Bugzilla

I have analyzed the message, and it really is BAD.

But it's really unusualy.

If you look at the message source, the MIME header says 
```
Content-Type: multipart/signed; 
	boundary="----=_Part_1086775_2137432030.1650522863189"; 
	protocol="application/pkcs7-signature"; micalg=SHA1
```

Looking at the inner data structure of the S/MIME signature, it says that SHA512 was used to calculate the message digest.

As a consequence, Thunderbird attempts to calculate a SHA1 digest, and that doesn't match the SHA512 from inside the signature, and it reports a mismatch.

You can perform an experiment: Save the message to a file, edit the message with a text editor, change the email header to micalg=SHA512, then open that modified message with Thunderbird, then copy it to one of your folders, then click the message in that folder. For me, then it shows a correct signature.

The message is incorrect, Thunderbird is reporting it correctly, and therefore I'm resolving this as invalid.

You should contact the people who sent this message, and make them aware of their mistake.

I have analyzed the message, and it really is BAD.

But it's really unusual.

If you look at the message source, the MIME header says 
```
Content-Type: multipart/signed; 
	boundary="----=_Part_1086775_2137432030.1650522863189"; 
	protocol="application/pkcs7-signature"; micalg=SHA1
```

Looking at the inner data structure of the S/MIME signature, it says that SHA512 was used to calculate the message digest.

As a consequence, Thunderbird attempts to calculate a SHA1 digest, and that doesn't match the SHA512 from inside the signature, and it reports a mismatch.

You can perform an experiment: Save the message to a file, edit the message with a text editor, change the email header to micalg=SHA512, then open that modified message with Thunderbird, then copy it to one of your folders, then click the message in that folder. For me, then it shows a correct signature.

The message is incorrect, Thunderbird is reporting it correctly, and therefore I'm resolving this as invalid.

You should contact the people who sent this message, and make them aware of their mistake.