On 2020-08-14 21:12 -0400, M Piles wrote: | | | | OpenPGP functionality for | | | Thunderbird 78 is still work in | | | progress, and is disabled by | | | default in the initial 78.0 | | | release. | | | | 78+ versions do not support Enigmail | | anymore it seems... | | Looking at the release notes for | 78.1.1 | (https://www.thunderbird.net/en-US/thunderbird/78.1.1/releasenotes/) | it looks like they've gotten OpenPGP | working but they're still testing it. | It should be fine in later versions. Posteo said something about this back in July: https://posteo.de/en/blog/enigmail-users-do-not-update-to-thunderbird-78

On Fri, Aug 14, 2020, 9:45 PM mpan <archml-y1vf3axu@mpan.pl> wrote:

...

Is there any reason the package is stuck to version 68? The reason is given on the very top of the page you have linked.

Correct me if I'm wrong, but couldn't we package thunderbird 78 in something like testing or the AUR for people who absolutely need 78, and then keep the stable version how it is? Yash

Am 15.08.20 um 05:39 schrieb Kusoneko:

On August 15, 2020 3:27:50 AM UTC, karx via arch-general <arch-general@archlinux.org> wrote:

...

couldn't we package thunderbird 78 in the AUR for people who absolutely need 78,

Sure, go ahead and do that if you want.

There is thunderbird-bin in the AUR which repackages the official upstream release of version 78.*

Le 15 août 2020 11:32:51 GMT+04:00, Franck STAUFFER <franck.stauffer@monaco.mc> a écrit :

Shouldn't it be the opposite? This is not Debian Stable, packages should be up-to-date and if people want older package they have to package it themselves in AUR. Am I wrong?

Not when a feature expected by many Arch users is broken.

Is it possible to update it in [testing] at least? This version is not an “upgradeable” release, as stated by the upstream. Not considered “next version” in the upgrades sequence. The next version after 68.11 is 78.2, which is not released yet.

Hypothetically [testing] could provide that release, but what for? To produce bug reports that will need to be dismissed immediately, because people didn’t suspected the upgrade is expected to break their installations? What is the reason to install 78.0 or 78.1? Unless either: - You are interested in very early previews, in which case you probably should be on nightly anyway; - You are among the people affected by the CVEs present in 68.11? But if you have a reason, you can install the official Mozzila’s release. There even is a ready PKGBUILD posted by someone on AUR, so you do not need to write your own from scratch: https://aur.archlinux.org/packages/thunderbird-bin/ A side note: I am not simply dismissive. Initially I was considering that putting it in [testing] may be a good idea. But after some talking with people around I changed my opinion.

On 8/15/20 2:38 PM, Geo Kozey wrote:

...

---------------------------------------- From: Franck STAUFFER <franck.stauffer@monaco.mc> Sent: Sat Aug 15 09:32:51 CEST 2020 To: karx via arch-general <arch-general@archlinux.org> Subject: Re: [arch-general] Thunderbird 78

Shouldn't it be the opposite? This is not Debian Stable, packages should be up-to-date and if people want older package they have to package it themselves in AUR. Am I wrong?

Upstream requested all distros to not ship Thunderbird 78 until 78.2 is released: https://twitter.com/mozthunderbird/status/1284418789153497090

Yours sincerely

G. K.

Since upstream is now on version 78.3.3 and the message about upgrading (on release notes) has disappeared since version 78.2.3 shouldn't we get this update now? -- Franck STAUFFER ~^~ // "\\ /\\ \\ // //\\\ --------------------------- @ // ///=\\SCII Ribbon Campaign X /=---=\\gainst HTML E- Mail, vCards X /// \\nd MS attachments // \\ ------------------------------------ \ // \\ \// \\ \\

From: Bjoern Franke via arch-general <arch-general@archlinux.org> Sent: Tue Oct 27 14:35:38 CET 2020 To: <arch-general@archlinux.org> Cc: Bjoern Franke <bjo@schafweide.org> Subject: Re: [arch-general] Thunderbird 78

I've switched now to 78.4.0 (from AUR) and it seems at lot of bugs of the first 78.x releases are gone.

And even Ubuntu ships 78.x now, so switching to 78.x should be fine :)

Even debian oldstable ships it :) https://packages.debian.org/stretch/thunderbird I think the problem may be that current maintainers don't really use it and don't have the time for it. Maybe it should be dropped to AUR? Yours sincerely G. K.

