Properly encrypt and sign to multiple recipients - will fix #41 (#42)

Refactor envelope.py to support multiple recipient certificates
and to use binary PKCS7 options for encryption

---------

Co-authored-by: G22147 <[email protected]>

envelope/envelope.py

@@ -1335,6 +1335,17 @@ def smime_sign_encrypt(self, email, sign, encrypt):
         else:
             pubkey = encrypt
 
+        certificates = encrypt
+
+        recipient_certs = []
+        for cert in certificates:
+            try:
+                c = load_pem_x509_certificate(cert)
+            except ValueError as e:
+                raise ValueError("failed to load certificate from file")
+
+            recipient_certs.append(c)
+
         try:
             pubkey = load_pem_x509_certificate(pubkey)
         except ValueError as e:
@@ -1344,7 +1355,11 @@ def smime_sign_encrypt(self, email, sign, encrypt):
         envelope_builder = pkcs7.PKCS7EnvelopeBuilder().set_data(signed_email)
         envelope_builder = envelope_builder.add_recipient(pubkey)
 
-        options = [pkcs7.PKCS7Options.Text]
+        for recip in recipient_certs:
+            envelope_builder = envelope_builder.add_recipient(recip)
+
+
+        options = [pkcs7.PKCS7Options.Binary]
         encrypted_email = envelope_builder.encrypt(serialization.Encoding.SMIME, options)
         return encrypted_email
 
@@ -1397,7 +1412,7 @@ def _encrypt_smime_now(self, email, sign, encrypt: Union[None, bool, bytes, List
             output = self.smime_sign_only(email, sign)
 
         elif sign and encrypt:
-            output = self.smime_sign_encrypt(email, sign, encrypt[0])
+            output = self.smime_sign_encrypt(email, sign, encrypt)
 
         elif not sign and encrypt:
             output = self.smime_encrypt_only(email, encrypt)