Encrypted attachments cannot be opened or saved as decrypted files

[Henning Sprang]

I have been using enigmail in thunderbird until I upgraded Ubuntu and with it thunderbird to the latest version 1:78.3.2+build1-0ubuntu1

As enigmail is now integrated in thunderbird, I have gone through the painful upgrade process (it does not allow to look into passwordmanager for the pasphrase of the gpg keys it wants to import by blocking all other windows), and decryption of emails now works.

But when looking at a decrypted email, fully being able to read the text content, when I want to use the Menu option "Decrypt and Open" by right clicking on an attachment (pdf in this case), nothing happens.

What I expect to happen: The pdf file being shown to me in the pdf viewer. Or some error being displayed, or maybe I am asked for my gpg passphrase again for additional security.

When trying the option "Decrypt and save as", next I can select a folder and filename, (the pdf name without .gpg) and chose "save" - but when looking into that folder, there is no decrypted file. (I tried this plenty of time, I am sure its not there, and I did this action before the upgrade many times successfully).

What I would expect: the attached file without the .gpg suffix (the filename proposed when opening the dialog, which I did not change) in the selected directory.

$ lsb_release -rd
Description: Ubuntu 20.10
Release: 20.10

$ apt-cache policy thunderbird
thunderbird:
  Installed: 1:78.3.2+build1-0ubuntu1
  Candidate: 1:78.3.2+build1-0ubuntu1
  Version table:
 *** 1:78.3.2+build1-0ubuntu1 500
        500 http://de.archive.ubuntu.com/ubuntu groovy/main amd64 Packages
        100 /var/lib/dpkg/status

[Dpsoft (dpsoft)]

Created attachment 9173976
Screenshot.png

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36

Steps to reproduce:

Testet with TB 78.1.1 and 78.2.1 on Windows 10.

I received a mail with multiple mime-parts: a html body and an encrypted attachment.

MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="123456789-11111-9876543210=:4444"

--123456789-11111-9876543210=:4444
Content-Type: TEXT/HTML; CHARSET=ISO-8859-1
Content-Transfer-Encoding: 8bit

-----BEGIN PGP MESSAGE-----
...snip...
-----END PGP MESSAGE-----
--123456789-11111-9876543210=:4444
Content-Type: APPLICATION/pdf; name="Antragsnummer_123456789.pdf.pgp"
Content-Transfer-Encoding: 8bit

-----BEGIN PGP MESSAGE-----
...snip...
-----END PGP MESSAGE-----
--123456789-11111-9876543210=:4444--

Actual results:

The message-body part decrypt successfully. But i can't open or save the attachment decrypted. While click "Decrypt and Open..." and "Decrypt and Save As..." nothing happend.

Expected results:

The attachment will be successfully decrypted and open/save with old TB Version <=68 and enigmail-addon.

[Mozzbug99 (mozzbug99)]

Hello,

Same problem observed with TB 78.2.2

Best Regards

[Altarius-4 (altarius-4)]

Created attachment 9176781
console output when clicking decrypt&save

same issue here on Win10, TB 78.2.2.

I've attached the console output when clicking those buttons.

Best regards

[Dpsoft (dpsoft)]

Issue still exists on TB 78.3.1

[Artur T. (artur-tanistra)]

+1

[Dpsoft (dpsoft)]

Issue still exists on TB 78.3.2

[Critter-8 (critter-8)]

Issue still exists on TB 78.3.3

[Resistor5k6 (resistor5k6)]

Issue still exists on TB 78.4.0

[Henning Sprang (henning)]

I started thunderbird in the console to get some more info.

WHile tryiong to "Decrypt and open" the attachment, the console says:

console.log: (new Error("Cannot load required OTR library", "resource:///modules/OTRLib.jsm", 75))
JavaScript error: chrome://chat/content/conversation-browser.js, line 853: NotSupportedError: CustomElementRegistry.define: 'conversation-browser' has already been defined as a custom element
console.warn: LoginHelper(Main): "Couldn't parse origin for" "chrome://mozapps" ({})
console.warn: LoginHelper(Main): "dedupeLogins: Deduping with a scheme preference but couldn't get the preferred origin scheme."
console.log: "CryptoAPI.sync() failed result: %o" (new Error("Not implemented", "chrome://openpgp/content/modules/cryptoAPI/RNPCryptoAPI.jsm", 179))
console.log: "CryptoAPI.sync() failed result: %o" (new Error("Not implemented", "chrome://openpgp/content/modules/cryptoAPI/RNPCryptoAPI.jsm", 209))
JavaScript error: chrome://openpgp/content/modules/decryption.jsm, line 634: TypeError: result.stdoutData is undefined

[Vseerror (vseerror)]

*** Bug 1672231 has been marked as a duplicate of this bug. ***

[Resistor5k6 (resistor5k6)]

Issue still exists on TB 78.4.1

[Bugzilla2007 (bugzilla2007)]

Confirming based on numerous reports from commenters and 1 duplicate.
Not being able to save an encrypted attachment as unencrypted sounds like a considerable detriment. -> S2.

