Install & update Thunderbird from Debian repositories instead of shipping a perpetually outdated version

intrigeri
2026-04-27T09:02:46Z

[[_TOC_]]

# Context

Mid-term we want to tails/tails#21374+ so the plan encoded in this issue is meant to be a _temporary_ solution to tails/tails#21202+ and tails/tails#21337+. As such, we want to keep it as _cheap_ as possible, while ...

Context

Localization packages

Packages size

To Do

Preparation

Iteration 1: ensure Thunderbird is kept up-to-date

Iteration 2: make ISO/USB images and IUKs smaller

What does not change as part of this plan

Context

Mid-term we want to Migrate Thunderbird from Additional Software to... (#21374) so the plan encoded in this issue is meant to be a temporary solution to Document the known risks of using Thunderbird i... (#21202 - closed) and Deal with Thunderbird being less hardened than ... (#21337 - closed). As such, we want to keep it as cheap as possible, while not making UX much worse.

The discussion that @anonym and @sajolida had in December 2025 about #21202 (closed), #21337 (closed), and !2640 (closed), was focused on short-term stopgaps. Unfortunately:

The discussion did not take #21216 (closed) into account.

The plan designed during that discussion mitigates the problem somewhat, but does not really solve it. Worse, we don't have full clarity about how well the mitigation would work, i.e. what proportion of the vulnerabilities fixed in each Thunderbird update can't be exploited under Simple HTML. For this mitigation to actually buy us anything, the answer must be "most of the case, 100%". Also, it'll be difficult to tell, for every such vulnerability, whether we have mitigated it successfully.

The plan designed during that discussion is quite expensive for other teams, and it's hard to make it actionable for users, e.g.

The communication strategy is tricky.

It's pretty hard to explain users if/when they can change their Message Body As setting; most users will have a hard time discovering they can even do that when Simple HTML is not enough; how would they remember switching back?

In other words that plan was de facto optimized for a low cost of implementation for the Tails Team (indeed !2640 (closed) looks pretty simple!), with the bulk of the cost on the plate of tech writers and comms people.

Since then, @intrigeri and @sajolida discussed this again, zooming out a little to look at the bigger picture, and in particular taking into account the ideas raised on #21216 (closed). This issue encodes the conclusions from this discussion.

Localization packages

Packages size

On Tails 7.4, after having run apt purge thunderbird-* && apt autopurge, all sizes rounded to the closest MB:

| download | installed (RAM)

Option A (for reference) — Installing Thunderbird with no l10n package:

apt install thunderbird

70

282

Option B — Installing Thunderbird and 1 single l10n package:

apt install thunderbird thunderbird-l10n-id

71

283

Option C — Installing Thunderbird and the same l10n packages that we currently include by default i.e. tier-1 languages:

apt install thunderbird thunderbird-l10n-ar thunderbird-l10n-de thunderbird-l10n-es-es thunderbird-l10n-fr thunderbird-l10n-id thunderbird-l10n-it thunderbird-l10n-pt-br thunderbird-l10n-ru thunderbird-l10n-tr thunderbird-l10n-zh-cn

75

288

Option D — Installing Thunderbird and all available l10n packages:

apt install thunderbird thunderbird-l10n-all

101

323

To Do

Preparation

Figure out how to handle l10n of Thunderbird

Check the size of thunderbird-l10n-all and its dependencies

Get UX input

If it's not too big: we'll use that → encode this in the plan below

Else: encode in the plan below that we have to programmatically determine which l10n package we should install, depending on the user's chosen locale

Verify that it's OK to drop our Thunderbird patches

Analyze and propose

Validate conclusions

Iteration 1: ensure Thunderbird is kept up-to-date

In Tails 7.5, we keep shipping Thunderbird in the images, but we ensure it's kept up-to-date thanks to the Additional Software feature.

Drop our Thunderbird patches

Drop patches

Drop corresponding code and doc

Handle case A: if Thunderbird & Additional Software persistent storage features are both enabled: add thunderbird and l10n package(s) to Additional Software, let the user know

End result:

User gets updates through Additional Software

Thunderbird is in Persistent Storage, ready for the next step

Uses more RAM

Regarding l10n packages:

It's worth giving it a try to map the user's locale to 1 single Thunderbird localization package, and when we find a match, add that one, and only that one, to Additional Software.

