1668508 - Signed message with own subkey shows as not verified, even though it's my own personal key

Status: NEW

(MailNews Core :: Security: OpenPGP, defect)

Description

[Onno Ekker [:nONoNonO UTC+1]]

Attachment: OpenPGP Warning.png

Latest Daily now looks at signing subkeys.
I've created this test message from the command line however:
$ gpg --clearsign test

The message shows with a warning symbol on the OpenPGP button, warning me that I haven't verified that the key is really owned by the sender. But the key manager contains both my public and private key, and I have told Thunderbird to treat the key as a personal key. There's not much more that I can do to verify that the key is really owned by the sender...

Comment 1

[Onno Ekker [:nONoNonO UTC+1]]

Attachment: Key Properties Acceptance.png

Comment 2

[Onno Ekker [:nONoNonO UTC+1]]

Attachment: Key Properties Structure.png

Comment 3

[Onno Ekker [:nONoNonO UTC+1]]

Attachment: Test message signed with gpg.eml

Comment 4

[Onno Ekker [:nONoNonO UTC+1]]

Not sure if it matters, but in Daily I have my test account <[e-mail]> configured with its own key pair and added an extra identity and imported the key pair for my main account <[e-mail]>. So the key manager in Daily only has my two key pairs.

I can't test Daily (or any of the other installed versions I have) with my main account, because it's too big (the default profile is 37GB).

Comment 5

[Kai Engert [:KaiE:]]

We'll need your public key to analyze the issue.

Comment 6

[Onno Ekker [:nONoNonO UTC+1]]

Attachment: Onno Ekker [e-mail]-(0x92FEB712E2DB2DC2)-public.asc

Comment 7

[Onno Ekker [:nONoNonO UTC+1]]

When I delete my private key from the OpenPGP Key Manager and only import the public key, the signature shows as valid.
The warning only shows when I import both the pub and sec ring, so I don't think the public key will help you much...