kosmos/husk-milter
8
0
Fork 0
Code Issues Packages Activity

Sign encrypted mails.

Browse Source 
- Husk now not only encrypts outgoing emails (if possible) but also adds
  a signature.
- Rework the internal handling of the signing key.
- Integrate the signing into the workflow of the daemon.
- Add a configuration option for a subject replacement.
This commit is contained in:
Malte Meiboom
2026-06-18 13:24:24 +02:00
parent 06c0583f5e
commit e47b1b837c
10 changed files with 155 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/commands/signkey.rs
+14 -4
View File
@@ -1,6 +1,7 @@
//! signkey subcommand
use anyhow::Result;
use sequoia_cert_store::Store;
use sequoia_openpgp::serialize::SerializeInto;
use crate::cli::cli_args::{SignkeyCommand, SignkeySubcommand};
@@ -19,16 +20,25 @@ pub async fn dispatch(cmd: SignkeyCommand, config: HuskConfigContainer) -> Resul
if let Some(key) = context.signing_key {
println!("Fingerprint: {}", key.fingerprint());
} else {
println!("No active signing key available.");
eprintln!("No active signing key available.");
}
},
SignkeySubcommand::Dump => {
let context = HuskContext::new(&config.into())?;
if let Some(key) = context.signing_key {
let armored = key.armored().to_vec()?;
println!("{}", String::from_utf8(armored)?);
if let Ok(cert) = &context.cert_store.lookup_by_cert_fpr(&key.fingerprint()) {
if let Ok(cert) = cert.to_cert() {
let armored = cert.armored().to_vec()?;
println!("{}", String::from_utf8_lossy(&armored[..]));
} else {
eprintln!("Certificate {} is damaged", cert.fingerprint());
}
} else {
eprintln!("Cannot find certificate for key {}", key.fingerprint());
}
} else {
println!("No active signing key available.");
eprintln!("No active signing key available.");
}
}
}
src/common/crypto.rs
+38 -26
View File
@@ -17,10 +17,11 @@ use sequoia_net::{KeyServer, wkd, dane};
use sequoia_directories::Home;
use sequoia_keystore::Keystore;
use sequoia_keystore::Context;
use sequoia_keystore::Key;
use sequoia_openpgp::packet::prelude::SignatureBuilder;
use sequoia_openpgp::parse::{PacketParser, PacketParserResult, Parse};
use sequoia_openpgp::policy::StandardPolicy;
use sequoia_openpgp::serialize::stream::{Message, Armorer, Encryptor, LiteralWriter};
use sequoia_openpgp::serialize::stream::{Message, Armorer, Encryptor, Signer, LiteralWriter};
use sequoia_openpgp::{Fingerprint, Cert, Packet};
use sequoia_openpgp::cert::raw::RawCertParser;
use sequoia_openpgp::types::SignatureType;
@@ -422,10 +423,21 @@ pub fn encrypt(context: &HuskContext<'_>, body: &[u8], recipients: &Vec<Recipien
let mut sink = Vec::new();
let message = Message::new(&mut sink);
let message = Armorer::new(message).build()?;
let message = Encryptor::for_recipients(message, keys).build()?;
let mut message = LiteralWriter::new(message).build()?;
message.write_all(body)?;
message.finalize()?;
let mut message = Encryptor::for_recipients(message, keys).build()?;
if let Some(key) = &context.signing_key {
log::debug!("use signing key {}", key.fingerprint());
message = Signer::new(message, key.clone())?.build()?;
}
message = LiteralWriter::new(message).build()?;
// XXX: error handling!!!
