diff -Nru thunderbird-78.9.0+build2/BUILDID thunderbird-78.9.1+build1/BUILDID
--- thunderbird-78.9.0+build2/BUILDID	2021-03-29 16:18:13.000000000 +0000
+++ thunderbird-78.9.1+build1/BUILDID	2021-04-08 08:48:23.000000000 +0000
@@ -1 +1 @@
-20210322094744
\ No newline at end of file
+20210406220621
\ No newline at end of file
diff -Nru thunderbird-78.9.0+build2/comm/calendar/providers/caldav/CalDavCalendar.jsm thunderbird-78.9.1+build1/comm/calendar/providers/caldav/CalDavCalendar.jsm
--- thunderbird-78.9.0+build2/comm/calendar/providers/caldav/CalDavCalendar.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/calendar/providers/caldav/CalDavCalendar.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -1778,6 +1778,9 @@
           return normalized == chs.path || normalized == chs.spec;
         };
         let createBoxUrl = path => {
+          if (!path) {
+            return null;
+          }
           let newPath = this.ensureDecodedPath(path);
           // Make sure the uri has a / at the end, as we do with the calendarUri.
           if (newPath.charAt(newPath.length - 1) != "/") {
@@ -1811,7 +1814,7 @@
           this.mInboxUrl = createBoxUrl(response.firstProps["C:schedule-inbox-URL"]);
           this.mOutboxUrl = createBoxUrl(response.firstProps["C:schedule-outbox-URL"]);
 
-          if (this.calendarUri.spec == this.mInboxUrl.spec) {
+          if (!this.mInboxUrl || this.calendarUri.spec == this.mInboxUrl.spec) {
             // If the inbox matches the calendar uri (i.e SOGo), then we
             // don't need to poll the inbox.
             this.mShouldPollInbox = false;
diff -Nru thunderbird-78.9.0+build2/comm/chat/modules/OTRLib.jsm thunderbird-78.9.1+build1/comm/chat/modules/OTRLib.jsm
--- thunderbird-78.9.0+build2/comm/chat/modules/OTRLib.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/chat/modules/OTRLib.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -13,62 +13,78 @@
 
 var abi = ctypes.default_abi;
 
-// Open libotr. Determine the path to the chrome directory and look for it
-// there first. If not, fallback to searching the standard locations.
 var libotr, libotrPath;
 
-function tryLoadOTR(name, suffix) {
-  let filename = ctypes.libraryName(name) + suffix;
+function getLibraryFilename(baseName, suffix) {
+  return ctypes.libraryName(baseName) + suffix;
+}
+
+function getDistributionFilename() {
+  let baseName;
+  let suffix;
+
+  switch (systemOS) {
+    case "winnt":
+      baseName = "libotr-5";
+      suffix = "";
+      break;
+    case "darwin":
+      baseName = "otr.5";
+      suffix = "";
+      break;
+    default:
+      baseName = "otr";
+      suffix = ".5";
+      break;
+  }
+
+  return getLibraryFilename(baseName, suffix);
+}
+
+function getDistributionFullPath() {
   let binPath = Services.dirsvc.get("XpcomLib", Ci.nsIFile).path;
   let binDir = OS.Path.dirname(binPath);
-  libotrPath = OS.Path.join(binDir, filename);
+  return OS.Path.join(binDir, getDistributionFilename());
+}
 
-  let loadFromInfo;
+function tryLoadOTR(filename, info) {
+  console.debug(`Trying to load ${filename}${info}`);
+  libotrPath = filename;
 
   try {
-    loadFromInfo = libotrPath;
-    libotr = ctypes.open(libotrPath);
+    libotr = ctypes.open(filename);
   } catch (e) {}
 
-  if (!libotr) {
-    try {
-      loadFromInfo = "system's standard library locations";
-      // look in standard locations
-      libotrPath = filename;
-      libotr = ctypes.open(libotrPath);
-    } catch (e) {}
-  }
-
   if (libotr) {
-    console.debug(
-      "Successfully loaded OTR library " + filename + " from " + loadFromInfo
-    );
+    console.debug("Successfully loaded OTR library " + filename + info);
   }
 }
 
 function loadExternalOTRLib() {
-  if (!libotr && (systemOS === "winnt" || systemOS === "darwin")) {
-    // otr.5.dll or otr.5.dylib
-    tryLoadOTR("otr.5", "");
+  const systemInfo = " from system's standard library locations";
+
+  // Try to load using an absolute path from our install directory
+  if (!libotr) {
+    tryLoadOTR(getDistributionFullPath(), "");
   }
 
-  if (!libotr && systemOS === "winnt") {
-    // otr-5.dll
-    tryLoadOTR("otr-5", "");
+  // Try to load using our expected filename from system directories
+  if (!libotr) {
+    tryLoadOTR(getDistributionFilename(), systemInfo);
   }
 
-  if (!libotr && systemOS === "winnt") {
-    // libotr-5.dll
-    tryLoadOTR("libotr-5", "");
+  // Try other filenames
+
+  if (!libotr && systemOS == "winnt") {
+    tryLoadOTR(getLibraryFilename("otr.5", ""), systemInfo);
   }
 
-  if (!libotr && !(systemOS === "winnt") && !(systemOS === "darwin")) {
-    // libotr.so.5
-    tryLoadOTR("otr", ".5");
+  if (!libotr && systemOS == "winnt") {
+    tryLoadOTR(getLibraryFilename("otr-5", ""), systemInfo);
   }
 
   if (!libotr) {
-    tryLoadOTR("otr", "");
+    tryLoadOTR(getLibraryFilename("otr", ""), systemInfo);
   }
 
   if (!libotr) {
diff -Nru thunderbird-78.9.0+build2/comm/mail/base/content/msgSecurityPane.inc.xhtml thunderbird-78.9.1+build1/comm/mail/base/content/msgSecurityPane.inc.xhtml
--- thunderbird-78.9.0+build2/comm/mail/base/content/msgSecurityPane.inc.xhtml	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/base/content/msgSecurityPane.inc.xhtml	2021-04-08 08:36:21.000000000 +0000
@@ -68,7 +68,7 @@
       <vbox id="signatureKey" class="message-security-container"
             collapsed="true">
         <hbox flex="1" align="center">
-          <label id="signatureKeyId" flex="1"/>
+          <label id="signatureKeyId" flex="1" context="copyPopup"/>
           <button id="viewSignatureKey" data-l10n-id="openpgp-view-signer-key"
                   oncommand="viewSignatureKey()" collapsed="true"/>
         </hbox>
@@ -103,7 +103,7 @@
 
       <vbox id="encryptionKey" class="message-security-container"
             collapsed="true">
-        <label id="encryptionKeyId"/>
+        <label id="encryptionKeyId" context="copyPopup"/>
         <hbox pack="end">
           <button id="viewEncryptionKey"
                   data-l10n-id="openpgp-view-your-encryption-key"
diff -Nru thunderbird-78.9.0+build2/comm/mail/components/compose/content/MsgComposeCommands.js thunderbird-78.9.1+build1/comm/mail/components/compose/content/MsgComposeCommands.js
--- thunderbird-78.9.0+build2/comm/mail/components/compose/content/MsgComposeCommands.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/components/compose/content/MsgComposeCommands.js	2021-04-08 08:36:21.000000000 +0000
@@ -4747,7 +4747,10 @@
     msgcomposeWindow.setAttribute("msgtype", msgType);
     msgcomposeWindow.dispatchEvent(event);
     if (event.defaultPrevented) {
-      throw Components.Exception("", Cr.NS_ERROR_ABORT);
+      throw Components.Exception(
+        "compose-send-message prevented",
+        Cr.NS_ERROR_ABORT
+      );
     }
 
