu>
Cc: 244673@bugs.debian.org
Subject: Re: Bug#244673: Your Mailman Debian bug
Date: Mon, 12 Dec 2005 18:28:17 +0100
On Mon, Nov 28, 2005 at 09:46:22PM +0100, Lionel Elie Mamane wrote:
> > http://ftp.intevation.de/users/bernhard/mailman/mailman-2.1.4-avoid-headerfolding-python21.diff

I am just comparing it to 77_header_folding_in_attachments.dpatch.

> I took a look at the patch. In the class "Generator" you define, you
> completely ignore the argument mangle_from to __init__. If it is not
> used, I would expect it not to be taken as an argument of __init__ at
> all. 

I accepted it as part of the promissed interface.
Note that you, in replacing maxheaderlen, will not fullfill
the promise of Generator __init_ interface anymore.
It should not be of practical relevance in this case, though.

Note also that clone() now also does something different in
a subtile way in your patch and depends on a Python version >2.2.2.
My patch worked for versions 2.1.x, too.
No problem for Debian of course.

> Or, on the contrary, to be used and passed to the
> email.Generator.Generator.__init__ call. It is probably best to pass
> it to email.Generator.Generator.__init__, and set it to "False" in all
> instances where one writes to a one-message file or to a string
> (nearly everywhere) and to "True" when one writes to a mailbox (in
> Mailman/Mailbox.py). 

I agree that it would be better 
to only have the mangeling in the case of writing an mbox file.
How to reach that goal is a matter of coding style,
my change was a bit easier to track for me back then I guess.

> Current OpenPGP implementations do
> 'From '-mangling themselves anyway before clearsigning. I dunno
> whether S/MIME implementations do, too.

I do not know for sure either.
I would assume that any reasonable
OpenPGP or S/MIME implementation would not mangle the from before signing.
Otherwise it would be a "modification" of the message
and the email would contain something that the user did not write.
It is a minor modification, but still it is a modification.
And maildir system can save a "From " in the body without problems
and SMTP also has no problem.

> Same story for the max_header_len argument; shouldn't we rather put
> the default value to 0 and pass the argument to
> email.Generator.Generator.__init__? This would avoid overwriting
> _write_headers.

A matter of style.
The change in the new patch now has a children_maxheaderlen in third
position of the __init__ arguments, which is different to what the
Generator class gave in the documentation.
Again: No practical consequences.
In my patch it was quite easy to see that no folding will happen anymore.

Bottom line: no real differences, except minor stylistic ones.



Information forwarded to debian-bugs-dist@lists.debian.org, Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Lionel Elie Mamane <lionel@mamane.lu>:
Extra info received and forwarded to list. Copy sent to Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #80 received at 244673@bugs.debian.org (full text, mbox):

From: Lionel Elie Mamane <lionel@mamane.lu>
To: Bernhard Reiter <bernhard@intevation.de>
Cc: 244673@bugs.debian.org
Subject: Re: Bug#244673: Your Mailman Debian bug
Date: Mon, 12 Dec 2005 21:01:20 +0100
On Mon, Dec 12, 2005 at 06:28:17PM +0100, Bernhard Reiter wrote:
> On Mon, Nov 28, 2005 at 09:46:22PM +0100, Lionel Elie Mamane wrote:

>>> http://ftp.intevation.de/users/bernhard/mailman/mailman-2.1.4-avoid-headerfolding-python21.diff

> I am just comparing it to 77_header_folding_in_attachments.dpatch.

>> I took a look at the patch. In the class "Generator" you define,
>> you completely ignore the argument mangle_from to __init__. If it
>> is not used, I would expect it not to be taken as an argument of
>> __init__ at all.

> I accepted it as part of the promissed interface.

The promised interface is that it gets set to "yes", "From " mangling
gets done. If you intend not to do "From " mangling, ever, it is a bit
... "deceitful" is much much too strong, but I can't find a good word
now ... to take the argument in __init__. It would confuse a user and
send him in fits of debugging of why this option doesn't work.

> Note that you, in replacing maxheaderlen, will not fullfill the
> promise of Generator __init_ interface anymore. (...)  The change in
> the new patch now has a children_maxheaderlen in third position of
> the __init__ arguments, which is different to what the Generator
> class gave in the documentation.

Yes... Maybe I should move children_maxheaderlen last and rename
toplevel_maxheaderlen to just "maxheaderlen", to stay more
compatible.

> Note also that clone() now also does something different in a
> subtile way in your patch

? It still creates a new Mailman.Generator that will not fold
headers. (Unless children_maxheaderlen is given a non-default value.)

> and depends on a Python version >2.2.2.

Ah? I tried to find the documentation of "email" on
http://www.python.org/doc/2.1.3/lib/lib.html to see whether it could
be avoided, but I can't find it. Do you have a pointer to it?

>> Current OpenPGP implementations do 'From '-mangling themselves
>> anyway before clearsigning. I dunno whether S/MIME implementations
>> do, too.