std::thread::scope(|s| {
s.spawn(|| -> anyhow::Result<()> {
message.write_all(body)?;
message.finalize()?;
Ok(())
});
});
Ok(Bytes::from(sink))
} else {
@@ -599,7 +611,7 @@ pub fn can_sign(cert: &ValidCert) -> bool {
/// Get Husks signing key
pub fn get_signing_key(sequoia_home: Home, cert_store: &CertStore<'_>, policy: &StandardPolicy<'_>, local_trust_root: &Cert) -> anyhow::Result<Option<Cert>> {
pub fn get_signing_key(sequoia_home: Home, cert_store: &CertStore<'_>, policy: &StandardPolicy<'_>, local_trust_root: &Cert) -> anyhow::Result<Option<Key>> {
let local_trust_root = local_trust_root.with_policy(policy, None)?;
let local_trust_fpr = local_trust_root.fingerprint();
@@ -607,33 +619,31 @@ pub fn get_signing_key(sequoia_home: Home, cert_store: &CertStore<'_>, policy: &
let mut newest = None;
let mut result = None;
if let Some(keys) = get_all_keys(sequoia_home) {
for key in keys {
if let Ok(cert) = cert_store.lookup_by_cert_fpr(&key) {
if let Ok(vc) = cert.with_policy(policy, None) {
if let Some(time) = contains_signing_key(&vc, &local_trust_fpr) {
if let Some(othertime) = newest {
if time > othertime {
newest = Some(time);
result = Some(vc.cert().clone());
}
} else { // first detected key
let keys = get_all_keys(sequoia_home);
for key in keys {
if let Ok(cert) = cert_store.lookup_by_cert_fpr(&key.fingerprint()) {
if let Ok(vc) = cert.with_policy(policy, None) {
if let Some(time) = contains_signing_key(&vc, &local_trust_fpr) {
if let Some(othertime) = newest {
if time > othertime {
newest = Some(time);
result = Some(vc.cert().clone());
result = Some(key.clone());
}
} else { // first detected key
newest = Some(time);
result = Some(key.clone());
}
}
}
}
Ok(result)
} else {
Ok(None)
}
Ok(result)
}
/// If `vc` is a certificate marked as a Husk signing key, return the
/// creation time of the signature - else return `None`.
pub fn contains_signing_key(vc: &ValidCert, local_root_fpr: &Fingerprint) -> Option<SystemTime> {
log::debug!("check {} for signing key", vc.fingerprint());
for uid in vc.userids() {
for sig in uid.certifications() {
if sig.issuer_fingerprints().any(|i| i == local_root_fpr)
@@ -641,6 +651,7 @@ pub fn contains_signing_key(vc: &ValidCert, local_root_fpr: &Fingerprint) -> Opt
// ignore signatures without creation time
if let Some(time) = sig.signature_creation_time() {
log::debug!("found");
return Some(time);
}
}
@@ -651,7 +662,7 @@ pub fn contains_signing_key(vc: &ValidCert, local_root_fpr: &Fingerprint) -> Opt
/// Get all keys from all backends
// XXX: Maybe the softkeys backend is sufficient
pub fn get_all_keys(sequoia_home: Home) -> Option<Vec<Fingerprint>> {
pub fn get_all_keys(sequoia_home: Home) -> Vec<Key> {
let mut result = Vec::new();
std::thread::scope(|s| {
@@ -660,14 +671,14 @@ pub fn get_all_keys(sequoia_home: Home) -> Option<Vec<Fingerprint>> {
.home(sequoia_home.data_dir(sequoia_directories::Component::Keystore))
.build() {
if let Ok(mut keystore) = Keystore::connect(&keystore_base) {
if let Ok(mut backends) = keystore.backends() {
for backend in &mut backends {
log::debug!("scanning backend {:?}", backend.id());
if let Ok(devices) = backend.devices() {
for mut device in devices {
if let Ok(keys) = device.keys() {
keys.iter().for_each(|k| {
result.push(k.fingerprint());
result.push(k.clone());
});
}
}
@@ -678,7 +689,7 @@ pub fn get_all_keys(sequoia_home: Home) -> Option<Vec<Fingerprint>> {
}
});
});
Some(result)
result
}
#[cfg(test)]
