kosmos/husk-milter
8
0
Fork 0
Code Issues Packages Activity

Milestone 5 reached

Browse Source 
Previously when Husk encountered an email which it could not encrypt, because it couldn’t get an authenticated certificate for the recipient, it let the email pass without modifications. This was especially true for emails with several recipients – if just one of them was without a certificate, the email was not encrypted.

With milestone 5, Husk now deals with the above situation. In that case, the email processing is split into two flows, producing a encrypted mail for all recipients with an authenticated certificate and sending the mail unencrypted for those recipients who don’t. The email headers are modified accordingly to avoid email loops and a footer is added so that a recipient still knows who else got this email.

This milestone also includes fixing of minor bugs and code improvements, to mention a few:

- Introducers where listed for each authentication path, now this list is deduplicated.
- Detect ANSI control characters in User ID as they can be used for malicious proposes.
This commit is contained in:
Malte Meiboom
2026-08-03 11:45:34 +02:00
parent 876eebd73d
commit 5cf7357230
1 changed files with 10 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -21
View File
@@ -8,32 +8,21 @@ Husk is written in Rust and uses Sequoia PGP for encryption and certificate hand
## Status
Milestone 4 is reached and Husk gains some new features:
Milestone 5 is reached and Husk gains some new features:
Previously when Husk encountered an email which it could not encrypt, because it couldn’t get an authenticated certificate for the recipient, it let the email pass without modifications. This was especially true for emails with several recipients – if just one of them was without a certificate, the email was not encrypted.
With milestone 5, Husk now deals with the above situation. In that case, the email processing is split into two flows, producing a encrypted mail for all recipients with an authenticated certificate and sending the mail unencrypted for those recipients who don’t. The email headers are modified accordingly to avoid email loops and a footer is added so that a recipient still knows who else got this email.
This milestone also includes fixing of minor bugs and code improvements, to mention a few:
- Introducers where listed for each authentication path, now this list is deduplicated.
- Detect ANSI control characters in User ID as they can be used for malicious proposes.
- Husk will wrap an email it encrypts into a fitting mime structure
so that MTUs (Mail user agent, like Thunderbird) can display the
message properly.
- Husk now can deal which attachments.
- Header protection will be used with encrypted emails.
- Husk can sign messages if you provide it with an appropriate key.
- Hush can now send itself into the background. It now understands start, stop
and status.
- When building Husk from source, files for shell completion are generated.
- When listing introducers their associated domains are also displayed.
Please refer to the [documentation](https://www.husk-project.org/documentation) for a full list of all
features and their usage.
Husk can now be used safely for pass-through mail encryption, **but**:
As Husk only encrypts if an authenticated certificate is available, emails
with more than one recipient are only encrypted if there are certificates
for all recipients - otherwise the mail will not be changed. That means
that even if a certificate is available for a certain recipient, it might
not be used.
This behavior will be improved in milestone 5.
## Documentation
The documentation (with install instructions) can be found [here](https://www.husk-project.org/documentation).