> I do not know for sure either.  I would assume that any reasonable
> OpenPGP or S/MIME implementation would not mangle the from before
> signing.

PGP and GnuPG both do; GnuPG puts a "- " in front of "From " in the
beginning of a line.

> Otherwise it would be a "modification" of the message and the email
> would contain something that the user did not write.

If they don't, the signature on the message will not verify (for same
cases) for no good reason.

> It is a minor modification, but still it is a modification.  And
> maildir system can save a "From " in the body without problems and
> SMTP also has no problem.

Which doesn't mean that From-escaping doesn't happen some MTA's /
LDA's are *very* eager and do it (nearly) all the time.

-- 
Lionel



Information forwarded to debian-bugs-dist@lists.debian.org, Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Bernhard Reiter <bernhard@intevation.de>:
Extra info received and forwarded to list. Copy sent to Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #85 received at 244673@bugs.debian.org (full text, mbox):

From: Bernhard Reiter <bernhard@intevation.de>
To: Lionel Elie Mamane <lionel@mamane.lu>
Cc: 244673@bugs.debian.org
Subject: Re: Bug#244673: Your Mailman Debian bug
Date: Tue, 13 Dec 2005 13:47:33 +0100
[Message part 1 (text/plain, inline)]
On Mon, Dec 12, 2005 at 09:01:20PM +0100, Lionel Elie Mamane wrote:
> The promised interface is that it gets set to "yes", "From " mangling
> gets done. If you intend not to do "From " mangling, ever, it is a bit
> ... "deceitful" is much much too strong, but I can't find a good word
> now ... to take the argument in __init__. It would confuse a user and
> send him in fits of debugging of why this option doesn't work.

> > Note that you, in replacing maxheaderlen, will not fullfill the
> > promise of Generator __init_ interface anymore. (...)  

> Yes... Maybe I should move children_maxheaderlen last and rename
> toplevel_maxheaderlen to just "maxheaderlen", to stay more
> compatible.

I think both points are minor, 
as the real patch should be different anyway and fix the email module.
Thanks for actively revising my patch! Good work!

> > Note also that clone() now also does something different in a
> > subtile way in your patch
> 
> ? It still creates a new Mailman.Generator that will not fold
> headers. (Unless children_maxheaderlen is given a non-default value.)
> 
> > and depends on a Python version >2.2.2.
> 
> Ah? I tried to find the documentation of "email" on
> http://www.python.org/doc/2.1.3/lib/lib.html to see whether it could
> be avoided, but I can't find it. Do you have a pointer to it?

It think this was missconception on my part,
Python 2.2 just added the email class, 
and clone() seems to have come with python 2.2.2.
As far as I remember Mailman brought its own email package if you
haven't had this one already.

> >> Current OpenPGP implementations do 'From '-mangling themselves
> >> anyway before clearsigning. I dunno whether S/MIME implementations
> >> do, too.
> 
> > I do not know for sure either.  I would assume that any reasonable
> > OpenPGP or S/MIME implementation would not mangle the from before
> > signing.
> 
> PGP and GnuPG both do; GnuPG puts a "- " in front of "From " in the
> beginning of a line.

GnuPG itself is not an OpenPGP mail application,
I just tested mutt and Kmail and both encode the F in the body
with quoted-printable, a nice solution.

> > Otherwise it would be a "modification" of the message and the email
> > would contain something that the user did not write.
> 
> If they don't, the signature on the message will not verify (for same
> cases) for no good reason.

It will verify, because the receiving MUA should be able to know
when it read from an mbox or not. And the MTA's should not mangle.

> > It is a minor modification, but still it is a modification.  And
> > maildir system can save a "From " in the body without problems and
> > SMTP also has no problem.
> 
> Which doesn't mean that From-escaping doesn't happen some MTA's /
> LDA's are *very* eager and do it (nearly) all the time.

For an MTA I guess it would be a bug!
For Local Deliver Daemons, it probably depends.

Anyway, a resonable body encoding is the best way out.

	Bernhard
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Lionel Elie Mamane <lionel@mamane.lu>:
Extra info received and forwarded to list. Copy sent to Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #90 received at 244673@bugs.debian.org (full text, mbox):

From: Lionel Elie Mamane <lionel@mamane.lu>
To: Bernhard Reiter <bernhard@intevation.de>, 244673@bugs.debian.org
Subject: Bug#244673: Your Mailman Debian bug
Date: Sun, 25 Dec 2005 14:39:58 +0100
On Tue, Dec 13, 2005 at 01:47:33PM +0100, Bernhard Reiter wrote:
> On Mon, Dec 12, 2005 at 09:01:20PM +0100, Lionel Elie Mamane wrote:

>> The promised interface is that it gets set to "yes", "From "
>> mangling gets done. If you intend not to do "From " mangling, ever,
>> it is a bit ... "deceitful" is much much too strong, but I can't
>> find a good word now ... to take the argument in __init__. It would
>> confuse a user and send him in fits of debugging of why this option
>> doesn't work.

