#1148000 libsequoia-octopus-librnp: thunderbird 153 does not decrypt emails

Package:
libsequoia-octopus-librnp
Source:
libsequoia-octopus-librnp
Description:
Reimplementation of librnp for Thunderbird by Sequoia
Submitter:
Gabriel Filion
Date:
2026-10-10 10:57:14 UTC
Severity:
normal
#1148000#5
Date:
2026-09-15 22:14:24 UTC
From:
To:
Hello!

I've recently started having issues with decrypting emails. thunderbird
was recently (september 8th, so 7 days ago) upgraded to 153.2.0. I
believe my issues started around the time of that upgrade.

In thunderbird's error console, I can see error messages when I try to
open an email that's pgp-encrypted. I'm attaching a screenshot of the
error console in case it can be useful for debugging. When that happens,
thunderbird does not mark the email as read.

Cheers!
#1148000#10
Date:
2026-09-16 11:29:30 UTC
From:
To:
control: forward -1 https://gitlab.com/sequoia-pgp/sequoia-octopus-librnp/-/merge_requests/169
thanks

bummer! i'm tempted to raise the severity to serious.. & thanks for filing this
bug report!

The fix is probably in the above linked MR, though it's unclear when upstream
can do another release.

And then eventually we'd need to get that into debian stable (when thunderbird
is updated there.)
#1148000#15
Date:
2026-09-16 11:29:30 UTC
From:
To:
control: forward -1 https://gitlab.com/sequoia-pgp/sequoia-octopus-librnp/-/merge_requests/169
thanks

bummer! i'm tempted to raise the severity to serious.. & thanks for filing this
bug report!

The fix is probably in the above linked MR, though it's unclear when upstream
can do another release.

And then eventually we'd need to get that into debian stable (when thunderbird
is updated there.)
#1148000#20
Date:
2026-09-16 11:37:30 UTC
From:
To:
control: forwarded -1 https://gitlab.com/sequoia-pgp/sequoia-octopus-librnp/-/merge_requests/169
thanks
#1148000#27
Date:
2026-10-09 20:04:49 UTC
From:
To:
Hello,

I can confirm an OpenPGP regression after upgrading Thunderbird from 140
to 153 on Debian testing (forky).

Installed versions:
- thunderbird: 1:153.4.0esr-1
- libsequoia-octopus-librnp: 1.11.1-10
- librnp0: 0.18.1-2+b1

With libsequoia-octopus-librnp installed, Thunderbird's Troubleshooting
Information page reports:

     RNP (OpenPGP):
     Status: Failed to load. OpenPGP will not work.
     Expected minimum version: 0.18.1
     Version in use: -
     Path: -

The OpenPGP Key Manager is completely empty, including my own private
key. Under Account Settings -> End-To-End Encryption, Thunderbird still
remembers the configured key ID but displays:

     This key could not be found! If you want to use it
     you must import it to Thunderbird.

Both pubring.gpg and secring.gpg are still present in my Thunderbird
profile.

The installed librnp.so symlink points to:

     /usr/lib/thunderbird/librnp.so
       -> ../sequoia/libsequoia_octopus_librnp.so

As a test, I removed libsequoia-octopus-librnp.
After doing so, Thunderbird successfully loads the standard RNP library,
reporting:

     Status: Unofficial version. OpenPGP might not
             work as expected.
     Expected minimum version: 0.18.1
     Version in use: 0.18.1-2+b1
     Path: librnp.so.0

However, removing libsequoia-octopus-librnp is not a satisfactory
workaround for users who rely on its integration with GnuPG.
Sequoia Octopus makes keys managed by GnuPG available to Thunderbird,
including private keys accessed through gpg-agent. Removing it therefore
breaks the existing GnuPG-based OpenPGP workflow.

The test indicates that the initialisation failure is specific to the
Sequoia Octopus replacement library. A fix is needed that restores
compatibility with Thunderbird 153 while preserving the GnuPG
integration provided by Sequoia Octopus.

Best regards

   Norbert

P.S. I would normally OpenPGP-sign messages to Debian mailing lists and
the BTS, but unfortunately this regression currently prevents me from
doing so.
#1148000#32
Date:
2026-10-10 10:54:24 UTC
From:
To:
control: severity -1 serious
thanks

sigh & thanks for reporting, upgrading severity accordingly.