[Resistor5k6 (resistor5k6)]

Issue still exists on TB 78.4.2

[Mkmelin+mozilla (mkmelin+mozilla)]

No surprise there - this needs a lot of hooking up. We should probably disable the menus until it's done.

https://searchfox.org/comm-central/rev/fdf77683a80c9b1dc7f3c3cb393a6ea895836948/mail/extensions/openpgp/content/modules/cryptoAPI/RNPCryptoAPI.jsm#179
https://searchfox.org/comm-central/rev/fdf77683a80c9b1dc7f3c3cb393a6ea895836948/mail/extensions/openpgp/content/modules/attachment.jsm#18
https://searchfox.org/comm-central/rev/fdf77683a80c9b1dc7f3c3cb393a6ea895836948/mail/extensions/openpgp/content/ui/enigmailMessengerOverlay.js#2755

I think this should instead use RNP.decrypt directly.

[Resistor5k6 (resistor5k6)]

Issue still exists on TB 78.4.3

[Mkmelin+mozilla (mkmelin+mozilla)]

*** Bug 1677155 has been marked as a duplicate of this bug. ***

[Mkmelin+mozilla (mkmelin+mozilla)]

Kai, should we just hide this menu until it's working? Or you you have code pointers to how to fix it?

[Gerhard-n (gerhard-n)]

Hiding is not a solution. Customers keep sending mail with encrypted attachments. The only alternative then is a separate encrypting program what is a big step back and you must manage two keyrings

[Mkmelin+mozilla (mkmelin+mozilla)]

Well, we'd hide it only until we get it working, which we'd like to do at some point.

[Resistor5k6 (resistor5k6)]

Issue still exists on TB 78.5.0

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Ivan (ivan-ivanov)]

It appears to be Thunderbird related and not directly linked with Ubuntu.
I'm running Arch Linux and today with recent Thunderbird upgrade I got the same behavior.
I may say that OTRLib.jsm is not connected with the problem. Yes, dependency on 'libotr' is missing - I fixed it manually and have now:
console.debug: "Successfully loaded OTR library libotr.so.5 from system's standard library locations"
But I can't save/decrypt attachements (the same way as in problem description) and have the same errors:
console.log: "CryptoAPI.sync() failed result: %o" (new Error("Not implemented", "chrome://openpgp/content/modules/cryptoAPI/RNPCryptoAPI.jsm", 179))
console.log: "CryptoAPI.sync() failed result: %o" (new Error("Not implemented", "chrome://openpgp/content/modules/cryptoAPI/RNPCryptoAPI.jsm", 209))
JavaScript error: chrome://openpgp/content/modules/decryption.jsm, line 634: TypeError: result.stdoutData is undefined

[Ivan (ivan-ivanov)]

According to https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq Thunderbird use "RNP software" for processing keys and it has some limitations, i.e. some types of keys are not supported. E.g. "Certain keys that are incomplete, for example those using an offline primary key."
I think my key if offline and this might be the reason why it doesn't work.

I tried to setup external GnuPG key accoring to the FAQ without any success. I don't see any difference (i.e. I don't understant does Thunderbird try to use GnuPG or not to decrypt my attacment... I see no new messages in console)

[Leopooh (fuzzy2)]

Please hide it until it work!

I just got an update of Thunderbird to 78.4.3 and Enigmail automatically disabled itself with migration of keys to Thunderbird. Ok, thats fine but than I spend several hours trying to understand what is wrong with my setup until I finally have reached this thread and found "it is not implemented".
So, as it doesn't work - please remove menu items in order not to confuse everyone else. Without menu everyone will immediately recognize that he need to forget old convenient way and use another tool (like, 'gpg --decrypt' from console for example)

[Resistor5k6 (resistor5k6)]

Issue still exists on TB 78.5.1

[Kai Engert (kaie)]

Created attachment 9191067
Bug 1663169 - Restore decrypt and save/open right click action for attachments. r=PatrickBrunschwig

[Kai Engert (kaie)]

(In reply to Magnus Melin [:mkmelin] from comment #15)
> Kai, should we just hide this menu until it's working? Or you you have code pointers to how to fix it?