     gAutoSaving = msgType == Ci.nsIMsgCompDeliverMode.AutoSaveAsDraft;
diff -Nru thunderbird-78.9.0+build2/comm/mail/config/version_display.txt thunderbird-78.9.1+build1/comm/mail/config/version_display.txt
--- thunderbird-78.9.0+build2/comm/mail/config/version_display.txt	2021-03-29 16:02:10.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/config/version_display.txt	2021-04-08 08:36:21.000000000 +0000
@@ -1 +1 @@
-78.9.0
+78.9.1
diff -Nru thunderbird-78.9.0+build2/comm/mail/config/version.txt thunderbird-78.9.1+build1/comm/mail/config/version.txt
--- thunderbird-78.9.0+build2/comm/mail/config/version.txt	2021-03-29 16:02:10.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/config/version.txt	2021-04-08 08:36:21.000000000 +0000
@@ -1 +1 @@
-78.9.0
+78.9.1
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/am-e2e/prefs/e2e-prefs.js thunderbird-78.9.1+build1/comm/mail/extensions/am-e2e/prefs/e2e-prefs.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/am-e2e/prefs/e2e-prefs.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/am-e2e/prefs/e2e-prefs.js	2021-04-08 08:36:21.000000000 +0000
@@ -37,6 +37,12 @@
 // The hexadecimal OpenPGP key ID externally configured by GnuPG used for an identity.
 pref("mail.identity.default.last_entered_external_gnupg_key_id", "");
 
+// Load a JSON file that contains recipient key alias rules. See bug 1644085.
+// Suggested filename: openpgp-alias-rules.json
+// Simple filenames (without path) are loaded from the profile directory.
+// If you need to specify a path, use a file:// URL
+pref("mail.openpgp.alias_rules_file", "");
+
 // When sending, encrypt to this additional key. Not available in release channel builds.
 pref("mail.openpgp.debug.extra_encryption_key", "");
 
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -10,11 +10,15 @@
 
 const EXPORTED_SYMBOLS = ["BondOpenPGP"];
 
-var { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm");
-var { MailConstants } = ChromeUtils.import(
-  "resource:///modules/MailConstants.jsm"
+var { XPCOMUtils } = ChromeUtils.import(
+  "resource://gre/modules/XPCOMUtils.jsm"
 );
 
+XPCOMUtils.defineLazyModuleGetters(this, {
+  MailConstants: "resource:///modules/MailConstants.jsm",
+  Services: "resource://gre/modules/Services.jsm",
+});
+
 var { EnigmailLazy } = ChromeUtils.import(
   "chrome://openpgp/content/modules/lazy.jsm"
 );
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/cryptoAPI/interface.js thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/cryptoAPI/interface.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/cryptoAPI/interface.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/cryptoAPI/interface.js	2021-04-08 08:36:21.000000000 +0000
@@ -44,6 +44,11 @@
       })
       .catch(gotResult => {
         console.log("CryptoAPI.sync() failed result: %o", gotResult);
+        if (gotResult instanceof Error) {
+          inspector.exitNestedEventLoop();
+          throw gotResult;
+        }
+
         res = gotResult;
         inspector.exitNestedEventLoop();
       });
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/encryption.jsm thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/encryption.jsm
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/encryption.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/encryption.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -58,6 +58,7 @@
 const ENC_TYPE_ATTACH_BINARY = 1;
 
 var EnigmailEncryption = {
+  // return object on success, null on failure
   getCryptParams(
     fromMailAddr,
     toMailAddr,
@@ -113,6 +114,7 @@
 
     result.to = toMailAddr.split(/\s*,\s*/);
     result.bcc = bccMailAddr.split(/\s*,\s*/);
+    result.aliasKeys = new Map();
 
     if (result.to.length == 1 && result.to[0].length == 0) {
       result.to.splice(0, 1); // remove the single empty entry
@@ -124,7 +126,7 @@
 
     console.debug(`getCryptParams, got: to=${result.to}, bcc=${result.bcc}`);
 
-    if (fromMailAddr.search(/^0x/) === 0) {
+    if (/^0x[0-9a-f]+$/i.test(fromMailAddr)) {
       result.sender = fromMailAddr;
     } else {
       result.sender = "<" + fromMailAddr + ">";
@@ -149,18 +151,42 @@
         result.encryptToSender = true;
       }
 
-      var k;
-      for (k = 0; k < result.to.length; k++) {
-        //result.to[k] = result.to[k].replace(/'/g, "\\'");
-        if (result.to[k].length > 0 && result.to[k].search(/^0x/) !== 0) {
-          result.to[k] = "<" + result.to[k] + ">";
-        }
-      }
+      let recipArrays = ["to", "bcc"];
+      for (let recipArray of recipArrays) {
+        let kMax = recipArray == "to" ? result.to.length : result.bcc.length;
+        for (let k = 0; k < kMax; k++) {
+          let email = recipArray == "to" ? result.to[k] : result.bcc[k];
+          if (!email) {
+            continue;
+          }
+          email = email.toLowerCase();
+          if (/^0x[0-9a-f]+$/i.test(email)) {
+            throw new Error(`Recipient should not be a key ID: ${email}`);
+          }
+          if (recipArray == "to") {
+            result.to[k] = "<" + email + ">";
+          } else {
+            result.bcc[k] = "<" + email + ">";
+          }
+
+          let aliasKeyList = EnigmailKeyRing.getAliasKeyList(email);
+          if (aliasKeyList) {
+            // We have an alias definition.
+
+            let aliasKeys = EnigmailKeyRing.getAliasKeys(aliasKeyList);
+            if (!aliasKeys.length) {
+              // An empty result means there was a failure obtaining the
+              // defined keys, this happens if at least one key is missing
+              // or unusable.
+              // We don't allow composing an email that involves a
+              // bad alias definition, return null to signal that
+              // sending should be aborted.
+              errorMsgObj.value = "bad alias definition for " + email;
+              return null;
+            }
 
-      for (k = 0; k < result.bcc.length; k++) {
-        //result.bcc[k] = result.bcc[k].replace(/'/g, "\\'");
-        if (result.bcc[k].length > 0 && result.bcc[k].search(/^0x/) !== 0) {
-          result.bcc[k] = "<" + result.bcc[k] + ">";
+            result.aliasKeys.set(email, aliasKeys);
+          }
         }
       }
     } else if (detachedSig) {
@@ -211,7 +237,7 @@
     let sign = !!(sendFlags & EnigmailConstants.SEND_SIGNED);
     let encrypt = !!(sendFlags & EnigmailConstants.SEND_ENCRYPTED);
 
-    if (fromKeyId.search(/^(0x)?[A-Z0-9]+$/) === 0) {
+    if (/^(0x)?[0-9a-f]+$/i.test(fromKeyId)) {
       // key ID specified
       foundKey = EnigmailKeyRing.getKeyById(fromKeyId);
     }
@@ -261,6 +287,7 @@
     return ret;
   },
 
+  // return 0 on success, non-zero on failure
   encryptMessageStart(
     win,
     uiFlags,
@@ -329,7 +356,7 @@
     );
 
     if (!encryptArgs) {
-      return 0;
+      return -1;
     }
 
     if (!listener) {
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/keyRing.jsm thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/keyRing.jsm
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/keyRing.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/keyRing.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -30,6 +30,9 @@
 const { EnigmailCryptoAPI } = ChromeUtils.import(
   "chrome://openpgp/content/modules/cryptoAPI.jsm"
 );
+const { OpenPGPAlias } = ChromeUtils.import(
+  "chrome://openpgp/content/modules/OpenPGPAlias.jsm"
+);
 const { PgpSqliteDb2 } = ChromeUtils.import(
   "chrome://openpgp/content/modules/sqliteDb.jsm"
 );
@@ -986,32 +989,62 @@
     throw new Error("Not implemented");
   },
 
