thunderbird / thunderbird/thunderbird-android
K-9 can't verify PGP signature when public key attached
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 14k
- Forks
- 2.8k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 57
Description
Checklist
- I have used the search function to see if someone else has already submitted the same bug report.
- I will describe the problem with as much detail as possible.
App version
6.400
Where did you get the app from?
Google Play
Android version
13
Device model
Pixel 4a
Steps to reproduce
- Thunderbird 102.5.1 (Mac--haven't tried others), set up account to "Attach my PGP key when sending signed messages". (Encryption subject also set to "off", but doesn't seem to matter.)
- Send a signed (unencrypted) message. (I sent it to myself.)
- In Thunderbird the sig checks out OK.
- In K9, the encryption icon shows "?". Clicking on it says, "Plaintext: end-to-end signature contained an error".
- In Thunderbird, turn off "Attach my PGP key".
- Send a signed (unencrypted) message.
- In Thunderbird the sig checks out OK.
- In K9, the encryption icon shows "blue check". Clicking on it says, "End-to-End signed plaintext: from verified signer"
I can also reproduce by manually attaching my public key in Thunderbird.
If Thunderbird automatically attaches the key, the MIME header is:
Content-Type: application/pgp-keys; name="OpenPGP_0xA165F24CF846C3C8.asc"
Content-Disposition: attachment; filename="OpenPGP_0xA165F24CF846C3C8.asc"
Content-Description: OpenPGP public key
Content-Transfer-Encoding: quoted-printable
And if I manually attach it, it's:
Content-Type: text/plain; charset=UTF-8; name="OpenPGP_0xA165F24CF846C3C8.asc"
Content-Disposition: attachment; filename="OpenPGP_0xA165F24CF846C3C8.asc"
Content-Transfer-Encoding: base64
but the issue repros on K9 either way.
Also, to repeat, this was my key mailing to myself.
Expected behavior
I would expect K9 to show the message as signed correctly regardless even if the public key were added as an attachment to the message.
Actual behavior
K9 only showed the signature as valid if the public key wasn't attached to the message by Thunderbird.
Logs
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue using Thunderbird 102.5.1 with a signed message that includes the public key attachment, then inspect k9mail-logs.txt and the OpenPGP signature-verification path. Done means K-9 reports the signature as valid for both automatically and manually attached public keys, without regressing messages that omit the attachment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100