Looks like I restored the functionality with the attached patch.

[Pulsebot (pulsebot)]

Pushed by <email address hidden>:
https://hg.mozilla.org/comm-central/rev/b98061eb01ee
Restore decrypt and save/open right click action for attachments. r=PatrickBrunschwig DONTBUILD

[Kai Engert (kaie)]

Comment on attachment 9191067
Bug 1663169 - Restore decrypt and save/open right click action for attachments. r=PatrickBrunschwig

[Approval Request Comment]
Regression caused by (bug #): none
User impact if declined: nonworking decrypt feature that's offered in UI
Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky): low

[Vseerror (vseerror)]

Comment on attachment 9191067
Bug 1663169 - Restore decrypt and save/open right click action for attachments. r=PatrickBrunschwig

[Triage Comment]
This won't reach beta via uplift.
Approved for esr78

[Kai Engert (kaie)]

78.6.0
https://hg.mozilla.org/releases/comm-esr78/rev/9e1c528c3a548d27251664c93c94620940672ed2

[Olivier Tilloy (osomon)]

According to the latest status update on the upstream bug, the fix is committed and will be released with thunderbird 78.6.0.

[Sebastien Bacher (seb128)]

https://bugs.launchpad.net/ubuntu/+source/thunderbird/1:78.6.0+build1-0ubuntu1

[Dpsoft (dpsoft)]

Tested with 78.6.0 Linux, unfortunately the decrypted files are saved incompletely.

I received two small PDF documents. I clicked "decrypt and save as", but on my filesystem the files have only few bytes. Nothing appears in the error console. I have successfully checked decrypting the pgp-files with gnupg.
```
$ gpg -o Abrechnungsschreiben_6912.pdf-gnupg -d Abrechnungsschreiben_6912.pdf.pgp
$ gpg -o Antragsnummer_79282.pdf-gnupg -d Antragsnummer_79282.pdf.pgp
$ ls -l *pdf*
-rw------- 1 dan users 199 16. Dez 00:00 Abrechnungsschreiben_6912.pdf
-rw-r--r-- 1 dan users 76748 16. Dez 00:00 Abrechnungsschreiben_6912.pdf-gnupg
-rw-r--r-- 1 dan users 86222 16. Dez 00:00 Abrechnungsschreiben_6912.pdf.pgp
-rw------- 1 dan users 123 16. Dez 00:00 Antragsnummer_79282.pdf
-rw-r--r-- 1 dan users 89009 16. Dez 00:00 Antragsnummer_79282.pdf-gnupg
-rw-r--r-- 1 dan users 119047 16. Dez 00:00 Antragsnummer_79282.pdf.pgp
$ cat Antragsnummer_79282.pdf
%PDF-1.4
%õäöü

9 0 obj
<< /Length 2596 /Filter [ /FlateDecode ] /N 3 >>
stream
½H.*1Ͻ7½JÀ RH
$
$ cat Abrechnungsschreiben_6912.pdf
%PDF-1.4
%õäöü

9 0 obj
<<
/Type /XObject
/Subtype /Image
/Name /I1
/Width 828
/Height 143
/BitsPerComponent 8
/ColorSpace /DeviceRGB
/Length 52405 /Filter [ /DCTDecode ] >>
stream
ÿØÿ
$
```

Thank you, for your work.

[Resistor5k6 (resistor5k6)]

> I clicked "decrypt and save as", but on my filesystem the files have only few bytes.

Same here. Does not work. :-(

[Gerhard-n (gerhard-n)]

same problem in W10 error in attachment

[Gerhard-n (gerhard-n)]

(In reply to gjo from comment #29)
> same problem in W10 error in attachment (messages box with: null undefined)

[Mozzbug99 (mozzbug99)]

Created attachment 9193450
Error message window after clicking "Decrypt and Save As"

Error message window after clicking "Decrypt and Save As" in TB 78.6.0 32-bit.

[Mozzbug99 (mozzbug99)]

Hello,

After clicking "Decrypt and Save As" error message window is displayed (as above) and following entry shows in "errors console":
> rnp_op_verify_execute returned unexpected: 268435457 RNP.jsm:991:17

TB 78.6.0 (32 bit)

Best Regards

[K-bugzilla (k-bugzilla)]

Tested with 78.6.0 Windows, unfortunately the decrypted files are saved incompletely.
Mode LastWriteTime Length Name
-a---- 17.12.2020 11:07 1403473 x.jpg.asc
-a---- 17.12.2020 11:11 °°°°°°4 x.jpg

PS C:\Users\buz> more x.jpg
ÿØÿà

PS C:\Users\buz> more x.jpg.asc
-----BEGIN PGP MESSAGE-----
...