+  isValidForEncryption(keyObj) {
+    return this._getValidityLevelIgnoringAcceptance(keyObj, null) == 0;
+  },
+
   // returns an acceptanceLevel from -1 to 3,
   // or -2 for "doesn't match email" or "not usable"
   async isValidKeyForRecipient(keyObj, emailAddr) {
+    if (!emailAddr) {
+      return -2;
+    }
+
+    let level = this._getValidityLevelIgnoringAcceptance(keyObj, emailAddr);
+    if (level < 0) {
+      return level;
+    }
+    return this._getAcceptanceLevelForEmail(keyObj, emailAddr);
+  },
+
+  /**
+   * This function checks that given key is not expired, not revoked,
+   * and that a (related) encryption (sub-)key is available.
+   * If an email address is provided by the caller, the function
+   * also requires that a matching user id is available.
+   *
+   * @param {Object} keyObj - the key to check
+   * @param {String} [emailAddr] - optional email address
+   * @return {Integer} - validity level, negative for invalid,
+   *                     0 if no problem were found (neutral)
+   */
+  _getValidityLevelIgnoringAcceptance(keyObj, emailAddr) {
     switch (keyObj.keyTrust) {
       case "e":
       case "r":
         return -2;
     }
 
-    let uidMatch = false;
-    for (let uid of keyObj.userIds) {
-      if (uid.type !== "uid") {
-        continue;
-      }
-      let split = {};
-      if (uidHelper.getPartsFromUidStr(uid.userId, split)) {
-        let uidEmail = split.email.toLowerCase();
-        if (uidEmail === emailAddr) {
-          uidMatch = true;
-          break;
+    if (emailAddr) {
+      let uidMatch = false;
+      for (let uid of keyObj.userIds) {
+        if (uid.type !== "uid") {
+          continue;
+        }
+        let split = {};
+        if (uidHelper.getPartsFromUidStr(uid.userId, split)) {
+          let uidEmail = split.email.toLowerCase();
+          if (uidEmail === emailAddr) {
+            uidMatch = true;
+            break;
+          }
         }
       }
+      if (!uidMatch) {
+        return -2;
+      }
     }
-    if (!uidMatch) {
-      return -2;
-    }
+
     // key valid for encryption?
     if (!keyObj.keyUseFor.includes("E")) {
       return -2;
@@ -1040,6 +1073,10 @@
       return -2;
     }
 
+    return 0; // no problem found
+  },
+
+  async _getAcceptanceLevelForEmail(keyObj, emailAddr) {
     let acceptanceLevel;
     if (keyObj.secretAvailable) {
       let isPersonal = await PgpSqliteDb2.isAcceptedAsPersonalKey(keyObj.fpr);
@@ -1145,6 +1182,12 @@
   },
 
   async getKeyAcceptanceLevelForEmail(keyObj, email) {
+    if (keyObj.secretAvailable) {
+      throw new Error(
+        `Unexpected private key parameter; keyObj.fpr=${keyObj.fpr}`
+      );
+    }
+
     let acceptanceLevel = 0;
 
     let acceptanceResult = {};
@@ -1207,12 +1250,10 @@
    *                                       * addr {String}: email addresses
    *                                       * msg {String}:  related error
    *                                       }
-   *                                   - keyMap {Object<String>}: map of email addr -> keyID
-   * @param {Array<String>} resultingArray: list of found key IDs
    *
    * @return {Boolean}: true if at least one key missing; false otherwise
    */
-  async getValidKeysForAllRecipients(addresses, details, resultingArray) {
+  async getValidKeysForAllRecipients(addresses, details) {
     if (!addresses) {
       return null;
     }
@@ -1220,7 +1261,6 @@
     let keyMissing = false;
     if (details) {
       details.errArray = [];
-      details.keyMap = {};
     }
     for (let i = 0; i < addresses.length; i++) {
       let addr = addresses[i];
@@ -1228,8 +1268,8 @@
         continue;
       }
       // try to find current address in key list:
-      let keyId = null;
       var errMsg = null;
+      addr = addr.toLowerCase();
       if (!addr.includes("@")) {
         throw new Error(
           "getValidKeysForAllRecipients unexpected lookup for non-email addr: " +
@@ -1237,19 +1277,62 @@
         );
       }
 
+      let aliasKeyList = this.getAliasKeyList(addr);
+      if (aliasKeyList) {
+        for (let entry of aliasKeyList) {
+          let foundError = true;
+
+          let key;
+          if ("fingerprint" in entry) {
+            key = this.getKeyById(entry.fingerprint);
+          } else if ("id" in entry) {
+            key = this.getKeyById(entry.id);
+          }
+          if (key && this.isValidForEncryption(key)) {
+            let acceptanceResult = {};
+            await PgpSqliteDb2.getFingerprintAcceptance(
+              null,
+              key.fpr,
+              acceptanceResult
+            );
+            // If we don't have acceptance info for the key yet,
+            // or, we have it and it isn't rejected,
+            // then we accept the key for using it in alias definitions.
+            if (
+              !("fingerprintAcceptance" in acceptanceResult) ||
+              acceptanceResult.fingerprintAcceptance != "rejected"
+            ) {
+              foundError = false;
+            }
+          }
+
+          if (foundError) {
+            keyMissing = true;
+            if (details) {
+              let detEl = {};
+              detEl.addr = addr;
+              detEl.msg = "alias problem";
+              details.errArray.push(detEl);
+            }
+            console.debug(
+              'keyRing.jsm: getValidKeysForAllRecipients(): alias key list for="' +
+                addr +
+                ' refers to missing or unusable key"\n'
+            );
+          }
+        }
+
+        // skip the lookup for direct matching keys by email
+        continue;
+      }
+
       // try email match:
       var addrErrDetails = {};
       let foundKeyId = await this.getValidKeyForRecipient(addr, addrErrDetails);
       if (details && addrErrDetails.msg) {
         errMsg = addrErrDetails.msg;
       }
-      if (foundKeyId) {
-        keyId = "0x" + foundKeyId.toUpperCase();
-        resultingArray.push(keyId);
-        if (details) {
-          details.keyMap[addr.toLowerCase()] = keyId;
-        }
-      } else {
+      if (!foundKeyId) {
         // no key for this address found
         keyMissing = true;
         if (details) {
@@ -1262,9 +1345,9 @@
           details.errArray.push(detailsElem);
         }
         EnigmailLog.DEBUG(
-          'keyRing.jsm: getValidKeysForAllRecipients(): return null (no single valid key found for="' +
+          'keyRing.jsm: getValidKeysForAllRecipients(): no single valid key found for="' +
             addr +
-            '")\n'
+            '"\n'
         );
       }
     }
@@ -1306,35 +1389,59 @@
   },
 
   /**
-   *  Determine the key ID for a set of given addresses
-   *
-   * @param {string[]} addresses - Email addresses to get key id for.
+   * If the given email address has an alias definition, return its
+   * list of key identifiers.
    *
-   * @return {Map<string,keyObj[]>}: map of email addr -> keyObj[]
+   * The function will prefer a match to an exact email alias.
+   * If no email alias could be found, the function will search for
+   * an alias rule that matches the domain.
+   *
+   * @param {string} email - The email address to look up
+   * @return {[]} - An array with alias key identifiers found for the
+   *                input, or null if no alias matches the address.
    */
-  async getMultValidKeysForMultRecipients(addresses) {
-    if (!addresses) {
-      return null;
+  getAliasKeyList(email) {
+    let ekl = OpenPGPAlias.getEmailAliasKeyList(email);
+    if (ekl) {
+      return ekl;
     }
-    let allKeysMap = new Map();
-    for (let i = 0; i < addresses.length; i++) {
-      let addr = addresses[i].toLowerCase();
-      if (!addr) {
-        continue;
-      }
 
-      if (!addr.includes("@")) {
-        throw new Error(
-          "getAllRecipientKeys unexpected lookup for non-email addr: " + addr
-        );
-      }
+    return OpenPGPAlias.getDomainAliasKeyList(email);
+  },
 