@@ -821,6 +832,7 @@ jk6lh01Ej9QTGQ==
signing_key: None,
introducers: Vec::new(),
keyservers: Vec::new(),
subject_replacement: "...".into(),
mail: MailContext::new()
};
@@ -836,7 +848,7 @@ jk6lh01Ej9QTGQ==
softkeys.import(&signing_key)?;
let keys= get_all_keys(home.clone());
eprintln!("{:?}", keys);
for key in keys { eprintln!("{}", key.fingerprint()); }
super::set_signing_key(&context, &valid_signing_cert)?;
src/config.rs
+29 -1
View File
@@ -9,13 +9,14 @@ use toml;
use log4rs;
use crate::types::errors::HuskError;
use crate::types::defaults::CONSOLE_LOGGING;
use crate::types::defaults::{CONSOLE_LOGGING, SUBJECT_REPLACEMENT};
#[derive(Deserialize, Debug, Clone)]
pub struct HuskConfig {
pub connection: String,
pub sequoia_home: String,
pub keyservers: Option<Vec<String>>,
pub subject_replacement: Option<String>,
logging: Option<toml::Value>,
}
@@ -68,6 +69,13 @@ impl HuskConfig {
}
}
pub fn get_subject_replacement(&self) -> String {
if let Some(replacement) = &self.subject_replacement {
replacement.clone()
} else {
SUBJECT_REPLACEMENT.to_string()
}
}
}
pub type HuskConfigContainer = Arc<Mutex<HuskConfig>>;
@@ -79,3 +87,23 @@ impl From<HuskConfigContainer> for HuskConfig {
}
}
#[cfg(test)]
mod tests {
use crate::types::defaults;
use super::HuskConfig;
#[test]
fn subject_line() {
let config = HuskConfig {
connection: "".into(),
sequoia_home: "".into(),
keyservers: None,
subject_replacement: None,
logging: None
};
assert_eq!(config.get_subject_replacement(), defaults::SUBJECT_REPLACEMENT);
}
}
src/daemon/mod.rs
+5
View File
@@ -241,6 +241,11 @@ impl Daemon {
}
}
}
// Change the subject
let _ = cx.actions.change_header(
"Subject",
1,
Some(context.subject_replacement.clone())).await;
},
Err(e) => {
log::error!("{}", e);
src/types/defaults.rs
+6 -2
View File
@@ -1,9 +1,13 @@
//! Defaults
pub const CONFIG_FILE_LOCATION: &'static str = "/etc/husk/config.toml";
pub const CONFIG_FILE_LOCATION: &str = "/etc/husk/config.toml";
/// If encrypting a mail, the subject is moved into the encrypted body
/// and replaced by `SUBJECT_REPLACEMENT` (unless configured otherwise).
pub const SUBJECT_REPLACEMENT: &str = "...";
/// Default logging configuration.
pub const CONSOLE_LOGGING: &'static str = "
pub const CONSOLE_LOGGING: &str = "
[appenders.console]
kind = \"console\"
src/types/husk_context.rs
+9 -2
View File
@@ -15,6 +15,7 @@ use sequoia_openpgp::policy::StandardPolicy;
use sequoia_openpgp::Cert;
use sequoia_cert_store::CertStore;
use sequoia_directories::Home;
use sequoia_keystore::Key;
use crate::config::HuskConfig;
use crate::common::crypto;
@@ -26,9 +27,10 @@ pub struct HuskContext<'hc> {
pub policy: StandardPolicy<'hc>,
pub cert_store: CertStore<'hc>,
pub local_trust_root: Cert,
pub signing_key: Option<Cert>,
pub signing_key: Option<Key>,
pub introducers: Vec<Introducer>,
pub keyservers: Vec<String>,
pub subject_replacement: String,
pub mail: MailContext<'hc>,
}
@@ -48,9 +50,13 @@ impl<'hc> HuskContext<'hc> {
let signing_key = match crypto::get_signing_key(sequoia_home, &cert_store, &policy, &local_trust_root) {
Ok(Some(cert)) => Some(cert),
_ => {
Ok(None) => {
log::warn!("No signing key found");
None
},
Err(e) => {
log::error!("Error while fetching signing key: {}", e);
None
}
};
@@ -61,6 +67,7 @@ impl<'hc> HuskContext<'hc> {
signing_key,
introducers,
keyservers: config.get_keyservers(),
subject_replacement: config.get_subject_replacement(),
mail: MailContext::new(),
})
}