From dbdf194f8b50568ba2ca4336fa477c7812525224 Mon Sep 17 00:00:00 2001
From: Conrad Hoffmann <ch@bitfehler.net>
Date: Wed, 5 Mar 2025 14:45:41 +0100
Subject: [PATCH] email/worker: catch some PGP error earlier

The writer returned by pgpmail.Encryption() will have the keyring
parsed, but it only tries to determine the encryption key once it is
being written to. Hence, certain errors will only occur later on, when
it is too late to fall back to unencrypted email.

Catch these errors earlier by checking if a valid encryption key is
found.
---
 email/worker.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/email/worker.go b/email/worker.go
index e2f48964697e3e04e61eb1b81775579550a07c48..fb9cb89cdc46b2a709f89685cbc32126b34167aa 100644
--- a/email/worker.go
+++ b/email/worker.go
@@ -72,6 +72,14 @@ func prepareEncrypted(rcptKey *string, header mail.Header,
 	}
 	rcptEntity := keyring[0]
 
+	// Make sure we can really encrypt with this key!
+	// pgpmail.Encrypt() returns a writer, and certain errors will only
+	// occur once it is written to.
+	_, ok := rcptEntity.EncryptionKey(time.Now())
+	if !ok {
+		return nil, fmt.Errorf("No valid encryption key found (expired?)")
+	}
+
 	return pgpmail.Encrypt(buf, header.Header.Header,
 		[]*openpgp.Entity{rcptEntity}, signed, nil)
 }