-      let found = await this.getMultValidKeysForOneRecipient(addr);
-      if (found) {
-        allKeysMap.set(addr, found);
+  /**
+   * Return the fingerprint of each usable alias key for the given
+   * email address.
+   *
+   * @param {String[]} keyList - Array of key identifiers
+   * @return {String[]} An array with fingerprints of all alias keys,
+   *                    or an empty array on failure.
+   */
+  getAliasKeys(keyList) {
+    let keys = [];
+
+    for (let entry of keyList) {
+      let key;
+      let lookupId;
+      if ("fingerprint" in entry) {
+        lookupId = entry.fingerprint;
+        key = this.getKeyById(entry.fingerprint);
+      } else if ("id" in entry) {
+        lookupId = entry.id;
+        key = this.getKeyById(entry.id);
+      }
+      if (key && this.isValidForEncryption(key)) {
+        keys.push(key.fpr);
+      } else {
+        let reason = key ? "not usable" : "missing";
+        console.debug(
+          "getAliasKeys: key for identifier: " + lookupId + " is " + reason
+        );
+        return [];
       }
     }
-    return allKeysMap;
+
+    return keys;
   },
 
   /**
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/mimeEncrypt.jsm thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/mimeEncrypt.jsm
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/mimeEncrypt.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/mimeEncrypt.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -589,7 +589,9 @@
           "\n"
       );
       if (this.exitCode !== 0) {
-        throw new Error("failure in finishCryptoEncapsulation");
+        throw new Error(
+          "failure in finishCryptoEncapsulation, exitCode: " + this.exitCode
+        );
       }
 
       if (this.mimeStructure == MIME_SIGNED) {
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/OpenPGPAlias.jsm thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/OpenPGPAlias.jsm
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/OpenPGPAlias.jsm	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/OpenPGPAlias.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -0,0 +1,152 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const EXPORTED_SYMBOLS = ["OpenPGPAlias"];
+
+var { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm");
+var { OS } = ChromeUtils.import("resource://gre/modules/osfile.jsm");
+
+Cu.importGlobalProperties(["fetch"]);
+
+var OpenPGPAlias = {
+  _aliasDomains: null,
+  _aliasEmails: null,
+
+  _loaded() {
+    return this._aliasDomains && this._aliasEmails;
+  },
+
+  async load() {
+    let path = Services.prefs.getStringPref(
+      "mail.openpgp.alias_rules_file",
+      ""
+    );
+
+    if (!path) {
+      this._clear();
+      return;
+    }
+
+    await this._loadFromFile(path);
+  },
+
+  _clear() {
+    this._aliasDomains = new Map();
+    this._aliasEmails = new Map();
+  },
+
+  _hasExpectedKeysStructure(keys) {
+    try {
+      for (let entry of keys) {
+        if (!("id" in entry) && !("fingerprint" in entry)) {
+          return false;
+        }
+      }
+      // all entries passed the test
+      return true;
+    } catch (ex) {
+      return false;
+    }
+  },
+
+  async _loadFromFile(src) {
+    this._clear();
+
+    let aliasRules;
+    let jsonData;
+    if (src.startsWith("file://")) {
+      let response = await fetch(src);
+      jsonData = await response.json();
+    } else if (src.includes("/") || src.includes("\\")) {
+      throw new Error(`Invalid alias rules src: ${src}`);
+    } else {
+      let spec = OS.Path.join(OS.Constants.Path.profileDir, src);
+      let response = await fetch(OS.Path.toFileURI(spec));
+      jsonData = await response.json();
+    }
+    if (!("rules" in jsonData)) {
+      throw new Error(
+        "alias file contains invalid JSON data, no rules element found"
+      );
+    }
+    aliasRules = jsonData.rules;
+
+    for (let entry of aliasRules) {
+      if (!("keys" in entry) || !entry.keys || !entry.keys.length) {
+        console.log("Ignoring invalid alias rule without keys");
+        continue;
+      }
+      if ("email" in entry && "domain" in entry) {
+        console.log("Ignoring invalid alias rule with both email and domain");
+        continue;
+      }
+      // Ignore duplicate rules, only use first rule per key.
+      // Require email address contains @, and domain doesn't contain @.
+      if ("email" in entry) {
+        let email = entry.email.toLowerCase();
+        if (!email.includes("@")) {
+          console.log("Ignoring invalid email alias rule: " + email);
+          continue;
+        }
+        if (this._aliasEmails.get(email)) {
+          console.log("Ignoring duplicate email alias rule: " + email);
+          continue;
+        }
+        if (!this._hasExpectedKeysStructure(entry.keys)) {
+          console.log(
+            "Ignoring alias rule with invalid key entries for email " + email
+          );
+          continue;
+        }
+        this._aliasEmails.set(email, entry.keys);
+      } else if ("domain" in entry) {
+        let domain = entry.domain.toLowerCase();
+        if (domain.includes("@")) {
+          console.log("Ignoring invalid domain alias rule: " + domain);
+          continue;
+        }
+        if (this._aliasDomains.get(domain)) {
+          console.log("Ignoring duplicate domain alias rule: " + domain);
+          continue;
+        }
+        if (!this._hasExpectedKeysStructure(entry.keys)) {
+          console.log(
+            "Ignoring alias rule with invalid key entries for domain " + domain
+          );
+          continue;
+        }
+        this._aliasDomains.set(domain, entry.keys);
+      } else {
+        console.log(
+          "Ignoring invalid alias rule without domain and without email"
+        );
+      }
+    }
+  },
+
+  getDomainAliasKeyList(email) {
+    if (!this._loaded()) {
+      return null;
+    }
+
+    let lastAt = email.lastIndexOf("@");
+    if (lastAt == -1) {
+      return null;
+    }
+
+    let domain = email.substr(lastAt + 1);
+    if (!domain) {
+      return null;
+    }
+
+    return this._aliasDomains.get(domain.toLowerCase());
+  },
+
+  getEmailAliasKeyList(email) {
+    if (!this._loaded()) {
+      return null;
+    }
+    return this._aliasEmails.get(email.toLowerCase());
+  },
+};
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/RNP.jsm thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/RNP.jsm
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/RNP.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/RNP.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -329,34 +329,35 @@
           break;
         }
 
-        let have_handle = false;
         let handle = new RNPLib.rnp_key_handle_t();
 
         if (RNPLib.rnp_locate_key(ffi, "grip", grip, handle.address())) {
           throw new Error("rnp_locate_key failed");
         }
-        have_handle = true;
 
         let keyObj = {};
         try {
+          if (RNP.isBadKey(handle)) {
+            continue;
+          }
+
           // Skip if it is a sub key, it will be processed together with primary key later.
-          let ok = this.getKeyInfoFromHandle(
-            ffi,
-            handle,
-            keyObj,
-            false,
-            forListing,
-            onlySecret
-          );
-          if (!ok) {
+          if (
+            !this.getKeyInfoFromHandle(
+              ffi,
+              handle,
+              keyObj,
+              false,
+              forListing,
+              onlySecret
+            )
+          ) {
             continue;
           }
         } catch (ex) {
           console.log(ex);
         } finally {
-          if (have_handle) {
-            RNPLib.rnp_key_handle_destroy(handle);
-          }
+          RNPLib.rnp_key_handle_destroy(handle);
         }
 
         if (keyObj) {
@@ -500,37 +501,47 @@
 
     /* The remaining actions are done for primary keys, only. */
     if (!is_subkey.value) {
-      let primary_uid_set = false;
-
       if (RNPLib.rnp_key_get_uid_count(handle, uid_count.address())) {
         throw new Error("rnp_key_get_uid_count failed");
       }
+      let firstValidUid = null;
       for (let i = 0; i < uid_count.value; i++) {
         let uid_handle = new RNPLib.rnp_uid_handle_t();
-        let is_revoked = new ctypes.bool();
 
         if (RNPLib.rnp_key_get_uid_handle_at(handle, i, uid_handle.address())) {
           throw new Error("rnp_key_get_uid_handle_at failed");
         }
 