[K-bugzilla (k-bugzilla)]

(In reply to bugzilla from comment #33)
> Tested with 78.6.0 Windows, unfortunately the decrypted files are saved incompletely.
> Mode LastWriteTime Length Name
> -a---- 17.12.2020 11:07 1403473 x.jpg.asc
> -a---- 17.12.2020 11:11 °°°°°°4 x.jpg
>
> PS C:\Users\buz> more x.jpg
> ÿØÿà
>
> PS C:\Users\buz> more x.jpg.asc
> -----BEGIN PGP MESSAGE-----
> ...

The Console only shows this:
12:39:26.123 1608205166123 addons.xpi-utils WARN Add-on <email address hidden> is not compatible with application version.

[K-bugzilla (k-bugzilla)]

(In reply to bugzilla from comment #33)
> Tested with 78.6.0 Windows, unfortunately the decrypted files are saved incompletely.
> Mode LastWriteTime Length Name
> -a---- 17.12.2020 11:07 1403473 x.jpg.asc
> -a---- 17.12.2020 11:11 °°°°°°4 x.jpg
>
> PS C:\Users\buz> more x.jpg
> ÿØÿà
>
> PS C:\Users\buz> more x.jpg.asc
> -----BEGIN PGP MESSAGE-----
> ...

11:30:41.069 rnp_op_verify_execute returned unexpected: 268435458

[Hyperbolic-b (hyperbolic-b)]

Obviously, my own bug report regarding this has been lost. I reported the same problem some weeks ago, and somebody said this problem would be solved with 78.6.0.

However, I can definitely confirm that the problem is NOT solved in 78.6.0. @Thunderfan has described exactly what happens.

I have tested this under Windows 10 Enterprise and Windows 7, each with TB 78.6.0.

I am aware that Thunderbird is free software with large parts made by volunteers. However, I would also like to make clear that this is not a low-priority problem and that such a long time to fix it is just not acceptable, even if it's free software. That problem is putting more and more pressure on us with each day it remains unfixed.

We are a company which often receives invoices as PGP-encrypted attachments in messages which are not encrypted in whole (only the attachments are encrypted). Since we have upgraded our PCs to TB 78 in the end of last year, not having come to the idea that such a basic and important function would be broken by the update, we have a massive problem in our accounting now. I know other companies and even private persons who also receive invoices and other important, sensitive documents as PGP-encrypted attachment, and suffer similarly.

Our current "solution" is that the administrators ask the users to save the attachments in encrypted form, and use GnuPG on the command line to decrypt them, which means using the users' private keys. This whole process is completely not acceptable under various aspects, among them important legal aspects and the EU GDPR.

If it doesn't get fixed soon, we'll probably have to switch to Outlook. We definitely won't go back to TB 68 where this was working somehow. So I would be glad if we could get a honest and definitive statement from a developer here. We can really understand if this won't get fixed because it is too difficult, is not of high priority from the developers' point of view, or takes too much time. But then please make a clear statement that you won't fix it in the next time. Once again, that would be fair enough, but please let us know about it.

Despite that problem, I'd like to say a big thanks to the development team for all your effort and for providing TB and OpenPGP free of charge. It has been, and still is, a revolution.

Best regards and a happy new year!

[Hyperbolic-b (hyperbolic-b)]

I forgot to mention that we experience the problem with TB 64 bit. That means that both versions are broken (@Thunderfan confirmed it for the 32-bit version).

Furthermore, if it helps, I can provide a message example as .eml file if it would help with resolving the issue. If somebody is interested, please let me know how I can send you the example in a safe way. I won't publish it here because it contains a lot of personal data, and while I could easily remove that data from the message itself (I know how to operate a text editor :-)), removing it from the encrypted attachment is not that easy and would at least take some time.

[Mkmelin+mozilla (mkmelin+mozilla)]

To help you can create a sample message for Alice, and add an encrypted attachment in that mail. Save as .eml and attach it to this bug.
You can find her keys here: https://searchfox.org/comm-central/source/mail/test/browser/openpgp/data/keys

[Resistor5k6 (resistor5k6)]

@hyperbolic

These are exactly my thoughts.

[Kai Engert (kaie)]

Sorry for the delays, I was out sick.

