1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
|
$Id$
USING PGP FROM WITHIN MUTT
WARNING: The configuration interface has completely changed as of
0.96.3!
USERS' GUIDE
How do I use mutt with PGP, PGP5, or GnuPG?
-------------------------------------------
Go to the contrib subdirectory of the source tree. You'll find
three files there, pgp2.rc, pgp5.rc, and gpg.rc. These files
contain ready-to-use configurations for using mutt with pgp2, pgp5,
and gpg.
Include one of these files with your ~/.muttrc, and things should
work out fine.
You may wish to verify that all paths and the language parameters
given to the PGP binaries match your needs.
Frequently Asked Questions and Tips
-----------------------------------
Q: "People are sending PGP messages which mutt doesn't
recognize. What can I do?"
The new way is to leave headers alone and use mutt's
check-traditional-pgp function, which can detect PGP messages at
run-time, and adjust content-types.
The old way is to configure your mail filter so it fixes headers:
Add the following lines to your ~/.procmailrc (you are
using procmail, aren't you?):
------------------------------
##
## PGP
##
:0
* !^Content-Type: message/
* !^Content-Type: multipart/
* !^Content-Type: application/pgp
{
:0 fBw
* ^-----BEGIN PGP MESSAGE-----
* ^-----END PGP MESSAGE-----
| formail \
-i "Content-Type: application/pgp; format=text; x-action=encrypt"
:0 fBw
* ^-----BEGIN PGP SIGNED MESSAGE-----
* ^-----BEGIN PGP SIGNATURE-----
* ^-----END PGP SIGNATURE-----
| formail \
-i "Content-Type: application/pgp; format=text; x-action=sign"
}
------------------------------
For users of maildrop, "Mark Weinem"
<mark.weinem@unidui.uni-duisburg.de> suggests the following recipe:
------------------------------
BPGPM="-----BEGIN PGP MESSAGE-----"
EPGPM="-----END PGP MESSAGE-----"
BPGPS="-----BEGIN PGP SIGNATURE-----"
EPGPS="-----END PGP SIGNATURE-----"
if (!/^Content-Type: message/ && !/^Content-Type: multipart/ \
&& !/^Content-Type: application\/pgp/)
{
if (/^$BPGPM/:b && /^$EPGPM/:b)
xfilter "reformail -A 'Content-Type: application/pgp; format=text; \
x-action=encrypt'"
if (/^$BPGPS/:b && /^$EPGPS/:b)
xfilter "reformail -A 'Content-Type: application/pgp; format=text; \
x-action=sign'"
}
------------------------------
Q: "I don't like that PGP/MIME stuff, but want to use the
old way of PGP-signing my mails. Can't you include
that with mutt?"
The old answer to this question used to be this:
No. Application/pgp is not really suited to a world with MIME,
non-textual body parts and similar things. Anyway, if you really
want to generate these old-style attachments, include the
following macro in your ~/.muttrc (line breaks for readability,
this is actually one line):
macro compose S "Fpgp +verbose=0 -fast
+clearsig=on\ny^T^Uapplication/pgp; format=text;
x-action=sign\n"
There's a new answer, though: Set the $pgp_create_traditional
configuration variable (it's a quad-option) to something different
from "no" (that's the default). Mutt will then try to use
application/pgp wherever it makes sense. In particular, it does
not make any sense with multiparts, or non-ASCII or non-text bodies.
In all other cases, PGP/MIME is used unconditionally.
Note that application/pgp is still strongly deprecated.
Q: "I don't like all the ^Gs and various other verbosity
PGP is presenting me with."
Roland Rosenfeld <roland@spinnaker.rhein.de> has found a quite
elegant solution to this problem: PGP has some pretty good foreign
language support. So we just introduce a language called "mutt"
which contains empty strings for the messages we don't want to see.
To use this, copy either language.txt or language50.txt (depending
on what PGP version you are using) to your $PGPPATH. Make sure the
PGP command formats pass "+language=pgp" to all the PGP binaries
(but not to mutt_pgpring!).
For PGP 2.6, a German version called "muttde" is available
as well.
Q: "My PGP signatures are being invalidated. BTW, I'm using Courier
MTA."
The author of the Courier MTA believes that the standard specifying
multipart/signed is broken. For that reason, he has chosen to
implement his MTA in a way which does not assure that
multipart/signed body parts are left untouched.
We suggest that you abandon courier and change to sendmail, postfix,
or exim.
BACKGROUND
Auxiliary Programs
------------------
Mutt needs two auxiliary programs for its PGP support: pgpewrap and
mutt_pgpring.
1. mutt_pgpring
mutt_pgpring is a key ring dumper. It extracts information from PGP's
binary key ring and emits it in an (almost) readable output format
understood by mutt's key selection routines. This output format
mimics the one used by the GNU Privacy Guard (GPG).
You'll need this program with PGP 2 and PGP 5.
Command line options:
-k <key ring> Dump the contents of the key ring specified
as an argument to -k.
-2, -5 Use the default key ring for PGP 2 or 5,
respectively.
-s Dump the secret key ring.
-S Dump signatures.
-f Dump fingerprints.
2. pgpewrap
This is a little C program which does some command line munging: The
first argument is a command to be executed. When pgpewrap
encounters a "--" (dash-dash) argument, it will interpret the next
argument as a prefix which is put in front of all following
arguments.
Example:
pgpewrap pgpe file -- -r a b c
will execute:
pgpe file -r a -r b -r c
This script is needed with PGP 5 and with GPG, since their command
line interfaces can't be properly served by mutt's format mechanism.
The Configuration Interface
---------------------------
As usual within mutt, the configuration interface for the PGP
commands relies on printf-like formats. For all PGP commands, the
following %-sequences are defined.
%p The empty string when no passphrase is needed,
the string "PGPPASSFD=0" if one is needed.
This is mostly used in conditional % sequences.
%f Most PGP commands operate on a single file or a file
containing a message. %f expands to this file's name.
%s When verifying signatures, there is another temporary file
containing the detached signature. %s expands to this
file's name.
%a In "signing" contexts, this expands to the value of the
configuration variable $pgp_sign_as. You probably need to
use this within a conditional % sequence.
%r In many contexts, mutt passes key IDs to pgp. %r expands to
a list of key IDs.
The following command formats are defined:
$pgp_decode_command Decode application/pgp messages. This
command operates with and without pass phrases.
$pgp_verify_command Verify a PGP/MIME signature.
$pgp_decrypt_command Decrypt a PGP/MIME encrypted MIME body.
This command always gets a pass phrase.
$pgp_sign_command Sign a PGP/MIME body. This command always
gets a pass phrase.
$pgp_encrypt_sign_command Encrypt and sign a MIME body. This
command always gets a pass phrase.
$pgp_encrypt_only_command Encrypt a MIME body, but don't sign it.
$pgp_import_command Import PGP keys from a file.
$pgp_export_command Export PGP keys to a file. The output must
be ASCII armored.
$pgp_verify_key_command Check a public key. This is used from the
key selection menu.
$pgp_list_secring_command List the secret keys matching some hints
given in %r.
$pgp_list_pubring_command List the public keys matching some hints
given in %r.
The passphrase is always passed on stdin; all commands must send
their output to stdout and stderr.
|