Error: Unknown message type: SIGNATURE when verifying message from gmail

offby1 commented 10 years ago

This might be related to #134.

I just received a PGP-signed message via gmail, and decided to paste it into keybase to verify it. I expected the verification to fail with a message to the effect of "this signature looks good, but it's from some random stranger that we can't vouch for", because the sender is indeed someone I've never tracked, or anything.

Anyway: here is what I did, and what I saw.

I grabbed the contents of the message from gmail by clicking the little dropdown in the upper-right, and choosing "show original". That took me to this URL (which of course will be a big fat 404 for you, since you're not me, but I'm including it for completeness): https://mail.google.com/mail/u/0/?ui=2&ik=f230ce0fde&view=om&th=14571740989ed74b

The message is your average multi-part MIME message with tons of headers; way down at the bottom there is what looks to me like a perfectly valid PGP signature block:


Received-SPF: neutral (google.com: 129.10.115.117 is neither permitted nor denied by domain of users-bounces@racket-lang.org) client-ip=129.10.115.117;
Received-SPF: pass (google.com: domain of gclru-users@m.gmane.org designates
 80.91.229.3 as permitted sender) client-ip=80.91.229.3; 
To: users@racket-lang.org
From: Lehi Toskin <lehi@tosk.in>
Date: Thu, 17 Apr 2014 20:48:04 +0000 (UTC)
Lines: 39
Message-ID: <lipem4$5cl$1@ger.gmane.org>
Mime-Version: 1.0
User-Agent: Pan/0.139 (Sexual Chocolate; GIT bf56508 git://git.gnome.org/pan2)
Subject: [racket] Introducing Blight - A Tox Client in Racket
Precedence: list
Content-Type: multipart/mixed; boundary="===============7846274802349329113=="
Errors-To: users-bounces@racket-lang.org
Sender: "users" <users-bounces@racket-lang.org>

--===============7846274802349329113==
Content-Type: multipart/signed; protocol="application/pgp-signature";
    micalg=pgp-sha1; boundary="=-oybjoNWEgsm/Mr2/5Ixh"

--=-oybjoNWEgsm/Mr2/5Ixh
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

I've recently started programming a GUI client for Tox (http://tox.im), a=20
GPLv3+ licensed, totally distributed, P2P secure instant messenger that=20
aims to supplant Skype in all areas: text, voice, and video. Blight is in=20
early development, so it doesn't do too much except display a few GUI=20
frames and bootstrap into the Tox network, but all the same I'd like for=20
anyone interested to take a look and return with some questions,=20
comments, concerns. This is my first "real", non-trivial program and I'm=20
excited to continue its development. The git repositories can be found=20
below:

Client:
https://github.com/lehitoskin/blight

Wrapper for the Tox library:
https://github.com/lehitoskin/libtoxcore-racket

Tox Core library
https://github.com/irungentoo/ProjectTox-Core=

--=-oybjoNWEgsm/Mr2/5Ixh
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc

-----BEGIN PGP SIGNATURE-----

iQEcBAABAgAGBQJTUD4EAAoJEFdIuXZ3LtXUVzoIAI+UNJWm4jYCtAmuibsL5ocg
YcS+VQfG9oMUAyyOpz5oY/NOFidACjGVE/spTT6APa46cU55+FY39H8sKeFb30Tt
i7bZC8D0JXm/BZxOaxOkwKyQNYiENiP6k7vDHR4BsgDJPjY0MpHOHaj3tx1jAJB2
H7L3HhwhEVZs/oO5HJt9jmlDO4TW/GseJld3eIRu1Azj3SFKUXjPSpmkO5mSIsDe
sd417t/3Pu6xkMBqxsc0eteEbc4k6vbBZO3BtOeDmijNS6PEhUD4rED5BRvj5nPX
aRf1SZpUPbiWGFqB6OTxg1GvWZAp0VBGuHBdfrF2MrDXJ2A7hHXAMQGZS/ptiaI=
=kC9z
-----END PGP SIGNATURE-----

--=-oybjoNWEgsm/Mr2/5Ixh--

--===============7846274802349329113==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

____________________
  Racket Users list:
  http://lists.racket-lang.org/users

--===============7846274802349329113==--

Anyway: I pasted the entire message into the big box at https://keybase.io/verify, and clicked the "Verify" button. But instead of seeing the message I expected, I simply saw Error: Unknown message type: SIGNATURE, which makes no sense to me at all.

maxtaco commented 10 years ago

It appears we're not handling detached signatures properly. I'm not entirely sure how it would work U/I-wise, since you've only pasted in half of the needed data. For a detached signature, you also need to paste in the original file that the signature is computer over.

offby1 commented 10 years ago

Sorry, I was afraid that would happen -- I only pasted the signature here in this bug report, but I pasted the entire email into keybase right before I got the unexpected message. I've updated my comment above with the complete message.

keybase / keybase-issues

Error: Unknown message type: SIGNATURE when verifying message from gmail #621