Debian Repairs Thunderbird’s PGP Mail Regression in a Second Update

A Trixie desktop can have Thunderbird 153.5.1 installed and still be missing Debian’s latest repair for PGP-encrypted mail. The version Debian asks users to install is 1:153.5.1esr-1~deb13u2. Keep that final deb13u2 in the comparison: the upstream application number alone does not identify the corrected package.

Why Debian issued another package

The October 27 security-team notice is DSA-6585-2, a follow-up to DSA-6585-1. Debian says the earlier update introduced a regression affecting support for PGP-encrypted email. Updated packages correct it, and the team recommends upgrading Thunderbird.

That gives someone with newly unreadable encrypted mail a fairly specific lead. If the trouble began after the security update, check the application package before rebuilding the account or asking a correspondent to send different keys. The notice describes a software fault. It contains no instruction to replace existing PGP keys.

There are two dates to keep straight. Our earlier Trixie Thunderbird report covered a previous security release. The new notice repairs a later update; it does not withdraw the case for keeping the mail client patched.

Read the full Installed line

Run apt policy thunderbird on a system using Debian’s package. The output separates Installed from Candidate. A newer Candidate means an update is offered by the configured repositories, not that the running mail client already contains it.

Refresh the package lists and apply available updates through your usual Debian update tool. Then read the Installed entry again. Debian’s published repaired version is the reference for Trixie, including its epoch, ESR designation and distribution revision.

Do this source check before drawing conclusions from the result. A Thunderbird downloaded separately or installed as a Flatpak has its own update channel. Likewise, the Trixie version in this advisory is not an instruction to install a Debian 13 package on another release.

Go back to the message that failed

Once the package is updated, quit Thunderbird completely and reopen it. Try a known PGP-encrypted message that previously opened correctly. An ordinary message arriving in the inbox would not exercise the feature Debian says regressed.

If that encrypted message still fails, keep its error wording and the complete installed version for troubleshooting. Leave the profile and keys intact while establishing what remains wrong. A public report can describe the failure without including private keys or confidential message text.

The useful stopping point is a repaired package followed by a successful encrypted-mail check. If only the package step succeeds, the remaining failure still needs investigation; repeatedly changing encryption settings would make the original sequence harder to reconstruct.