Hello,

The pattern `Mime-Version` only appears in the tests. I'm new to Go and
am wondering where and which module we're using to set this attribute.
I'd like to know so I can propose the upstream to change the casing to
`MIME-Version`, following the RFC1341 convention.

This is important because some email providers automatically change the
casing to the RFC1341 convention, which compromises the integrity of GPG
signatures since MIME-Version is signed with the rest of the email body.

Thank you,
Coco

On Sat Feb 25, 2023 at 8:13 AM CST, Coco Liliace wrote:
> Hello,
>
> The pattern `Mime-Version` only appears in the tests. I'm new to Go and
> am wondering where and which module we're using to set this attribute.
> I'd like to know so I can propose the upstream to change the casing to
> `MIME-Version`, following the RFC1341 convention.
>
> This is important because some email providers automatically change the
> casing to the RFC1341 convention, which compromises the integrity of GPG
> signatures since MIME-Version is signed with the rest of the email body.

This was a tough one to track down. aerc uses go-message to write the messages,
which in turn is setting the header as MIME-Version. However, it's relying on
the stdlib "net/textproto" package to add keys to the header:

https://pkg.go.dev/net/textproto#CanonicalMIMEHeaderKey

This converts 'MIME-Version' to 'Mime-Version'. It would be difficult to fix
this in go-message, because it's using the call to
textproto.CanonicalMIMEHeaderKey in a lot of places, but a wrapper around it
is probably best, and then replace all the internal calls to textproto to the
wrapper.

Hope that helps!

-- 
Tim

On Sat Feb 25, 2023 at 10:11 AM EST, Tim Culverhouse wrote:
> This converts 'MIME-Version' to 'Mime-Version'. It would be difficult to fix
> this in go-message, because it's using the call to
> textproto.CanonicalMIMEHeaderKey in a lot of places, but a wrapper around it
> is probably best, and then replace all the internal calls to textproto to the
> wrapper.

Thank you for tracking this down and providing a helpful starting point!
I'd like to try submitting a patch for this, though it may take some
time as I'm still learning Go :)

Coco

On Sat Feb 25, 2023 at 10:51 PM EST, Coco Liliace wrote:
> I'd like to try submitting a patch for this, though it may take some
> time as I'm still learning Go :)

The go-message developer suggested leaving it as is and fixing it from
the email provider's side. So I will not submit a patch for this after
all. Sorry for the troubles and thanks again for tracking this down.

https://github.com/emersion/go-message/issues/165#issuecomment-1445388235

Coco