-        if (RNPLib.rnp_uid_is_revoked(uid_handle, is_revoked.address())) {
-          throw new Error("rnp_uid_is_revoked failed");
+        // Never allow revoked user IDs
+        let uidOkToUse = !this.isRevokedUid(uid_handle);
+        if (uidOkToUse) {
+          // Usually, we don't allow user IDs reported as not valid
+          uidOkToUse = !this.isBadUid(uid_handle);
+          if (!uidOkToUse && keyObj.keyTrust == "e") {
+            // However, a user might be not valid, because it has
+            // expired. If the primary key has expired, we should show
+            // some user ID, even if all user IDs have expired,
+            // otherwise the user cannot see any text description.
+            // We allow showing user IDs with a good self-signature.
+            uidOkToUse = this.uidHasGoodSignature(keyObj.keyId, uid_handle);
+          }
         }
 
-        if (!is_revoked.value) {
+        if (uidOkToUse) {
           let uid_str = new ctypes.char.ptr();
           if (RNPLib.rnp_key_get_uid_at(handle, i, uid_str.address())) {
             throw new Error("rnp_key_get_uid_at failed");
           }
           let userIdStr = uid_str.readStringReplaceMalformed();
           RNPLib.rnp_buffer_destroy(uid_str);
+
           if (userIdStr !== RNP_PHOTO_USERID_ID) {
-            if (!primary_uid_set) {
+            if (!firstValidUid) {
+              firstValidUid = userIdStr;
+            }
+
+            if (!keyObj.userId && this.isPrimaryUid(uid_handle)) {
               keyObj.userId = userIdStr;
-              if (forListing) {
-                keyObj.name = keyObj.userId;
-              }
-              primary_uid_set = true;
             }
 
             let uidObj = {};
@@ -546,18 +557,17 @@
         RNPLib.rnp_uid_handle_destroy(uid_handle);
       }
 
+      if (!keyObj.userId && firstValidUid) {
+        // No user ID marked as primary, so let's use the first valid.
+        keyObj.userId = firstValidUid;
+      }
+
       if (!keyObj.userId) {
-        let prim_uid_str = new ctypes.char.ptr();
-        if (RNPLib.rnp_key_get_primary_uid(handle, prim_uid_str.address())) {
-          // Seen with some stripped keys from keys.openpgp.org
-          // if an essential key is distributed, but the owner didn't
-          // agree to ship their user id.
-          keyObj.userId = "?";
-          console.debug("rnp_key_get_primary_uid failed");
-        } else {
-          keyObj.userId = prim_uid_str.readStringReplaceMalformed();
-          RNPLib.rnp_buffer_destroy(prim_uid_str);
-        }
+        keyObj.userId = "?";
+      }
+
+      if (forListing) {
+        keyObj.name = keyObj.userId;
       }
 
       if (RNPLib.rnp_key_get_subkey_count(handle, sub_count.address())) {
@@ -569,13 +579,14 @@
           throw new Error("rnp_key_get_subkey_at failed");
         }
 
-        let subKeyObj = {};
-        this.addKeyAttributes(sub_handle, meta, subKeyObj, true, forListing);
-        keyObj.subKeys.push(subKeyObj);
+        if (!RNP.isBadKey(sub_handle)) {
+          let subKeyObj = {};
+          this.addKeyAttributes(sub_handle, meta, subKeyObj, true, forListing);
+          keyObj.subKeys.push(subKeyObj);
+          hasAnySecretKey = hasAnySecretKey || subKeyObj.secretAvailable;
+        }
 
         RNPLib.rnp_key_handle_destroy(sub_handle);
-
-        hasAnySecretKey = hasAnySecretKey || subKeyObj.secretAvailable;
       }
 
       let haveNonExpiringEncryptionKey = false;
@@ -708,6 +719,83 @@
     return true;
   },
 
+  isBadKey(handle) {
+    let validTill = new ctypes.uint32_t();
+    if (RNPLib.rnp_key_valid_till(handle, validTill.address())) {
+      throw new Error("rnp_key_valid_till failed");
+    }
+
+    // A bad key is invalid for any time
+    return !validTill.value;
+  },
+
+  isPrimaryUid(uid_handle) {
+    let is_primary = new ctypes.bool();
+
+    if (RNPLib.rnp_uid_is_primary(uid_handle, is_primary.address())) {
+      throw new Error("rnp_uid_is_primary failed");
+    }
+
+    return is_primary.value;
+  },
+
+  uidHasGoodSignature(self_key_id, uid_handle) {
+    let sig_count = new ctypes.size_t();
+    if (RNPLib.rnp_uid_get_signature_count(uid_handle, sig_count.address())) {
+      throw new Error("rnp_uid_get_signature_count failed");
+    }
+
+    let found_result = false;
+    let is_good = false;
+    for (let i = 0; !found_result && i < sig_count.value; i++) {
+      let sig_handle = new RNPLib.rnp_signature_handle_t();
+
+      if (
+        RNPLib.rnp_uid_get_signature_at(uid_handle, i, sig_handle.address())
+      ) {
+        throw new Error("rnp_uid_get_signature_at failed");
+      }
+
+      let sig_id_str = new ctypes.char.ptr();
+      if (RNPLib.rnp_signature_get_keyid(sig_handle, sig_id_str.address())) {
+        throw new Error("rnp_signature_get_keyid failed");
+      }
+
+      if (sig_id_str.readString() == self_key_id) {
+        found_result = true;
+
+        let sig_validity = RNPLib.rnp_signature_is_valid(sig_handle, 0);
+        is_good =
+          sig_validity == RNPLib.RNP_SUCCESS ||
+          sig_validity == RNPLib.RNP_ERROR_SIGNATURE_EXPIRED;
+      }
+
+      RNPLib.rnp_signature_handle_destroy(sig_handle);
+    }
+
+    return is_good;
+  },
+
+  isBadUid(uid_handle) {
+    let is_valid = new ctypes.bool();
+
+    if (RNPLib.rnp_uid_is_valid(uid_handle, is_valid.address())) {
+      throw new Error("rnp_uid_is_valid failed");
+    }
+
+    return !is_valid.value;
+  },
+
+  isRevokedUid(uid_handle) {
+    let is_revoked = new ctypes.bool();
+
+    if (RNPLib.rnp_uid_is_revoked(uid_handle, is_revoked.address())) {
+      throw new Error("rnp_uid_is_revoked failed");
+    }
+
+    return is_revoked.value;
+  },
+
   getKeySignatures(keyId, ignoreUnknownUid) {
     let handle = this.getKeyHandleByKeyIdOrFingerprint(
       RNPLib.ffi,
@@ -733,17 +821,12 @@
       let outputIndex = 0;
       for (let i = 0; i < uid_count.value; i++) {
         let uid_handle = new RNPLib.rnp_uid_handle_t();
-        let is_revoked = new ctypes.bool();
 
         if (RNPLib.rnp_key_get_uid_handle_at(handle, i, uid_handle.address())) {
           throw new Error("rnp_key_get_uid_handle_at failed");
         }
 
-        if (RNPLib.rnp_uid_is_revoked(uid_handle, is_revoked.address())) {
-          throw new Error("rnp_uid_is_revoked failed");
-        }
-
-        if (!is_revoked.value) {
+        if (!this.isBadUid(uid_handle) && !this.isRevokedUid(uid_handle)) {
           let uid_str = new ctypes.char.ptr();
           if (RNPLib.rnp_key_get_uid_at(handle, i, uid_str.address())) {
             throw new Error("rnp_key_get_uid_at failed");
@@ -826,7 +909,7 @@
                 throw new Error("rnp_signature_get_signer failed");
               }
 
-              if (signerHandle.isNull()) {
+              if (signerHandle.isNull() || this.isBadKey(signerHandle)) {
                 if (!ignoreUnknownUid) {
                   sigObj.userId = "?";
                   sigObj.sigKnown = false;
@@ -840,7 +923,7 @@
                     signer_uid_str.address()
                   )
                 ) {
-                  throw new Error("rnp_key_get_uid_at failed");
+                  throw new Error("rnp_key_get_primary_uid failed");
                 }
                 sigObj.userId = signer_uid_str.readStringReplaceMalformed();
                 RNPLib.rnp_buffer_destroy(signer_uid_str);
@@ -1232,14 +1315,29 @@
       }
     }
 
