= Messages encryption = I'll document the effort to add support for optionally message encryption using GnuPG. == Code structure == === Where === Where to kick in and mangle the message body is of course an essential decision. Reading the current code from trunk I found this in ./announcerplugin_trunk/announcer/distributors/mail.py {{{ parentMessage.attach(msgText) decorators = self._get_decorators() if len(decorators) > 0: decorator = decorators.pop() decorator.decorate_message(event, rootMessage, decorators) --> recip_adds = [x[2] for x in recipients if x] # Append any to, cc or bccs added to the recipient list for field in ('To', 'Cc', 'Bcc'): }}} --> Here I'll add some code to make encryption just work (1st step). Encryption/signing key ID hard-coded, growing number of variables I'd like to see as options in [annoucer] section of trac.ini and other ugliness. This will evolve over time. [FIXME: add more Q+A here to help with code design evaluation and code review] ?: Why not implement encryption as another IAnnouncementEmailDecorator A: Decorators are called without guaranteed order. Encryption needs control, that it'll be the last message body mangling action. ?: Why not implement encryption as another IAnnouncementFormatter A: Encryption is not about encoding etc. === What === What to do. It greatly depends on decision about how much is read from configuration or qualified deduction/guessing. Less configuration is good for the Admin in charge. Overview of expected behavior/features: * set gpg environment, preferable a dedicated place * read recipient list, optionally group recipients into require_encryption_group and allow_verbatim_msg_group * associate each recipient in require_encryption_group with key * handle behavior on missing key * embed DEBUG logging into all operations mentioned above === How === To make it more difficult for me to start I've found not one but several candidates for interacting with GnuPG from Python (http://wiki.python.org/moin/GnuPrivacyGuard has a listing with some more comments): * [http://code.google.com/p/python-gnupg/ python-gnupg] * PRO: no additional dependencies but pure Python, works on Windows as well as Unix/Linux, most complete set of gpg actions including key generation and management, active development - python 3 support since July 2009, latest release v0.2.4 from 01-03-2010 * CON: no Debian package? * [http://py-gnupg.sourceforge.net/ Python GnuPGInterface] * PRO: Debian package python-gnupginterface-0.3.2-9 * CON: concentrates on interacting with GnuPG via filehandles, based on Perl module GnuPG::Interface by same author, rumors about being "not very easy to use", doesn't work on Windows ([http://sourceforge.net/tracker/?func=detail&aid=1859636&group_id=29555&atid=396635 open feature request] since 2007, even has predecessor from 2002 that was plainly rejected), quite old - latest release v0.3.2 from 24-02-2002, even looks unmaintained since 2008 * [https://launchpad.net/pygpgme PyGPGME] * PRO: Debian package python-gpgme-0.1+bzr20090820-1+b1 * CON: ? * [http://pyme.sourceforge.net/ PyMe] * PRO: interface to C GPGME library, not limited to gpg by design, other backends planned, works on Windows as well as Unix/Linux, latest release v0.8.1 from 26-11-2008, Debian package python-pyme-0.8.1+clean-1 * CON: complex dependencies because built on GPGME + Python + SWIG * [http://pypi.python.org/pypi/OpenPGP/ OpenPGP] * PRO: ? * CON: no Debian package?, no information on Windows support, quite old - latest release v0.2.3 from 01-07-2005, even looks unmaintained ([http://www.aonalu.net/openpgp project homepage] currently unreachable) * [http://www.cs.auckland.ac.nz/~pgut001/cryptlib/ cryptlib] * PRO: interface to a range of plug-in encryption modules, not only but including gnupg, language bindings for C / C++, C# / .NET, Delphi, Java, Python, and Visual Basic, re-entrant and completely thread-safe, most core algorithms implemented in assembly language, support crypto hardware acceleration facilities like in Via C3 CPU family, extensive documentation designed for cut-n-paste directly from manual * CON: no Debian package? conclusion: test '''!PyMe''', PyGPGME, have a closer look at python-gnupg (hm, maybe), skip GnuPGInterface, OpenPGP, cryptlib (for now)[[BR]] hints, recommendations? known-good code references or popular applications? === Sources (ideas and code) === * Intro to python-gnupg at http://groups.google.de/group/comp.lang.python/browse_thread/thread/f2b97a2c11e1df63 * Python Wrapper for GnuPG v0.2.4 documentation: http://www.red-dove.com/python_gnupg/index.html * Python e-mail test server http://docs.djangoproject.com/en/1.1/topics/email/#topics-email * How Django, another Python based system handles e-mail-encryption with [http://code.google.com/p/django-email-extras/ django-email-extras] ([http://code.google.com/p/django-email-extras/source/browse/trunk/email_extras/ browse the code]) some more real-world implementations of python-gnupg, hints? -- hasienda