I have just upgraded from Thunderbird 68 with Enigmail to Thunderbird 78, with its native OpenPGP features. However, the migration from Enigmail didn't succeed and it fails to associate the keys in my keyring to my e-mail accounts.
When I first upgraded, Enigmail popped up a tab with a "Migrate" button on it. At first it didn't work -- it kept complaining that Thunderbird's OpenPGP infrastructure wasn't initialised -- but turning it off-and-on again got me passed that.
When I successfully started the migration, it started asking me for passwords to keys. Fair enough, I assume it was just trying to validate them. However, then it started asking me the password to a revoked key. I'm pretty sure I got the password right -- although it was revoked in 2016, so I can't be sure -- but it just kept going round in a loop. Ultimately, I cancelled this and Enigmail completed, with the warning that this key couldn't be imported. That's fine; like I say, it's revoked.
Now, in Account Settings > Account > End-To-End Encryption, it fails to associate my key with my accounts. I assume it does this based on the key identity matching the account's e-mail address. My main key has many identities associated with it (one for my personal e-mail, one for work, etc.), is this what is causing the association to fail? (Incidentally, my keys do correctly appear in Thunderbird's OpenPGP key manager.)
Seeing that this doesn't work, I try exporting my keys with
gnupg and importing them into Thunderbird. It correctly recognises the keys when I do the import, but then it starts asking for the password to that revoked key again! I don't know what that key has to do with my new keys, apart from it has the same identity.
If I don't do anything -- i.e., assume it will work magically -- when I try to send a signed or encrypted e-mail, it complains that it cannot find the secret key for my identity's key. So, it did work magically, in the sense that it correctly determined the signing/encryption key it should be using -- and not the revoked one -- but for some reason it fails to find the secret key. What's going on!?
Is Thunderbird shelling out to
gnupg under the hood, or does it contain its own implementation and its own keyring? If the latter, that could explain it, but if it does work that way, I'm not happy about the "forking" of keyrings. That would mean I have to maintain another set.