Am 27.10.20 um 23:12 schrieb Javier via arch-general:

I really hope not, I prefer to wait than having to build TB on every release. Besides, current version works just fine...

There are also bin-packages so you don't have build it really. Best Regards Bjoern

Le 28/10/2020 à 15:20, Maarten de Vries via arch-general a écrit :

On Tue, 27 Oct 2020 at 23:26, Bjoern Franke via arch-general < arch-general@archlinux.org> wrote:

...

Am 27.10.20 um 23:12 schrieb Javier via arch-general:

...

I really hope not, I prefer to wait than having to build TB on every release. Besides, current version works just fine... There are also bin-packages so you don't have build it really.

True, but it still won't update automatically with `pacman -Syu`. For an email client, automatic security updates are quite important. Having to update manually from the AUR would certainly be a downgrade in user experience.

An AUR helper can solve this, but a binary is not good when it can be avoided for system shared libs instead.

Anyway, I can't imagine that not a single Arch packager or TU is using thunderbird.

Several of us use it (though I guess most use mutt or neomutt), but anthraxx, the maintainer, seems quite busy and want to triple check things around the new GPG interface before pushing. Regards, Archange

Could you guys reference the security patches that Arch is critically missing out on by delaying this update? I've noticed a couple of you speaking on that, but not actually citing any concrete problem areas. With the update, TB is implementing PGP by themselves without gnupg for internal PGP usage. This is quite a large change, security-wise, and could result in encryption/signing being broken. For this reason, some of the Arch security team is doing their work and relentlessly reviewing their implementation, among other changes that have been included in the update binaries. This is being done because it's known that PGP on Thunderbird at the current version in Arch is still using gnupg to do it's work, so it's known that we can depend on that PGP implementation in a stable way. Arch wants to make sure that it's users aren't being faked out; that is, if Arch users expect that they're using their PGP keys for their email, but TBird's implementation is broken in some way, that would cause havoc within the community and possibly leak out private information that people depend on PGP to keep safe. Yes, it's taking longer than usual. But the good news is, after this update, I doubt Mozilla will be modifying their PGP implementation anytime soon, and thus won't need such close review. Disclaimer: I'm not an Arch TU, staff member, or anything like that. I'm just a community member. On Wed, Oct 28, 2020 at 12:20:45PM +0100, Maarten de Vries via arch-general wrote:

On Tue, 27 Oct 2020 at 23:26, Bjoern Franke via arch-general < arch-general@archlinux.org> wrote:

...

Am 27.10.20 um 23:12 schrieb Javier via arch-general:

...

I really hope not, I prefer to wait than having to build TB on every release. Besides, current version works just fine...

There are also bin-packages so you don't have build it really.

True, but it still won't update automatically with `pacman -Syu`. For an email client, automatic security updates are quite important. Having to update manually from the AUR would certainly be a downgrade in user experience.

Anyway, I can't imagine that not a single Arch packager or TU is using thunderbird.

-- Maarten

-- Kevin Morris Software Developer

From: Kevin Morris <kevr@0cost.org> Sent: Thu Oct 29 00:28:04 CET 2020 To: General Discussion about Arch Linux <arch-general@archlinux.org> Subject: Re: [arch-general] Thunderbird 78

Could you guys reference the security patches that Arch is critically missing out on by delaying this update? I've noticed a couple of you speaking on that, but not actually citing any concrete problem areas.

I sent mail with link to mozilla advisory 10h before you asked for it so this complaint is completely off. https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/

With the update, TB is implementing PGP by themselves without gnupg for internal PGP usage. This is quite a large change, security-wise, and could result in encryption/signing being broken. For this reason, some of the Arch security team is doing their work and relentlessly reviewing their implementation, among other changes that have been included in the update binaries.

That's nice to hear that Arch is now doing security audit of package updates even when facing lack of manpower. I understand you work closely with upstream and other distros which faced exact same issue and we will see your final report and patches sent upstream.

This is being done because it's known that PGP on Thunderbird at the current version in Arch is still using gnupg to do it's work, so it's known that we can depend on that PGP implementation in a stable way. Arch wants to make sure that it's users aren't being faked out; that is, if Arch users expect that they're using their PGP keys for their email, but TBird's implementation is broken in some way, that would cause havoc within the community and possibly leak out private information that people depend on PGP to keep safe.

