1693931 - Homebrew's apple silicon native gpgme in /opt/homebrew not found

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, defect)

Description

[christian.hawkins-github]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15

Steps to reproduce:

On a new M1 Mac:

1. Download Nightly Thunderbird
2. Install homebrew as instructed at https://brew.sh without using rosetta. Homebrew will be installed into /opt/homebrew
3. Add eval $(/opt/homebrew/bin/brew shellenv) to .zprofile as stated in stdout of install script
4. brew install gnupg gpgme
5. Set up https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards

Actual results:

Decryption and signing fails, because thunderbird can't find gpgme libraries. When creating symlinks to /usr/local/lib|bin it starts working. However, this is where homebrew+rosetta2 resides, and overwriting the x86_64 libraries breaks current stable thunderbird (obviously)

Expected results:

Thunderbird should also check the new homebrew path, since for many this will be the default install of gpgme. Thunderbird already has a list of additional library paths for osx, so adding one more might not be introducing too many issues.

https://github.com/mozilla/releases-comm-central/blob/master/mail/extensions/openpgp/content/modules/GPGMELib.jsm#L21

Comment 1

[christian.hawkins-github]

Shouldn't hardware be

Comment 2

[christian.hawkins-github]

For anyone who finds that bug that is affected. Mozilla does not seem to care about Smartcard GPG, so I came up with a workaround.

Assuming Smartcard GPG worked for you before updating to 91.* and assuming you have arm homebrew gpgme installed, you can

sudo mkdir -p /opt/local
sudp ln -s /opt/homebrew/lib /opt/local/lib

to have Thunderbird find your gpgme located in /opt/homebrew/lib

Comment 3

[Rob Lemley [:rjl]]

Attachment: Bug 1693931 - Add addition homebrew library path for using GPG smartcards. r=kaie

For Apple Silicon, Homebrew installs to /opt/homebrew by default.

Comment 4

[Kai Engert [:KaiE:]]

If there is a PIN on the smartcard, will you get a prompt?

I was told in the past that using GPGME from homebrew might not work in this scenario, because no default app to bring up GUI prompts for a PIN are installed.

Could you please investigate that before we consider the patch?

Comment 5

[Kai Engert [:KaiE:]]

Well, independent of my concern, we already look for libs in those directories, which will already find those homebrew libs on Intel Macs. So taking the patch isn't making things worse.

Comment 6

[christian.hawkins-github]

Yes, but you have to install pinentry-mac and configure it in your gpg-agent.conf

Comment 7

[Kai Engert [:KaiE:]]

this should be safe to uplift to 78, too

Comment 8

[Kai Engert [:KaiE:]]

Rob, are we using thunderbird91 or thunderbird_esr91 tracking flags? Is it thunderbird91 while it's still in beta?

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/f8ac674397dd
Add addition homebrew library path for using GPG smartcards. r=kaie

Comment 10

[Rob Lemley [:rjl]]

In reply to Kai Engert (:KaiE:) from comment #8)

Rob, are we using thunderbird91 or thunderbird_esr91 tracking flags? Is it thunderbird91 while it's still in beta?

Use tracking_thunderbird91 while still in beta.

Comment 11

[Kai Engert [:KaiE:]]

(In reply to christian.hawkins-github from comment #2)

For anyone who finds that bug that is affected. Mozilla does not seem to care about Smartcard GPG,

Please don't say that. We added the possibility to use external GnuPG specifically because we care about smartcard users.

(In reply to christian.hawkins-github from comment #6)

Yes, but you have to install pinentry-mac and configure it in your gpg-agent.conf

The Thunderbird project depends on community contributions like your bug report and your expertise. Would you be willing to help edit the https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards page and add this information? Thanks

Comment 12

[christian.hawkins-github]

This is already covered by the first line of this snippet.

You're responsible for installing all software that is required to use your Smartcard. You must use the appropriate tools to prepare
your smartcard for use, for example, the card must contain an appropriate key pair. You must make note of the primary key ID of the
smartcard's key that you'd like to use. It has 16 characters. It is the same as the last 16 characters of your primary key's fingerprint.

Here is the snippet for those that can't:

$ cat .gnupg/gpg-agent.conf 
pinentry-program /opt/homebrew/bin/pinentry-mac

Comment 13

[Kai Engert [:KaiE:]]

Comment on attachment 9231398 [details]
Bug 1693931 - Add addition homebrew library path for using GPG smartcards. r=kaie

[Approval Request Comment]
Regression caused by (bug #): no, specific to Apple Silicon
User impact if declined: less automatism with OpenPGP smartcards
Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky): very low

Comment 14

[Kai Engert [:KaiE:]]

Comment on attachment 9231398 [details]
Bug 1693931 - Add addition homebrew library path for using GPG smartcards. r=kaie

should be safe for esr78, too

Comment 15

[Wayne Mery (:wsmwk)]

Comment on attachment 9231398 [details]
Bug 1693931 - Add addition homebrew library path for using GPG smartcards. r=kaie

[Triage Comment]
Approved for beta

Comment 16

[Dave Miller [:justdave]]

Thunderbird 91.0b3:
https://hg.mozilla.org/releases/comm-beta/rev/dc159af5bbc7

Comment 17

[Kai Engert [:KaiE:]]

(In reply to christian.hawkins-github from comment #12)

You're responsible for installing all software that is required to use your Smartcard. You must use the appropriate tools to prepare
your smartcard for use, for example, the card must contain an appropriate key pair. You must make note of the primary key ID of the
smartcard's key that you'd like to use. It has 16 characters. It is the same as the last 16 characters of your primary key's fingerprint.

We should update the wiki page to explain what exactly needs to be done. I just added a section, let me know if you see a mistake.

Comment 18

[Wayne Mery (:wsmwk)]

Comment on attachment 9231398 [details]
Bug 1693931 - Add addition homebrew library path for using GPG smartcards. r=kaie

[Triage Comment]
Approved for esr78

Comment 19

[Rob Lemley [:rjl]]

Thunderbird 78.13.0:
https://hg.mozilla.org/releases/comm-esr78/rev/adcfedf831da