thunderbird / thunderbird/thunderbird-android

K-9 can't verify PGP signature when public key attached

Open
#6,511 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Kotlin
Stars
14k
Forks
2.8k
Avg merge
3d 3h
Merged PRs (30d)
57

Description

Checklist
  • I have used the search function to see if someone else has already submitted the same bug report.
  • I will describe the problem with as much detail as possible.
App version

6.400

Where did you get the app from?

Google Play

Android version

13

Device model

Pixel 4a

Steps to reproduce
  1. Thunderbird 102.5.1 (Mac--haven't tried others), set up account to "Attach my PGP key when sending signed messages". (Encryption subject also set to "off", but doesn't seem to matter.)
  2. Send a signed (unencrypted) message. (I sent it to myself.)
  3. In Thunderbird the sig checks out OK.
  4. In K9, the encryption icon shows "?". Clicking on it says, "Plaintext: end-to-end signature contained an error".
  5. In Thunderbird, turn off "Attach my PGP key".
  6. Send a signed (unencrypted) message.
  7. In Thunderbird the sig checks out OK.
  8. In K9, the encryption icon shows "blue check". Clicking on it says, "End-to-End signed plaintext: from verified signer"

I can also reproduce by manually attaching my public key in Thunderbird.

If Thunderbird automatically attaches the key, the MIME header is:

Content-Type: application/pgp-keys; name="OpenPGP_0xA165F24CF846C3C8.asc"
Content-Disposition: attachment; filename="OpenPGP_0xA165F24CF846C3C8.asc"
Content-Description: OpenPGP public key
Content-Transfer-Encoding: quoted-printable

And if I manually attach it, it's:

Content-Type: text/plain; charset=UTF-8; name="OpenPGP_0xA165F24CF846C3C8.asc"
Content-Disposition: attachment; filename="OpenPGP_0xA165F24CF846C3C8.asc"
Content-Transfer-Encoding: base64

but the issue repros on K9 either way.

Also, to repeat, this was my key mailing to myself.

Expected behavior

I would expect K9 to show the message as signed correctly regardless even if the public key were added as an attachment to the message.

Actual behavior

K9 only showed the signature as valid if the public key wasn't attached to the message by Thunderbird.

Logs

k9mail-logs.txt

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue using Thunderbird 102.5.1 with a signed message that includes the public key attachment, then inspect k9mail-logs.txt and the OpenPGP signature-verification path. Done means K-9 reports the signature as valid for both automatically and manually attached public keys, without regressing messages that omit the attachment.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.