That's great but again is this cooperated with upstream and other distros in any way? As they made updates already them may have some knowledge about the matter and it would be waste if every single distro had to learn everything from scratch.

Yes, it's taking longer than usual. But the good news is, after this update, I doubt Mozilla will be modifying their PGP implementation anytime soon, and thus won't need such close review.

Well, if you find some issues (which is the point) then they will have to modify their implementation, no? Yours sincerely G. K.

From: Morten Linderud via arch-general <arch-general@archlinux.org> Sent: Thu Oct 29 13:57:35 CET 2020 To: <arch-general@archlinux.org> Cc: Morten Linderud <foxboron@archlinux.org> Subject: Re: [arch-general] Thunderbird 78

On Thu, Oct 29, 2020 at 01:51:23PM +0100, Geo Kozey via arch-general wrote:

...

...

From: Kevin Morris <kevr@0cost.org> With the update, TB is implementing PGP by themselves without gnupg for internal PGP usage. This is quite a large change, security-wise, and could result in encryption/signing being broken. For this reason, some of the Arch security team is doing their work and relentlessly reviewing their implementation, among other changes that have been included in the update binaries.

That's nice to hear that Arch is now doing security audit of package updates even when facing lack of manpower. I understand you work closely with upstream and other distros which faced exact same issue and we will see your final report and patches sent upstream.

We don't do this. We don't have the capacity, nor the technical capability to review these things. Ensuring it works is not the same as going through implementation details.

I do not know where Kevin got this impression from.

-- Morten Linderud PGP: 9C02FF419FECBE16

I know, I don't demand something like this from Arch devs and I knew someone is speaking about things they don't know here so my reply was a bit sarcastic :) My only advice would be to push new TB to testing so you get at least some initial feedback from users if something is broken or not. Yours sincerely G. K.

Hi,

I have not thoroughly tested through things on the build yet, though. I have never used thunderbird much, so I'm not sure I would be the best person to test and ensure all of it's features work right. I do want to however verify that removing the newly unsupported flags isn't breaking anything.

Let me know if you'd like the PKGBUILD, or if I can do anything to help you guys with this update. I've got time to do extra things for now.

I have used the 78.x betas and they had bugs like error messages about broken keys though I didn't want to encrypt or sign a message. 78.4.1 is out now, so maybe Levente or Jan could find some time to update it :) Best Regards Bjoern

On 08.11.20 07:18, Archange via arch-general wrote:

anthraxx did update the PKGBUILD and we are testing the build but currently for instance I’m unable to decrypt messages using the external GnuPG feature (reported upstream), and there is also a build issue with system bzip2 (I used the vendored one instead, but that’s not what we want for the final build).

So for now this remain WIP.

Can this at least be built and placed to "testing"? This would offer at least some way to easily get pending security updates installed without manual compiling. Manuel

On 09.11.20 17:27, Jens John wrote:

Just don't bother with Arch's release cycle and use Mozilla's build, either directly (with auto updates) or through https://aur.archlinux.org/packages/thunderbird-bin/.

That's what I did not. I uninstalled the thunderbird package completely and used Mozilla's build with auto update until Arch finally gets the needed security updates shipped. If there is a small percentage of Arch users which has issues with GPG, maybe it would be better to ship TB 78 and this small percentage of users uses Mozilla builds until the pending bugs are fixed? This would provide a more secure environment for the Arch userbase... Manuel

Hello Nico, You cannot use gpg for public key operations but for secret key ops. Please follow the instructions for smartcards (no smartcard daemon needed obviously): https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards Then you can use the external gpg with your ~/.gnupg for decryption and signing. Best wishes, NTS On 28 Nov 2020 9:36 a.m., "NicoHood" <archlinux@nicohood.de> wrote: Thunderbird 78 is in the repos for quite some time now. Can anyone please explain me what is the best way to use GPG now for email encryption? I read that Archlinux aims to use the system wide gpg keyring instead of thunderbirds builtin store. Is that still the case and is that implemented yet? Thunderbird asks me to migrate my keys, and I am not sure, if I should not wait a few more days. Having the private key in multiple places is really not the best idea in my opinion. Depending on the current state we could also add a news on the archlinux website or at least update the wiki: https://wiki.archlinux.org/index.php/Thunderbird/Enigmail Cheers Nico