+    let signer_key = new RNPLib.rnp_key_handle_t();
+    let have_signer_key = false;
+    let use_signer_key = false;
+
     if (query_signer) {
-      let key = new RNPLib.rnp_key_handle_t();
-      if (RNPLib.rnp_op_verify_signature_get_key(sig, key.address())) {
+      if (RNPLib.rnp_op_verify_signature_get_key(sig, signer_key.address())) {
         throw new Error("rnp_op_verify_signature_get_key");
       }
 
+      have_signer_key = true;
+      use_signer_key = !this.isBadKey(signer_key);
+    }
+
+    if (use_signer_key) {
       let keyInfo = {};
-      let ok = this.getKeyInfoFromHandle(ffi, key, keyInfo, true, false, false);
+      let ok = this.getKeyInfoFromHandle(
+        ffi,
+        signer_key,
+        keyInfo,
+        true,
+        false,
+        false
+      );
       if (!ok) {
         throw new Error("getKeyInfoFromHandle failed");
       }
@@ -1331,8 +1429,10 @@
         result.statusFlags &= ~EnigmailConstants.GOOD_SIGNATURE;
         result.statusFlags |= EnigmailConstants.UNCERTAIN_SIGNATURE;
       }
+    }
 
-      RNPLib.rnp_key_handle_destroy(key);
+    if (have_signer_key) {
+      RNPLib.rnp_key_handle_destroy(signer_key);
     }
 
     return true;
@@ -1616,7 +1716,7 @@
     permissive = true
   ) {
     if (!keyBlockStr) {
-      throw new Error("invalid data parameter");
+      throw new Error(`Invalid parameter; keyblock: ${keyBlockStr}`);
     }
 
     if (keyBlockStr.length > RNP.maxImportKeyBlockSize) {
@@ -2096,6 +2196,12 @@
     if (RNPLib.rnp_locate_key(ffi, type, id, key.address())) {
       throw new Error("rnp_locate_key failed, " + type + ", " + id);
     }
+
+    if (!key.isNull() && this.isBadKey(key)) {
+      RNPLib.rnp_key_handle_destroy(key);
+      key = new RNPLib.rnp_key_handle_t();
+    }
+
     return key;
   },
 
@@ -2140,7 +2246,7 @@
       if (RNPLib.rnp_key_get_subkey_at(primary, i, sub_handle.address())) {
         throw new Error("rnp_key_get_subkey_at failed");
       }
-      let skip = this.isKeyExpired(sub_handle);
+      let skip = this.isBadKey(sub_handle) || this.isKeyExpired(sub_handle);
       if (!skip) {
         let key_revoked = new ctypes.bool();
         if (RNPLib.rnp_key_is_revoked(sub_handle, key_revoked.address())) {
@@ -2198,6 +2304,38 @@
     }
   },
 
+  addAliasKeys(aliasKeys, op) {
+    for (let ak of aliasKeys) {
+      let key = this.getKeyHandleByKeyIdOrFingerprint(RNPLib.ffi, "0x" + ak);
+      if (!key || key.isNull()) {
+        console.debug(
+          "addAliasKeys: cannot find key used by alias rule: " + ak
+        );
+        return false;
+      }
+      this.addSuitableEncryptKey(key, op);
+      RNPLib.rnp_key_handle_destroy(key);
+    }
+    return true;
+  },
+
+  async addEncryptionKeyForEmail(email, op) {
+    let key = await this.findKeyByEmail(email, true);
+    if (!key || key.isNull()) {
+      return false;
+    }
+    this.addSuitableEncryptKey(key, op);
+    RNPLib.rnp_key_handle_destroy(key);
+    return true;
+  },
+
+  getEmailWithoutBrackets(email) {
+    if (email.startsWith("<") && email.endsWith(">")) {
+      return email.substring(1, email.length - 1);
+    }
+    return email;
+  },
+
   async encryptAndOrSign(plaintext, args, resultStatus) {
     if (args.sign && args.senderKeyIsExternal) {
       if (!GPGME.allDependenciesLoaded()) {
@@ -2347,26 +2485,41 @@
     }
 
     if (args.encrypt) {
+      // If we have an alias definition, it will be used, and the usual
+      // lookup by email address will be skipped. Earlier code should
+      // have already checked that alias keys are available and usable
+      // for encryption, so we fail if a problem is found.
+
       for (let id in args.to) {
         let toEmail = args.to[id].toLowerCase();
-        let toKey = await this.findKeyByEmail(toEmail, true);
-        if (!toKey || toKey.isNull()) {
+        let aliasKeys = args.aliasKeys.get(
+          this.getEmailWithoutBrackets(toEmail)
+        );
+        if (aliasKeys) {
+          if (!this.addAliasKeys(aliasKeys, op)) {
+            resultStatus.statusFlags |= EnigmailConstants.INVALID_RECIPIENT;
+            return null;
+          }
+        } else if (!(await this.addEncryptionKeyForEmail(toEmail, op))) {
           resultStatus.statusFlags |= EnigmailConstants.INVALID_RECIPIENT;
           return null;
         }
-        this.addSuitableEncryptKey(toKey, op);
-        RNPLib.rnp_key_handle_destroy(toKey);
       }
 
       for (let id in args.bcc) {
         let bccEmail = args.bcc[id].toLowerCase();
-        let bccKey = await this.findKeyByEmail(bccEmail, true);
-        if (bccKey.isNull()) {
+        let aliasKeys = args.aliasKeys.get(
+          this.getEmailWithoutBrackets(bccEmail)
+        );
+        if (aliasKeys) {
+          if (!this.addAliasKeys(aliasKeys, op)) {
+            resultStatus.statusFlags |= EnigmailConstants.INVALID_RECIPIENT;
+            return null;
+          }
+        } else if (!(await this.addEncryptionKeyForEmail(bccEmail, op))) {
           resultStatus.statusFlags |= EnigmailConstants.INVALID_RECIPIENT;
           return null;
         }
-        this.addSuitableEncryptKey(bccKey, op);
-        RNPLib.rnp_key_handle_destroy(bccKey);
       }
 
       if (AppConstants.MOZ_UPDATE_CHANNEL != "release") {
@@ -2485,7 +2638,7 @@
 
   async findKeyByEmail(id, onlyIfAcceptableAsRecipientKey = false) {
     if (!id.startsWith("<") || !id.endsWith(">") || id.includes(" ")) {
-      throw new Error("invalid parameter given to findKeyByEmail");
+      throw new Error(`Invalid argument; id=${id}`);
     }
 
     let emailWithoutBrackets = id.substring(1, id.length - 1);
@@ -2527,7 +2680,9 @@
         if (is_subkey.value) {
           continue;
         }
-
+        if (this.isBadKey(handle)) {
+          continue;
+        }
         let key_revoked = new ctypes.bool();
         if (RNPLib.rnp_key_is_revoked(handle, key_revoked.address())) {
           throw new Error("rnp_key_is_revoked failed");
@@ -2548,7 +2703,6 @@
         let foundUid = false;
         for (let i = 0; i < uid_count.value && !foundUid; i++) {
           let uid_handle = new RNPLib.rnp_uid_handle_t();
-          let is_revoked = new ctypes.bool();
 
           if (
             RNPLib.rnp_key_get_uid_handle_at(handle, i, uid_handle.address())
@@ -2556,11 +2710,7 @@
             throw new Error("rnp_key_get_uid_handle_at failed");
           }
 
-          if (RNPLib.rnp_uid_is_revoked(uid_handle, is_revoked.address())) {
-            throw new Error("rnp_uid_is_revoked failed");
-          }
-
-          if (!is_revoked.value) {
+          if (!this.isBadUid(uid_handle) && !this.isRevokedUid(uid_handle)) {
             let uid_str = new ctypes.char.ptr();
             if (RNPLib.rnp_key_get_uid_at(handle, i, uid_str.address())) {
               throw new Error("rnp_key_get_uid_at failed");
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/RNPLib.jsm thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/RNPLib.jsm
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/RNPLib.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/RNPLib.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -1349,6 +1349,38 @@
       ctypes.uint32_t
     ),
 