I can confirm the bug. When recently re-enabling this feature, I had tested only using encrypted attachments which decrypt to plain text.
The bug occurs if the attachment decrypts to binary data.

I have a fix that I will send for review.

[Kai Engert (kaie)]

Created attachment 9196379
Bug 1663169 - Fix decrypting of attachments containing binary data. r=mkmelin

[Mkmelin+mozilla (mkmelin+mozilla)]

Do you have a sample message to attach, or a simple way to generate it?

[Mkmelin+mozilla (mkmelin+mozilla)]

It would be better to clone this bug to another one for the specific case, since otherwise tracking flags will all be wrong.

[Kai Engert (kaie)]

You're right, I'll file a separate bug, and move the patch over there.
Also, I'm working on a test.

[Kai Engert (kaie)]

Everyone, please use bug 1663169 to track the fix of the remaining bug.
Marking this one fixed again.

[Phab-bot (phab-bot)]

Comment on attachment 9196379
Bug 1663169 - Fix decrypting of attachments containing binary data. r=mkmelin

Revision D101351 was moved to bug 1686055. Setting attachment 9196379 to obsolete.

[Resistor5k6 (resistor5k6)]

Issue still exists on TB 78.6.1

[Resistor5k6 (resistor5k6)]

Issue still exists on TB 78.7.0

[Mkmelin+mozilla (mkmelin+mozilla)]

You'll want to follow bug 1686055.

[Resistor5k6 (resistor5k6)]

On
https://bugzilla.mozilla.org/show_bug.cgi?id=1686055
I read: " status-thunderbird86: --- → fixed"

When and where do we get TB86?

[Mkmelin+mozilla (mkmelin+mozilla)]

From https://www.thunderbird.net/en-US/#channel - 86 beta1 will be out in a day or two.

[Yg-info (yg-info)]

Could somebody please tell if this is working in the current beta?

I usually avoid beta versions, but this one might be an exception since this function is extremely important to us. However, I'd rather not install a beta version to learn that it's not fixed yet :-)

[K-bugzilla (k-bugzilla)]

The use of External GnuPG in TB still does not allow to decrypt attachments!

[Tobias (lolliren)]

Hi, I've stumbled across this post here after I've searched for the error message "rnp_op_verify_execute returned unexpected" on Google.

@yg-info I've tested the beta version "88.0b2" (simply downloading the .tar.bz2 for Linux and executing the "thunderbird" binary) and it's now working. The two emails, which can't be open by Thunderbird "78.9.1", can be open with Thunderbird "88.0b2".

The first email has no attachments and the second email has one attachment (simple csv file), which I can open.

I'm using (Manjaro Arch) Linux, Kernel 5.11.10-1-MANJARO, x64.

[Mkmelin+mozilla (mkmelin+mozilla)]

(In reply to bugzilla from comment #53)
> The use of External GnuPG in TB still does not allow to decrypt attachments!

If you still see it with 91 beta, please file a new bug.

[K-bugzilla (k-bugzilla)]

Is [Bug 1704820] fixed in 91 beta too?

[Mkmelin+mozilla (mkmelin+mozilla)]

No, that would be the bug (still NEW).

[Michael Altfield (maltfield)]

This has been a long-standing issue since I made the poor/forced decision to switch from enigmail to the built-in Thunderbird support.

This has been horrible. I first noticed the issue when telling my future employer (the CEO of the company) that they failed to attach my contract to an email. They did attach it, but Thunderbird just didn't display it.

That was 10 months ago. I still can't open attachments in gpg-encrypted mails.

I have no idea when (if?) this will be fixed, so I present a work around: use claws mail.

  sudo apt-get install claws-mail claws-mail-pgpmime

When someone sends me an email and I suspect there's an attachment, I just run claws mail to view the attachment. It's awful, but it works.

[Yg-info (yg-info)]

The bug is still present in TB 91.0.3 (I am not talking of external GnuPG here). The only difference, compared to comment #31, is the contents of the dialog box. It now says "Error - decryption failed" instead of "null / undefined".

[Mkmelin+mozilla (mkmelin+mozilla)]

The general case works for me. If it doesn't work for you, there must be something special going on with the attachment or with your setup.

[Yg-info (yg-info)]

For the people who are coming to this page via Google: The problem occurs if the attachments are without MDC (which can still happen even today). This has become a new bug report: https://bugzilla.mozilla.org/show_bug.cgi?id=1729221

[K-bugzilla (k-bugzilla)]

Does not work for me in 102.0.2 (64-Bit).