Add support for mobileconfig signing

rseichter / automx2

Mail User Agent (email client) configuration made easy

GNU General Public License v3.0

65 stars 20 forks source link

Add support for mobileconfig signing #11

Closed sriccio closed 2 years ago

sriccio commented 2 years ago

This is a first attempt at supporting mobileconfig signing as a per "provider" basis.

This adds 3 columns to the provider table:

sign - enable or disable signing for this provider (0/1)
sign_key - The signing private key for the provider
sign_cert - The signing corresponding certificate for the provider

It requires M2Crypto python package and some system packages (example for debian/ubuntu):

build-essential
python3-dev or python-dev
libssl-dev
swig

TODO ?:

Maybe find a more secure way to store private key in the DB
Document the usage
Add tests

sriccio commented 2 years ago

The resulting mobileconfig shows green (verified) when signed:

rseichter commented 2 years ago

Hello Sébastien.

As stated clearly in the project's main README file, I do not accept code contributions for automx2, mostly to avoid potential copyright issues.

Besides, it is considered proper form to first open an issue describing the proposal one has in mind, allowing for discussion of ideas, methods, and restrictions. This avoids investing time in code which may not be accepted, as happened in this case. Only after that should code be provided. I also consider additional documentation and unit tests covering all affected code necessary right away, not simply listed as TODOs for a later time, as a mark of quality.

I'll be closing this pull request. Please don't take it personally; it definitely is not.

sriccio commented 2 years ago

Hello Ralph,

Thank you for the feedback. It's true I did not read the Contribution part of the README and I went a bit too fast issuing a PR right away. I'll now refrain from doing so. I was just happy to maybe propose something and contribute to a project.

Kind regards.

rseichter commented 2 years ago

I can imagine you feeling disappointed, which is not my intent. I have been mulling a signature feature for Mobileconfig myself, but have not come up with a method that fully satisfied me. What crypto package to use, how to safely store the key material, and so forth. If I may, I might revisit your suggestions in the future, for inspiration.