+    rnp_key_valid_till: librnp.declare(
+      "rnp_key_valid_till",
+      abi,
+      rnp_result_t,
+      rnp_key_handle_t,
+      ctypes.uint32_t.ptr
+    ),
+
+    rnp_uid_is_valid: librnp.declare(
+      "rnp_uid_is_valid",
+      abi,
+      rnp_result_t,
+      rnp_uid_handle_t,
+      ctypes.bool.ptr
+    ),
+
+    rnp_uid_is_primary: librnp.declare(
+      "rnp_uid_is_primary",
+      abi,
+      rnp_result_t,
+      rnp_uid_handle_t,
+      ctypes.bool.ptr
+    ),
+
+    rnp_signature_is_valid: librnp.declare(
+      "rnp_signature_is_valid",
+      abi,
+      rnp_result_t,
+      rnp_signature_handle_t,
+      ctypes.uint32_t
+    ),
+
     rnp_result_t,
     rnp_ffi_t,
     rnp_password_cb_t,
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/sqliteDb.jsm thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/sqliteDb.jsm
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/modules/sqliteDb.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/modules/sqliteDb.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -57,6 +57,13 @@
   accCacheEmails: null,
 
   async getFingerprintAcceptance(conn, fingerprint, rv) {
+    // 40 is for modern fingerprints, 32 for older fingerprints.
+    if (fingerprint.length != 40 && fingerprint.length != 32) {
+      throw new Error(
+        "internal error, invalid fingerprint value: " + fingerprint
+      );
+    }
+
     fingerprint = fingerprint.toLowerCase();
     if (fingerprint == this.accCacheFingerprint) {
       rv.fingerprintAcceptance = this.accCacheValue;
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/composeKeyStatus.js thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/composeKeyStatus.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/composeKeyStatus.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/composeKeyStatus.js	2021-04-08 08:36:21.000000000 +0000
@@ -15,15 +15,24 @@
 var { EnigmailKey } = ChromeUtils.import(
   "chrome://openpgp/content/modules/key.jsm"
 );
+const { OpenPGPAlias } = ChromeUtils.import(
+  "chrome://openpgp/content/modules/OpenPGPAlias.jsm"
+);
 const { PgpSqliteDb2 } = ChromeUtils.import(
   "chrome://openpgp/content/modules/sqliteDb.jsm"
 );
 
 var gListBox;
 var gViewButton;
+var gLdapBundle;
 
 var gEmailAddresses = [];
 var gRowToEmail = [];
+
+// One boolean entry per row. True means it is an alias row.
+// This allows us to use different dialog behavior for alias entries.
+var gAliasRows = [];
+
 var gMapAddressToKeyObjs = null;
 
 function addRecipients(toAddrList, recList) {
@@ -38,38 +47,54 @@
 }
 
 async function setListEntries() {
-  gMapAddressToKeyObjs = await EnigmailKeyRing.getMultValidKeysForMultRecipients(
-    gEmailAddresses
-  );
-  if (!gMapAddressToKeyObjs) {
-    throw new Error("getMultValidKeysForMultRecipients failed");
-  }
+  gMapAddressToKeyObjs = new Map();
 
   for (let addr of gEmailAddresses) {
-    let emailStatus = null;
-
     addr = addr.toLowerCase();
-    let foundKeys = gMapAddressToKeyObjs.get(addr);
-    if (!foundKeys || !foundKeys.length) {
-      emailStatus = "openpgp-recip-missing";
+
+    let statusStringID = null;
+    let statusStringDirect = "";
+
+    let aliasKeyList = EnigmailKeyRing.getAliasKeyList(addr);
+    let isAlias = !!aliasKeyList;
+
+    if (isAlias) {
+      let aliasKeys = EnigmailKeyRing.getAliasKeys(aliasKeyList);
+      if (!aliasKeys.length) {
+        // failure, at least one alias key is unusable/unavailable
+        statusStringDirect = gLdapBundle.getString("33");
+      } else {
+        // use a better string after 78, bug 1679301
+        statusStringDirect = "a -> b";
+      }
     } else {
-      for (let keyObj of foundKeys) {
-        let goodPersonal = false;
-        if (keyObj.secretAvailable) {
-          goodPersonal = await PgpSqliteDb2.isAcceptedAsPersonalKey(keyObj.fpr);
+      let foundKeys = await EnigmailKeyRing.getMultValidKeysForOneRecipient(
+        addr
+      );
+      if (!foundKeys || !foundKeys.length) {
+        statusStringID = "openpgp-recip-missing";
+      } else {
+        gMapAddressToKeyObjs.set(addr, foundKeys);
+        for (let keyObj of foundKeys) {
+          let goodPersonal = false;
+          if (keyObj.secretAvailable) {
+            goodPersonal = await PgpSqliteDb2.isAcceptedAsPersonalKey(
+              keyObj.fpr
+            );
+          }
+          if (
+            goodPersonal ||
+            keyObj.acceptance == "verified" ||
+            keyObj.acceptance == "unverified"
+          ) {
+            statusStringID = "openpgp-recip-good";
+            break;
+          }
         }
-        if (
-          goodPersonal ||
-          keyObj.acceptance == "verified" ||
-          keyObj.acceptance == "unverified"
-        ) {
-          emailStatus = "openpgp-recip-good";
-          break;
+        if (!statusStringID) {
+          statusStringID = "openpgp-recip-none-accepted";
         }
       }
-      if (!emailStatus) {
-        emailStatus = "openpgp-recip-none-accepted";
-      }
     }
 
     let listitem = document.createXULElement("richlistitem");
@@ -81,7 +106,13 @@
     listitem.appendChild(emailItem);
 
     let status = document.createXULElement("label");
-    document.l10n.setAttributes(status, emailStatus);
+
+    if (statusStringID) {
+      document.l10n.setAttributes(status, statusStringID);
+    } else {
+      status.setAttribute("value", statusStringDirect);
+    }
+
     status.setAttribute("crop", "end");
     status.setAttribute("style", "width: var(--statusWidth)");
     listitem.appendChild(status);
@@ -89,6 +120,7 @@
     gListBox.appendChild(listitem);
 
     gRowToEmail.push(addr);
+    gAliasRows.push(isAlias);
   }
 }
 
@@ -98,9 +130,18 @@
     return;
   }
 
+  try {
+    await OpenPGPAlias.load();
+  } catch (ex) {
+    console.log("failed to load OpenPGP alias file: " + ex);
+  }
+
   gListBox = document.getElementById("infolist");
   gViewButton = document.getElementById("detailsButton");
 
+  // Fix as part of bug 1679301
+  gLdapBundle = document.getElementById("bundle_ldap");
+
   var arrLen = {};
   var recList;
 
@@ -147,7 +188,10 @@
 }
 
 function onSelectionChange(event) {
-  gViewButton.disabled = !gListBox.selectedItems.length;
+  // We don't offer detail management/discovery for email addresses
+  // that match an alias rule.
+  gViewButton.disabled =
+    !gListBox.selectedItems.length || gAliasRows[gListBox.selectedIndex];
 }
 
 function viewSelectedEmail() {
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/composeKeyStatus.xhtml thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/composeKeyStatus.xhtml
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/composeKeyStatus.xhtml	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/composeKeyStatus.xhtml	2021-04-08 08:36:21.000000000 +0000
@@ -29,6 +29,9 @@
   ]]></script>
   <script src="chrome://messenger/content/dialogShadowDom.js"/>
 
