#1043138 thunderbird: cannot send OpenPGP signed message: rnp_op_sign_add_signature failed since upgrade to 115.1.0 (sid)

Package:
thunderbird
Source:
thunderbird
Description:
mail/news client with RSS, chat and integrated spam filter support
Submitter:
Jamie McClelland
Date:
2023-08-15 08:54:02 UTC
Severity:
normal
#1043138#5
Date:
2023-08-06 14:10:05 UTC
From:
To:
Dear Maintainer,

After upgrading to 115.1.0, when sending a message with "Digitally sign"
selected I consistently receive an error that "Sending of the message
failed." (When
just encrypting it works fine.)

The error console reports:

CryptoAPI.sync() failed result:  Error: rnp_op_encrypt_add_signature failed
     encryptAndOrSign chrome://openpgp/content/modules/RNP.jsm:3526
     sync chrome://openpgp/content/modules/cryptoAPI/interface.js:56
     encryptMessageStart chrome://openpgp/content/modules/encryption.jsm:446
     finishCryptoEncapsulation
chrome://openpgp/content/modules/mimeEncrypt.jsm:516
     createMessageFile resource:///modules/MimeMessage.jsm:90
interface.js:46:17
Error: failure in finishCryptoEncapsulation, exitCode: -1
     finishCryptoEncapsulation
chrome://openpgp/content/modules/mimeEncrypt.jsm:537
     createMessageFile resource:///modules/MimeMessage.jsm:90
mimeEncrypt.jsm:554:15
mimeEncrypt.js: caught exception: Error
Message: 'failure in finishCryptoEncapsulation, exitCode: -1'
File:    chrome://openpgp/content/modules/mimeEncrypt.jsm
Line:    537
Stack:
finishCryptoEncapsulation@chrome://openpgp/content/modules/mimeEncrypt.jsm:537:15
createMessageFile@resource:///modules/MimeMessage.jsm:90:27


Error: failure in finishCryptoEncapsulation, exitCode: -1
mimeEncrypt.jsm:537:15
     finishCryptoEncapsulation
chrome://openpgp/content/modules/mimeEncrypt.jsm:537
     createMessageFile resource:///modules/MimeMessage.jsm:90
     InterpretGeneratorResume self-hosted:1455
     AsyncFunctionNext self-hosted:852
mailnews.send: NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS: [JavaScript
Error: "failure in finishCryptoEncapsulation, exitCode: -1" {file:
"chrome://openpgp/content/modules/mimeEncrypt.jsm" line:
537}]'[JavaScript Error: "failure in finishCryptoEncapsulation,
exitCode: -1" {file: "chrome://openpgp/content/modules/mimeEncrypt.jsm"
line: 537}]' when calling method:
[nsIMsgComposeSecure::finishCryptoEncapsulation]
     createMessageFile resource:///modules/MimeMessage.jsm:90
MessageSend.jsm:137:32
     createAndSendMessage resource:///modules/MessageSend.jsm:137
mailnews.send: Sending failed; , exitCode=2153185313, originalMsgURI=
MessageSend.jsm:362:32
     fail resource:///modules/MessageSend.jsm:362
     createAndSendMessage resource:///modules/MessageSend.jsm:145
Error: rnp_op_encrypt_add_signature failed RNP.jsm:3526:21

#1043138#10
Date:
2023-08-07 15:46:54 UTC
From:
To:
Hello Jamie,

I can't reproduce this issue.

Am 06.08.23 um 16:10 schrieb Jamie McClelland:

You don't give any further information so it's difficult to give some
good advice.

There are some general suggestions how to narrow down potential issues
while working with a somehow dysfunctional Thunderbird application in
the Debian Wiki.

Taking parts of the log from your error messages let me think it's not a
issue within Thunderbird itself, it looks like you've configured
Thunderbird to use GPG and not the internal crypto handling.

So far I remember you need ensure you have commented out this line in
~/.gnupg/gpg-agent.conf

And also don't have set "pinentry-mode loopback" in ~/.gnupg/gpg.conf.

To see more information you will need to enable some debugging.

https://www.gnupg.org/documentation/manuals/gpgme/Debugging.html

e.g.

#1043138#15
Date:
2023-08-07 20:45:32 UTC
From:
To:
Thank you for the support and sorry to waste your time.

I think the problem is that I didn't have a Primary password set. I set
a primary password, then re-imported my secret key and now it seems to work.

jamie

#1043138#20
Date:
2023-08-08 21:53:21 UTC
From:
To:
Hi,


I was reproducing the exact issue (same error and same RNP function).

I'm using a primary key without its private key and 2 subkeys with their
private keys:

| Key Part        | Usage         |
| --------------- | ------------- |
| (!) primary key | Sign, Certify |
| subkey          | Encrypt       |
| subkey          | Sign          |
For keys marked with (!) the secret key is not available.


I've tried to use a fresh thunderbird profile and re-import my GPG key
and sending signed messages is working again.
So I guess something was bad in the thunderbird profile.

#1043138#25
Date:
2023-08-12 13:40:00 UTC
From:
To:
Hi,

Moving to bug 1043138.

I'm trying to do that, but it's a fight.

mimeEncrypt.js: caught exception: Error
Message: 'failure in finishCryptoEncapsulation, exitCode: -1'
File:    chrome://openpgp/content/modules/mimeEncrypt.jsm
Line:    537
Stack:
finishCryptoEncapsulation@chrome://openpgp/content/modules/mimeEncrypt.jsm:537:15
createMessageFile@resource:///modules/MimeMessage.jsm:90:27


Error: failure in finishCryptoEncapsulation, exitCode: -1
mimeEncrypt.jsm:537:15
mailnews.send: NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS: [JavaScript
Error: "failure in finishCryptoEncapsulation, exitCode: -1" {file:
"chrome://openpgp/content/modules/mimeEncrypt.jsm" line:
537}]'[JavaScript Error: "failure in finishCryptoEncapsulation,
exitCode: -1" {file: "chrome://openpgp/content/modules/mimeEncrypt.jsm"
line: 537}]' when calling method:
[nsIMsgComposeSecure::finishCryptoEncapsulation]
     createMessageFile resource:///modules/MimeMessage.jsm:90
MessageSend.jsm:137:32
mailnews.send: Sending failed; , exitCode=2153185313, originalMsgURI=
MessageSend.jsm:362:32
Error: rnp_op_sign_add_signature failed RNP.jsm:3535:19
mailnews.smtp:
error { target: TCPSocket, isTrusted: true, name: "NetworkTimeoutError",
message: "Network", errorCode: 2152398862, srcElement: TCPSocket,
currentTarget: TCPSocket, eventPhase: 2, bubbles: false, cancelable:
false, … }
SmtpClient.jsm:434:17

Paul

#1043138#30
Date:
2023-08-12 14:31:44 UTC
From:
To:
Hi again,

Am 12.08.23 um 15:40 schrieb Paul Gevers:

another try would be to use the upstream precompiled binaries.

Just extract to somewhere and start the thunderbird binary, it will pick
up the profile automatically.

If the issue is quite the same I suggest to open a upstream issue in the
Bugzilla system.

#1043138#35
Date:
2023-08-12 18:33:59 UTC
From:
To:
Hi,

I successfully imported my key again, and as you can see with this
message, it's both signed and sent with firefox. So I confirm that the
work around works in my case.

Paul

#1043138#40
Date:
2023-08-15 08:50:48 UTC
From:
To:
FWIW, I had the same issue after upgrading to 115.1 and fixed it by
re-importing my secret key. I use Thunderbird's own OpenPGP implementation.