4

I'm using mutt, with notmuch-mutt indexing the mail. I have a macro defined in mutt to search multiple mailboxes, using notmuch's integration (as suggested in the man page).

macro index <F3> \
  "<enter-command>set my_old_pipe_decode=\$pipe_decode my_old_wait_key=\$wait_key nopipe_decode nowait_key<enter>\
  <shell-escape>notmuch-mutt -r --prompt search --decrypt<enter>\
  <change-folder-readonly>`echo ${XDG_CACHE_HOME:-$HOME/.cache}/notmuch/mutt/results`<enter>\
  <enter-command>set pipe_decode=\$my_old_pipe_decode wait_key=\$my_old_wait_key<enter>" \
  "notmuch: search mail"

I also have GPG-encrypted email. mutt can unencrypt these fine, and its internal search works perfectly on the encrypted emails. However, notmuch-mutt fails to search these properly. Notmuch 0.6 (from 2011) apparently supports GPG, however this doesn't work for me out of the box. I'm running Notmuch 0.20.2. Is there a way to search encrypted mails using notmuch-mutt?

5
  • Did you found a solution for this? If so, could you post it?
    – gxx
    Jan 16, 2016 at 14:51
  • No, I still haven't found a solution. FWIW I'm not running Notmuch 0.21 and it's still not working out of the box.
    – Sparhawk
    Jan 16, 2016 at 21:37
  • Which OS are you using?
    – gxx
    Feb 9, 2016 at 10:37
  • @gf_ (Arch) Linux.
    – Sparhawk
    Feb 9, 2016 at 11:04
  • See the update in my answer.
    – gxx
    Mar 18, 2018 at 0:25

1 Answer 1

3

Update as of 2018/03/18: This feature was merged upstream, and released in notmuch 0.26.

Please note:

The contents of the index are sufficient to roughly reconstruct the cleartext of the message itself, so please ensure that the notmuch index itself is adequately protected. DO NOT USE this feature without considering the security of your index.

See the comments below this answer how to make use of this feature.

--

This is in the works upstream, as of today, 2016/02/09. Quoting the linked mail:

This is the third draft of the series initially announced in id:1449718786-28000-1-git-send-email-dkg at fifthhorseman.net (second draft was in id:1453258369-7366-1-git-send-email-dkg at fifthhorseman.net). It differs from v2 in that it incorporates the recent improvements in detecting and processing S/MIME signatures.

From the v2 description:

Notmuch currently doesn't index the cleartext of encrypted mail. This is the right choice by default, because the index is basically cleartext-equivalent, and we wouldn't want every indexed mailstore to leak the contents of its encrypted mails.

However, if a notmuch user has their index in a protected location, they may prefer the convenience of being able to search the contents of (at least some of) their encrypted mail.

This series of patches enables notmuch to index the cleartext of specific encrypted messages when they're being added via "notmuch new" or "notmuch insert", via a new --try-decrypt flag.

If --try-decrypt is used, and decryption is successful for part of a message, the message gets an additional "index-decrypted" tag. If decryption of part of a message fails, the message gets an additional "index-decryption-failed" tag.

v2 addresses the concerns raised from the helpful feedback on the previous series, and adds a notmuch_indexopts_t object that can be used to declare options for indexing messages, including a "try_decrypt" boolean.

Additionally, this series adds a new function to libnotmuch:

notmuch_message_reindex (notmuch_message_t *message, notmuch_indexopts_t *indexopts)

Which allows user of the library to adjust the indexing options of a given message.

The CLI is additionally augmented with a new notmuch subcommand, "notmuch reindex", which also has a --try-decrypt flag.

So a user who has their message index stored securely and wants to index the cleartext of all encrypted messages they've received can do something like:

notmuch reindex --try-decrypt tag:encrypted and not tag:index-decrypted

Or can clear all indexed cleartext from their database with:

notmuch reindex tag:encrypted and tag:index-decrypted

9
  • 1
    Just as an update, it looks like this feature has still not been implemented. There have been a dozen updates to notmuch, but reindex hasn't been added yet. The "bug tracker" is very hard to search, but I think this is the most recent post.
    – Sparhawk
    May 2, 2017 at 2:01
  • It was finally merged and released in notmuch 0.26. :)
    – gxx
    Mar 18, 2018 at 0:26
  • @gf I tried $ notmuch config set index.try_decrypt true, which added try_decrypt=true to ~/.notmuch-config, then I tried $ notmuch reindex --try-decrypt tag:encrypted and not tag:index-decrypted, but got Unrecognized option: --try-decrypt. I'm using notmuch 0.26.
    – Sparhawk
    Mar 19, 2018 at 11:34
  • @Sparhawk Where did you get --try-decrypt from?
    – gxx
    Mar 19, 2018 at 15:23
  • 1
    Great! :) I've added some more information, for other people reading this, in the beginning of the answer.
    – gxx
    Mar 20, 2018 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.