2041024 - unobtrusive signing: empty email body results in invalid signature

Status: NEW

(MailNews Core :: Security: OpenPGP, defect)

Description

[Calum Mackay]

153.0a1 (2026-05-20) (aarch64) — MacOS 26.4.1 (25E253)

With unobtrusive signing enabled, sending an email with a Subject, but an empty body, results in Invalid Digital Signature.

Email sent with a body has a good signature.

Sent and received using above version.

This may be expected, but isn't ideal.

Comment 1

[meso5]

I have sent the same message (with subject and a single word in the body) to my Gmail and Outlook accounts. When Thunderbird collected the message from these accounts over IMAP,

• GMail worked as before (ie it displayed no attachment and displayed the OpenPGP button and badge).
• the Outlook account displayed no attachment but it only displayed the OpenPGP button (no badge). Clicking on the button shows a message saying 'Invalid Digital Signature'.

Both Gmail and Outlook on the web displayed no confusing attachment, which is good, but they didn't show any reference to OpenPGP either which makes me wonder how the recipient will know that email was signed.

Comment 2

[Calum Mackay]

(In reply to meso5 from comment #1)

I have sent the same message (with subject and a single word in the body) to my Gmail and Outlook accounts. When Thunderbird collected the message from these accounts over IMAP,

• GMail worked as before (ie it displayed no attachment and displayed the OpenPGP button and badge).
• the Outlook account displayed no attachment but it only displayed the OpenPGP button (no badge). Clicking on the button shows a message saying 'Invalid Digital Signature'.

Both Gmail and Outlook on the web displayed no confusing attachment, which is good, but they didn't show any reference to OpenPGP either which makes me wonder how the recipient will know that email was signed.

Hi, this bug is about the new Unobtrusive Signatures feature, which is under development, and not enabled by default.

I'm can't quite see what relation your comments above have to this bug? Are you using UO signatures? If so, then I'd not expect that to work yet with either gmail, or Outlook, as they will need to be upated to know about the new format. However, the whole point of the format is that they shouldn't show any indication if they don't know about it.

Comment 3

[meso5]

this bug is about the new Unobtrusive Signatures feature, which is under development, and not enabled by default.

I know. I was reporting back as invited here.

Are you using UO signatures?

Yes. I am just saying that if, as I suspect, Gmail, Outlook and other big providers don't support UO signatures, and the recipients are not alerted that there is a signature, awareness that the specific sender has a key and that there is such a thing as digital signatures will actually decrease.

Hiding the signature works as intended, but I am just wondering. Without UO signatures recipients find out that you use OpenPGP and many of those who get confused ask questions, but answering those questions educate them about digital signatures. Perhaps senders can add a text signature advertising that the message is digitally signed with an UO signature.

Comment 4

[Calum Mackay]

Thanks! Reporting back is good, although perhaps logging a new bug, rather than adding to an existing one, would be better. This bug is about messages with an empty body being seen as having an invalid signature.

As to your general comment, I would hope that the expectation is that other MUA apps will eventually add support for UO signatures.

Meanwhile, the annoyance and confusion that having a digital signature attachment, that is visible but unhandled, perhaps outweighs the awareness issue you raise. But that's perhaps best discussed on the mailing list (etc), and isn't relevant to this particular bug.

thanks again for your comments.