Thunderbird 78 Split GPG upgrade issue

User Support
1

Hi All,

I am attempting to do an upgrade from an existing enigmail / Thunderbird install and having followed the documentation I am still getting problems. Struggling to find any meaningful debug output as well, so any pointers on that would be appreciated. I have followed (and double checked) the instructions here: Split GPG | Qubes OS

When I am attempting to decrypt a message previously received I get the error “the secret key that is required to decrypt this message is not available” and nothing else. I have also found in TB’s Error Console this one solitary line:

cannot decrypt message decryption.jsm:528:15

I have tested that the qubes-gpg-client-wrapper tool is still working by copying the PGP block into a file and decrypting that with “qubes-gpg-client-wrapper -d”. I have also uninstalled enigmail in Thunderbird (both via removing the plugin fron TB and by removing the package “qubes-thunderbird”) in case there was any conflict. Following someone’s suggestion I have also checked to make sure my Debian template has libgpgme11 installed, which it does.

Any pointers would be appreciated and if there are additional steps required for upgrades rather than new installs. Happy to update docs when complete too if appropriate.

Thank you in advance!

2

A while ago this was not working for me on either Fedora or Debian (can’t remember, sorry). So I guess my advice would be for you to try the same process but changing the templateVM to be fedora.

3

“the secret key that is required to decrypt this message is not
available”

I had that exact same error. Since I create my templates with batch
files I can tell you for certain that this will work based on
debian-11-minimal:

apt install --no-install-recommends qubes-core-agent-networking
qubes-gpg-split thunderbird libgpgme11 -y

Obviously, make sure /rw/config/gpg-split-domain is set correctly in the
app VM.

Following someone’s suggestion I have also checked to make sure my
Debian template has libgpgme11 installed, which it does.

Well, if qubes-gpg-client-wrapper -K is showing you your private keys
and apt search libgpgme11 says it’s installed … then I don’t know what
else it could be.

You could try a new debian-10-minimal based template and just install
the 4 packages I listed above.

4

batch files

lol … bash scripts … have to do some Windows based work today and
that’s messing with my head.

5

Thanks for the response Sven. Unfortunately I have just tried your suggestion of a fresh template with your apt command and it hasn’t made any difference. This suggests that the problem lies with the Thunderbird profile / something in my qubes’ home directory instead.

I’m not keen on the scorched earth approach - I’d rather work out what the cause is and fix it. That and I don’t really want to introduce different distros, so I’d like to stick with Debian. Anyone got any debug suggestions?

Thanks again!