Implement a basic programmatic mapping algorithm.

Ensure the mapping is correct for tier-1 languages, hard-coding exceptions to the programmatic mapping if needed. This way we don't regress for users who currently have their Thunderbird localized.

Hope for the best for non-tier-1 languages. If/when users later report "for locale ll_LL I need thunderbird-l10n-XYZ but your code does not guess that automatically" we can add it to the list of exceptions.

If it turns out it's not so cheap to implement, it's acceptable to fall back to option C, to get the same l10n support for users as what we currently ship.

To Do for case A

write code for case A

implement design for l10n language

implement a basic programmatic mapping algorithm

ensure the mapping is correct for tier-1 languages

evaluate cost of communicating case A success when starting Thunderbird instead of after having updated the config (!2738 (comment 277039))

design UI for case A

implement UI design for case A

write doc that the UI points to for case A

Handle case B: if Thunderbird persistence feature is enabled but Additional Software is not: send user to doc that instructs them to add Thunderbird and localization packages to Additional Software → they go to case A

write code for case B

design UI for case B

implement UI design for case B

fix startup of the update config service in case B

fix opening the doc from the notification

don't tell the user we've added Thunderbird to Additional Software when they start Thunderbird on next boot, after they've done it manually themselves during this session

improve handling of case B (!2738 (comment 277890))

write doc that the UI points to for case B

Note: if the user does not follow the doc, we'll keep asking them to do it on every boot. If they don't want to use Thunderbird anymore, and thus don't want to be nagged anymore, they have to disable the Thunderbird persistent storage feature, which will turn off the nagging.

Handle case C: Thunderbird persistent storage feature is not enabled: status quo, Thunderbird is available.

Ensure tails-additional-software-update-config.service starts automatically once tails-additional-software-install.service has started

Preserve the relevant bits of config/chroot_local-includes/usr/local/bin/thunderbird, e.g. MOZ_REMOTE_SETTINGS_DEVTOOLS=1 which is require for some of the prefs we set in aa_tails.js to actually take effect

Ensure we do this migration only once

Check that the design & implementation make sense when running from an ISO

Ask sajolida to test the various relevant cases

Fix URLs to doc in the code: look for TODO:UX in the diff

Decide when we'll do iteration 2 (!2738 (comment 277643))

Adjust "Tails 7.N+x (MONTH YEAR)" in the code

Communicate about this change via release notes + doc only

We want to focus on users who are actually impacted (by the previous security issues, and by the newly worse UX), instead of making lots of noise for everybody else.

Archive the tails/thunderbird GitLab project

tails/gitlab-config!110

Iteration 2: make ISO/USB images and IUKs smaller

In Tails 7.8, we stop shipping Thunderbird in the images, which will make the images and IUKs smaller.

Our goal is to have everything ready ahead of time: it has to be reviewed and approved by May 7. Then we'll merge it at the right time during the 7.8 dev cycle (not too early because we don't want this to be prematurely released in a 7.7.x emergency release).

We will communicate about this change via release notes + doc only: we want to focus on users who are actually impacted (by the previous security issues, and by the newly worse UX), instead of making lots of noise for everybody else.

Stop installing Thunderbird packages in the images

Handle case A: Thunderbird is installed on startup via Additional Software, in theory they don’t notice the transition, as long as they've gone through the migration already

Handle case C (and case B that haven't followed our instructions)

ship a thunderbird.desktop that points to doc

implement

include the Thunderbird icon in our image so that the launcher and new dialog can use it

review & improve the UI design (@sajolida)

write doc that explains they should enable Persistent Storage, install Thunderbird + localization packages, and accept adding them to Additional Software. (@sajolida)

Update the UI strings that say we will remove Thunderbird in the future

Update the doc that says we will remove Thunderbird in the future

Update the doc that says that language packs are "included"

Adjust automated test suite

Ensure our wrapper is still used once Thunderbird is installed

Write snippets for release notes (@sajolida)

What does not change as part of this plan

We keep our Thunderbird config in /etc.

Message Body As remains the default "Original HTML": once Thunderbird is kept up-to-date, the marginal cost / marginal benefit of changing this setting gets much worse. If desired, a new issue can be created to consider changing this for additional hardening. If you do so, please copy the notes about it from this issue and from !2640 (closed).