Are gpg signatures considered attachments?

[Alphax]

Thorsten Haude wrote:
> Hi,
> 
> * Chris wrote (2005-12-28 00:45):
> 
<snip>
>>On the bad signature I see this when looking at the msg source:
>>
>>--nextPart5566026.XhGQNAZr0e
>>Content-Type: text/plain;
>> charset="iso-8859-1"
>>Content-Transfer-Encoding: quoted-printable
>>Content-Disposition: inline
>>
>>On a good signature I see this:
>>
>>Content-Type: text/plain;
>> charset="iso-8859-1"
>>Content-Transfer-Encoding: 7bit
>>Content-Disposition: inline
> 
> 
> This is from a single mail, before and after it got munged by the
> mailing list software? If not, *are* the mails changed that way? In
> what way are they changed?

I can answer this in part... "quoted-printable" equals-escapes things
such as newlines and equals signs - which of course changes the message
hash, invalidating the signature. Any mailing list software which
changes message encoding is EVIL.


>>Its even gotten so messed up that some have their signatures show bad when 
>>adding a sig to the bottom of the message, leaving it off shows the 
>>signature as valid.  The opinion on the list is that something is 
>>definately out of whack in the list software configuration.
> 
> 
> So whack it over the head. These things can be changed. What software
> do they use? What does the list provider say? What does the creator of
> the mailing list say?
> 
> 

Mailman seems to be okay with such things... generally adding a mailing
list footer won't mangle PGP/MIME (I've never seen it mangle inline
PGP), but once you add attachments the list footer will start breaking
things.

-- 
Alphax                      |   /"\
Encrypted Email Preferred   |   \ /     ASCII Ribbon Campaign
OpenPGP key ID: 0xF874C613  |    X   Against HTML email & vCards
http://tinyurl.com/cc9up    |   / \
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 556 bytes
Desc: OpenPGP digital signature
Url : /pipermail/attachments/20051228/6df01c63/signature.pgp