>>> Note that you, in replacing maxheaderlen, will not fullfill the
>>> promise of Generator __init_ interface anymore. (...)  

>> Yes... Maybe I should move children_maxheaderlen last and rename
>> toplevel_maxheaderlen to just "maxheaderlen", to stay more
>> compatible.

I've just done that. Here's the patch as it will go in the next Debian
upload.

-- 
Lionel



Information forwarded to debian-bugs-dist@lists.debian.org, Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>:
Bug#244673; Package mailman. Full text and rfc822 format available.

Acknowledgement sent to Lionel Elie Mamane <lionel@mamane.lu>:
Extra info received and forwarded to list. Copy sent to Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>. Full text and rfc822 format available.

Message #95 received at 244673@bugs.debian.org (full text, mbox):

From: Lionel Elie Mamane <lionel@mamane.lu>
To: Bernhard Reiter <bernhard@intevation.de>, 244673@bugs.debian.org
Subject: Re: [Pkg-mailman-hackers] Bug#244673: Your Mailman Debian bug
Date: Sun, 25 Dec 2005 15:11:15 +0100
[Message part 1 (text/plain, inline)]
On Sun, Dec 25, 2005 at 02:39:58PM +0100, Lionel Elie Mamane wrote:

> Here's the patch as it will go in the next Debian upload.

Really, this time.

-- 
Lionel
[77_header_folding_in_attachments.dpatch (text/plain, attachment)]

Reply sent to Lionel Elie Mamane <lmamane@debian.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Bernhard Reiter <bernhard@intevation.de>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #100 received at 244673-close@bugs.debian.org (full text, mbox):

From: Lionel Elie Mamane <lmamane@debian.org>
To: 244673-close@bugs.debian.org
Subject: Bug#244673: fixed in mailman 2.1.6-1
Date: Sun, 25 Dec 2005 06:47:10 -0800
Source: mailman
Source-Version: 2.1.6-1

We believe that the bug you reported is fixed in the latest version of
mailman, which is due to be installed in the Debian FTP archive:

mailman_2.1.6-1.diff.gz
  to pool/main/m/mailman/mailman_2.1.6-1.diff.gz
mailman_2.1.6-1.dsc
  to pool/main/m/mailman/mailman_2.1.6-1.dsc
mailman_2.1.6-1_sparc.deb
  to pool/main/m/mailman/mailman_2.1.6-1_sparc.deb
mailman_2.1.6.orig.tar.gz
  to pool/main/m/mailman/mailman_2.1.6.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 244673@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Lionel Elie Mamane <lmamane@debian.org> (supplier of updated mailman package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Format: 1.7
Date: Sun, 25 Dec 2005 15:13:36 +0100
Source: mailman
Binary: mailman
Architecture: source sparc
Version: 2.1.6-1
Distribution: unstable
Urgency: low
Maintainer: Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org>
Changed-By: Lionel Elie Mamane <lmamane@debian.org>
Description: 
 mailman    - Powerful, web-based mailing list manager
Closes: 244673 244699 311414 343029
Changes: 
 mailman (2.1.6-1) unstable; urgency=low
 .
   * The "Quick, quick, upload before upstream releases a new version" release
   * New upstream release: (closes: #311414)
     New release packaging work:
     - Drop patches integrated upstream (or same fix in another way):
       handle-from-in-non-ascii
       75_danish_options_traceback
       73_list-id_strict_rfc
       69_python24_bouncehandler_datetime
       65_donot_add_empty_cc
       57_fix_missing_da_template
       04_CAN-2005-0202
       03_CAN-2004-1143
       02_CAN-2004-1177_driver_css
     - Upstream doesn't ship README.{EXIM,POSTFIX} anymore: Drop their patch
     - Update patches
        62_new_list_bad_pending_requests
        64_correct_html_nesting
        68_translation_update_nl
        70_invalid_utf8_dos.dpatch
        99_js_templates
     Bugs fixed upstream:
     - Possible data loss in archives (closes: #244699)
   * Don't fold headers in attachments (closes: #244673)
     This avoids breaking cryptographic signatures
   * Warn that list passwords are broken on upgrade from 2.0 (closes: #343029)
Files: 
 e4e6456ba10c6f8d94c289e7762397c4 738 mail optional mailman_2.1.6-1.dsc
 4e0f9d09c1553bd1a0a5327052179ca2 6482726 mail optional mailman_2.1.6.orig.tar.gz
 addf55484dbf9bfc0b021c34d51d4560 191965 mail optional mailman_2.1.6-1.diff.gz
 079b89ff0bce69bd023d284c393133a1 7676726 mail optional mailman_2.1.6-1_sparc.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iEYEAREDAAYFAkOurwMACgkQscRzFz57S3N6LgCdEzLr9woAqN8XVRIDiqFHUaCB
IRkAoMFLc0rUlql5rcrGrTS1dKRQjgGp
=qh14
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 26 Jun 2007 12:22:28 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Apr 20 11:10:57 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.