Example using poor-smime-sign - python-3.x

Question

I am trying to send SMIME signed email and fail.
I use Python 3, so I chose the poor-smime-sign library.
Using Thunderbird to recieve, I either get an empty email with "undisclosed recipients" and no subject, which is signed or I get the whole thing in plain-text, printing a huge blob of base64 with the message-body - no sign of signing (pun unintended, noticed and left intact).
I have compared the source of a working email (created by Thunderbird from my sent folder) with my franken-mails, but I don't quite see the difference.
Here's the code:
from poor_smime_sign import smime_sign
def signEmail(self, message :str) -> str:
"""Sign the message-body.
The message is encoded in UTF-8, signed and then returned as Unicode.
Check this document on how to generate untrusted example-keys:
https://tools.ietf.org/doc/python-m2crypto/howto.smime.html
Check the settings ('invmail'->'keydir') where to put the keys.
The privateKey is called 'signer_key.pem' and publicKey 'signer.pem'.
"""
import os
privateKey = os.path.join(settings.SF.mail['keydir'], 'signer_key.pem')
publicKey = os.path.join(settings.SF.mail['keydir'], 'signer.pem')
try:
signed = smime_sign(publicKey, privateKey, message.encode('UTF-8'))
except Exception as e:
raise(Exception("Problem during signing: "+str(e)))
return signed.decode('UTF-8')
poor_smime_sign btw is pretty humble about their module, which I quite like. I looked at their code and all they do is call openssl, which is what I would have done, too, as the next step. If you're troubleshooting you can go into the mod and log the command that gets executed and fiddle with that in a shell until you understand why it fails. I e.g. had pub and priv cert the wrong way and got a really stupid error message.
This is what puts the message together in the end. I had copied it from some example somewhere.
body = self.signEmail(body)
emailAr = [
"From: %s" % emailFrom,
"To: %s" % emailTo,
"Subject: %s" % subject,
"", # <- that one
body,
]
message = "\r\n".join(emailAr)
#...
server.sendmail(emailFrom, [emailTo], message.encode('UTF-8'))

Answer 1

TL;DR:
Get the headers right: Signing already creates a header. Just add to that. No empty new lines.
Well, turns out I had no idea how email works. I was indeed wondering about why I use the TO-address twice (once constructing the message and once in sendmail()) but it took a while until I figured it out. I knew, that I needed some sort of header but I did not know where and why.
The solution was twofold:
The text that gets signed needs a header so the email client knows what to do with it. I took one from a working email I had lying around.
Looks like this.
cannedHeader = "\r\n".join([
"Content-Type: text/plain; charset=utf-8; format=flowed",
"Content-Language: de-DE",
"Content-Transfer-Encoding: quoted-printable",
"","" # emtpy new line concludes header
])
body = cannedHeader+bodyInput
body = self.signEmail(body)
The signed message-body already comes with a partial header attached to it. Printing out the result of signing, you see it starts with
MIME-Version: 1.0 Content-Type: multipart/signed;
protocol=3Dpplication/x-pkcs7-signature"; m= icalg=3Dha-256";
boundary=3D---DF20A931579CC3CE98F68AEF4D387131"
This is an S/MIME signed message
------DF20A931579CC3CE98F68AEF4D387131
And I ran that through the initial version of the code, generating two headers in the process. One with recipients and subject suffixed by an empty new line, and then added the signed message-body, which had another header, containing SMIME information, also suffixed by an empty new line. That could not work. So removing the empty line (in the question marked with "that line") fixed this.
As I have not found any example on stackexchange, I thought I'd write this down, so I can find it when I need it the next time.