From 2f59f6414f7e3291be93b19b47354f8b0a3c93f1 Mon Sep 17 00:00:00 2001 From: marinthiercelin Date: Mon, 25 Apr 2022 13:57:07 +0200 Subject: [PATCH 1/2] Return decrypted PGP/MIME content with wrong signatures When the PGP/MIME decryption encounters a signature verification error, it will keep decrypting the content and return it in the appropriate callbacks. This allows the caller to choose to display the content with a warning rather than just returning an error. --- crypto/mime.go | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/mime.go b/crypto/mime.go index 65dc89d..4d55cd0 100644 --- a/crypto/mime.go +++ b/crypto/mime.go @@ -45,7 +45,6 @@ func (keyRing *KeyRing) DecryptMIMEMessage( callbacks.OnError(embeddedSigError) callbacks.OnError(mimeSigError) callbacks.OnVerified(prioritizeSignatureErrors(embeddedSigError, mimeSigError)) - return } else if verifyKey != nil { callbacks.OnVerified(constants.SIGNATURE_OK) } From 07e32e3c5bbc13ab111a750bb6cd23ed9416c371 Mon Sep 17 00:00:00 2001 From: marinthiercelin Date: Mon, 25 Apr 2022 14:01:50 +0200 Subject: [PATCH 2/2] Update CHANGELOG.md --- CHANGELOG.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e994cd..922a61f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,9 +4,14 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## Unreleased + +### Changed +- `DecryptMIMEMessage` will return the decrypted content in the `OnBody` callback, even when there's a signature verification error. That lets the caller decide whether they want to use the content with a warning or hard fail on signature errors. + ## [2.4.6] 2022-03-25 -## Fixed +### Fixed - Update dependency `github.com/ProtonMail/go-mime`. It makes the parsing of MIME messages more flexible to messages with no specified charsets. - Fix the verification of PGP/MIME signature, the signature is now verified