Bug 80066

Summary:	Handling of unknown email signatures: show which kind of signature is unknown and automate downloading this signature
Product:	[Applications] kmail2	Reporter:	Marcin Kasperski <Marcin.Kasperski>
Component:	crypto	Assignee:	kdepim bugs <kdepim-bugs>
Status:	REOPENED ---
Severity:	wishlist	CC:	kde, pino
Priority:	NOR
Version:	4.9.0
Target Milestone:	---
Platform:	Compiled Sources
OS:	Linux
Latest Commit:		Version Fixed In:
Sentry Crash Report:
Attachments:	Enable KGpg calls for key import & info

Description Marcin Kasperski 2004-04-21 15:16:58 UTC

Version:            (using KDE KDE 3.2.1)
Installed from:    Compiled From Sources
OS:          Linux

The situation: I am reading PGP-signed email signed with the key I do not currently know.
There are two things which could be improved:

a) In such case my kmail shows text (it is in Polish but the problem is likely to be generic: 'Wiadomość została podpisana nieznanym kluczem 0xFFFFFFFFFFFFF. Nie można sprawdzić poprawności podpisu.' (message is signed with unknown key 0xFFFFFFFFFFF The signature can not be verified'. This text missess one very important information: the KIND of key. In this case it should tell 'message is signed with unknown *PGP* key...'. It is worth remembering that one can (try) configuring S/MIME support too.

So: information that the message is signed should contain information about the signature kind I think that in case signature uses known key and is verified it should tell it too).

b) In case I miss such public key, to download it, I usually must open kgpg, open its key server window, copy&paste the key identifier to the key search window, then go back to kmail, click some other mail and click this mail again. One can easily find a lot of possible improvements here. I imagine for instance
- whenever info about unknown PGP key is presented, there is either in-text button or right-click context menu position 'Download this key'
- after selecting this position I see some kind of key search window (with button to abort search available), after the search is found it is automatically imported,
- after i close the window above I return to kmail and the freshly downloaded key is automatically used to verify the signature - so I just see the info that the signature was verified

Comment 1 Henrique Pinto 2004-04-21 15:37:42 UTC

Em Qua 21 Abr 2004 10:17, Marcin Kasperski escreveu:
> b) In case I miss such public key, to download it, I usually must open
> kgpg, open its key server window, copy&paste the key identifier to the key
> search window, then go back to kmail, click some other mail and click this
> mail again. One can easily find a lot of possible improvements here. I
> imagine for instance - whenever info about unknown PGP key is presented,
> there is either in-text button or right-click context menu position
> 'Download this key' - after selecting this position I see some kind of key
> search window (with button to abort search available), after the search is
> found it is automatically imported, - after i close the window above I
> return to kmail and the freshly downloaded key is automatically used to
> verify the signature - so I just see the info that the signature was
> verified

One can configure gpg to automatically fetch unknown keys from key servers.

Comment 2 Marcin Kasperski 2004-04-21 16:26:54 UTC

This option is not present anywhere withing kgpg configuration so - for the average KDE user - it does not exist. Maybe it would be good idea to add it somewhere within kgpg configuration. But I am afraid that turning it on will cause painful experience - as it is gpg option, there will be no 'downloading key' window with Abort button, probably no clue what is going on at all and probably long delay while opening the mail message.

Comment 3 Henrique Pinto 2004-04-21 16:59:51 UTC

Em Qua 21 Abr 2004 11:26, Marcin Kasperski escreveu:
> This option is not present anywhere withing kgpg configuration so - for the
> average KDE user - it does not exist. Maybe it would be good idea to add it
> somewhere within kgpg configuration.

File a wish item for KGpg.

Comment 4 bj 2004-05-17 01:25:41 UTC

Just saw this thread. Configuring gpg to automatically download unknown keys is really bad for the GUI, because there is no feedback, so KGpg or KMail will likely freeze until the key is fully downloaded.
I just added a new DCOP method to KGpg that offers just what is requested in b). All that is needeed now is adding a button in KMail to perform the task...

The DCOP method works like this:
dcop kgpg KeyInterface importRemoteKey 0x000000
where 0x00000 is the key ID. It brings KGpg's key import dialog, with possibility to abort.

The biggest problem I see is that KGpg is in kdeutils and not in kdepim, so KGpg will not necessarily be present... I will forward the info to the kde-pim list.

Comment 5 bj 2004-05-21 19:30:03 UTC

Created attachment 6079 [details]
Enable KGpg calls for key import & info

This patch changes KMail so that when a message is signed with an unknown key,
you just need to click on the key ID in KMail to import it from a keyserver.
Clicking on a known key brings up a key info dialog.
It is all done through DCOP calls to KGpg.
Requires latest kgpg & kmail cvs.

Comment 6 Marcin Kasperski 2004-05-21 20:24:13 UTC

Great!

Minor note: as it can be fairly unobvious for the user what will happen after click, I'd do something like:

- append additional explanation to the info, so it reads for instance
    Message was signed with unknown key 0x34234234 (click to import).
  and 
    Message was signed by John Smith (click to view).
  
- or create statusbar notification of similar type when the mouse is over the link

Comment 7 Marcin Kasperski 2004-11-12 22:43:57 UTC

BTW: what about smaller part of this bug - a) (information about the signature type)?

Comment 8 ieure 2005-02-02 23:08:06 UTC

Is there any chance of getting this patch applied in the near future? I'd very much like to see this feature.

Comment 9 Rolf Eike Beer 2007-09-19 19:35:09 UTC

*** Bug 112438 has been marked as a duplicate of this bug. ***

Comment 10 Myriam Schweingruber 2012-08-18 08:04:07 UTC

Thank you for your feature request. Kmail1 is currently unmaintained so we are closing all wishes. Please feel free to reopen a feature request for Kmail2 if it has not already been implemented.
Thank you for your understanding.

Comment 11 Rolf Eike Beer 2012-08-18 13:09:36 UTC

Situation in KMail2 is still the same.