2026356 - Failure to sign with an external GnuPG key that requires the use of a signing subkey

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, defect, P3)

Description

[Kai Engert [:KaiE:]]

In the following scenario, adding a digital OpenPGP signature fails:

• external GnuPG configuration is enabled
• for that key, the primary key doesn't have signing capability

The current code asks GPG for a key handle to the configured external key ID, and then adds that key handle as a signer.

Apparently that fails in certain scenarios. GPGME reports a failure to sign.

I assume that GPGME doesn't have the capability to automatically select the corresponding signing subkey, but rather returns a failure because the given key handle cannot be used directly for signing.

This bug was reported for a split-qubes configuration.

Comment 1

[Kai Engert [:KaiE:]]

I suggest to fix this in the following way:

If Thunderbird is asked to use signing with external GnuPG, TB should inspect the corresponding public key (that the user was required to import, that's a precondition for using external secret key, as documented).

The code should find the most recently created subkey, and prefer that one (we use that preference already when selecting a suitable encryption key). If non exists, it should fall back to use the primary key (if it has signing capability).

That approach should fix this bug.

Comment 2

[Kai Engert [:KaiE:]]

Attachment: Bug 2026356 - Prefer signing subkey in external secret key configuration, only use primary as fall back. r=mkmelin

Comment 3

[Kai Engert [:KaiE:]]

I don't want to require the gnupg tools to be available in our CI environment.
But it would be nice to have an automated test that we can execute manually, locally on a developer machine.

Comment 4

[Kai Engert [:KaiE:]]

Attachment: Bug 2026356 - Add an optional Linux-only external-gnupg test (only if binaries are installed). r=mkmelin

Comment 5

[Kai Engert [:KaiE:]]

Final try run:
https://treeherder.mozilla.org/jobs?repo=try-comm-central&revision=8c429e0e640bac783bf65f98d2c5f14a426863be

Comment 6

[Alex Schmitz]

Conflicts found while landing. Please Rebase.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/106037f54581
Prefer signing subkey in external secret key configuration, only use primary as fall back. r=mkmelin
https://hg.mozilla.org/comm-central/rev/805e3cdb2427
Add an optional Linux-only external-gnupg test (only if binaries are installed). r=mkmelin