+  <!-- TODO: Remove after 78 is done, bug 1679301 -->
+  <stringbundle id="bundle_ldap" src="chrome://mozldap/locale/ldap.properties"/>
+
   <linkset>
     <html:link rel="localization" href="messenger/openpgp/composeKeyStatus.ftl"/>
   </linkset>
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/enigmailMessengerOverlay.js thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/enigmailMessengerOverlay.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/enigmailMessengerOverlay.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/enigmailMessengerOverlay.js	2021-04-08 08:36:21.000000000 +0000
@@ -3293,6 +3293,9 @@
   },
 
   commonProcessAttachedKey(keyData, isBinaryAutocrypt) {
+    if (!keyData) {
+      return;
+    }
     let errorMsgObj = {};
     let preview = EnigmailKey.getKeyListFromKeyBlock(
       keyData,
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/enigmailMsgComposeHelper.js thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/enigmailMsgComposeHelper.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/enigmailMsgComposeHelper.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/enigmailMsgComposeHelper.js	2021-04-08 08:36:21.000000000 +0000
@@ -46,43 +46,15 @@
 }
 
 Enigmail.hlp = {
-  /* try to find valid key to passed email addresses (or keys)
-   * @return: list of all found key (with leading "0x") or null
-   *          details in details parameter
+  /**
+   * Check availability of valid keys for passed email addresses (or keys).
+   * @param {String} emailsOrKeys - comma separated list
+   * @param {Object} details - holds details for invalid keys, see
+   *                           EnigmailKeyRing.getValidKeysForAllRecipients
+   * @return {Boolean} - false on failure
    */
   async validKeysForAllRecipients(emailsOrKeys, details) {
-    EnigmailLog.DEBUG("=====> validKeysForAllRecipients()\n");
-    EnigmailLog.DEBUG(
-      "enigmailMsgComposeHelper.js: validKeysForAllRecipients(): emailsOrKeys='" +
-        emailsOrKeys +
-        "'\n"
-    );
-
-    // use helper to see when we enter and leave this function
-    let resultingArray = await this.doValidKeysForAllRecipients(
-      emailsOrKeys,
-      details
-    );
-
-    EnigmailLog.DEBUG(
-      "enigmailMsgComposeHelper.js: validKeysForAllRecipients(): return '" +
-        resultingArray +
-        "'\n"
-    );
-    EnigmailLog.DEBUG("  <=== validKeysForAllRecipients()\n");
-    return resultingArray;
-  },
-
-  // helper for validKeysForAllRecipients()
-  async doValidKeysForAllRecipients(emailsOrKeys, details) {
-    EnigmailLog.DEBUG(
-      "enigmailMsgComposeHelper.js: doValidKeysForAllRecipients(): emailsOrKeys='" +
-        emailsOrKeys +
-        "'\n"
-    );
-
-    let keyMissing;
-    let resultingArray = []; // resulting key list (if all valid)
+    let keyMissing = true;
     try {
       // create array of address elements (email or key)
       let addresses = [];
@@ -93,30 +65,22 @@
       // resolve all the email addresses if possible:
       keyMissing = await EnigmailKeyRing.getValidKeysForAllRecipients(
         addresses,
-        details,
-        resultingArray
+        details
       );
     } catch (ex) {
       EnigmailLog.DEBUG(
-        "enigmailMsgComposeHelper.js: doValidKeysForAllRecipients(): return null (exception: " +
+        "enigmailMsgComposeHelper.js: validKeysForAllRecipients(): return null (exception: " +
           ex.message +
           "\n" +
           ex.stack +
           ")\n"
       );
-      return null;
     }
     if (keyMissing) {
       EnigmailLog.DEBUG(
-        "enigmailMsgComposeHelper.js: doValidKeysForAllRecipients(): return null (key missing)\n"
+        "enigmailMsgComposeHelper.js: validKeysForAllRecipients(): return null (key missing)\n"
       );
-      return null;
     }
-    EnigmailLog.DEBUG(
-      'enigmailMsgComposeHelper.js: doValidKeysForAllRecipients(): return "' +
-        resultingArray +
-        '"\n'
-    );
-    return resultingArray;
+    return !keyMissing;
   },
 };
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/enigmailMsgComposeOverlay.js thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/enigmailMsgComposeOverlay.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/enigmailMsgComposeOverlay.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/enigmailMsgComposeOverlay.js	2021-04-08 08:36:21.000000000 +0000
@@ -99,6 +99,9 @@
 const { EnigmailCryptoAPI } = ChromeUtils.import(
   "chrome://openpgp/content/modules/cryptoAPI.jsm"
 );
+const { OpenPGPAlias } = ChromeUtils.import(
+  "chrome://openpgp/content/modules/OpenPGPAlias.jsm"
+);
 var { jsmime } = ChromeUtils.import("resource:///modules/jsmime.jsm");
 
 var l10n = new Localization(["messenger/openpgp/openpgp.ftl"], true);
@@ -1243,6 +1246,12 @@
     // gMsgCompose.expandMailingLists();
 
     if (Enigmail.msg.isEnigmailEnabledForIdentity()) {
+      try {
+        await OpenPGPAlias.load();
+      } catch (ex) {
+        console.log("failed to load OpenPGP alias file: " + ex);
+      }
+
       var toAddrList = [];
       var arrLen = {};
       var recList;
@@ -2614,7 +2623,6 @@
 
       try {
         this.modifyCompFields();
-        //bc.setAttribute("disabled", "true");
 
         const cApi = EnigmailCryptoAPI();
         let encryptResult = cApi.sync(this.prepareSendMsg(sendMsgType));
@@ -2624,9 +2632,11 @@
           event.stopPropagation();
         }
       } catch (ex) {
-        console.debug(ex);
+        Cu.reportError("GenericSendMessage FAILED: " + ex);
+        this.resetUpdatedFields();
+        event.preventDefault();
+        event.stopPropagation();
       }
-      //bc.removeAttribute("disabled");
     } else {
       EnigmailLog.DEBUG(
         "enigmailMsgComposeOverlay.js: Enigmail.msg.sendMessageListener: sending in progress - autosave aborted\n"
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/enigmailMsgHdrViewOverlay.js thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/enigmailMsgHdrViewOverlay.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/enigmailMsgHdrViewOverlay.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/enigmailMsgHdrViewOverlay.js	2021-04-08 08:36:21.000000000 +0000
@@ -594,7 +594,7 @@
     }
     if (signedUINode.getAttribute("signed")) {
       window.dispatchEvent(
-        new CustomEvent("display-secure-msg", {
+        new CustomEvent("secureMsgLoaded", {
           detail: {
             key: "signed-openpgp",
             data: signedUINode.getAttribute("signed"),
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/oneRecipientStatus.js thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/oneRecipientStatus.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/content/ui/oneRecipientStatus.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/content/ui/oneRecipientStatus.js	2021-04-08 08:36:21.000000000 +0000
@@ -54,7 +54,7 @@
     } else {
       if (!("acceptance" in keyObj)) {
         throw new Error(
-          "expected getMultValidKeysForMultRecipients to set acceptance"
+          "expected getMultValidKeysForOneRecipient to set acceptance"
         );
       }
       switch (keyObj.acceptance) {
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/test/unit/rnp/test_alias.js thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/test/unit/rnp/test_alias.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/test/unit/rnp/test_alias.js	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/test/unit/rnp/test_alias.js	2021-04-08 08:36:21.000000000 +0000
@@ -0,0 +1,324 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Tests for OpenPGP encryption alias rules.
+ */
+
+"use strict";
+
+const { OS } = ChromeUtils.import("resource://gre/modules/osfile.jsm");
+const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm");
+const { RNP } = ChromeUtils.import("chrome://openpgp/content/modules/RNP.jsm");
+const { EnigmailConstants } = ChromeUtils.import(
+  "chrome://openpgp/content/modules/constants.jsm"
+);
+const { EnigmailKeyRing } = ChromeUtils.import(
+  "chrome://openpgp/content/modules/keyRing.jsm"
+);
+const { EnigmailEncryption } = ChromeUtils.import(
+  "chrome://openpgp/content/modules/encryption.jsm"
+);
+const { OpenPGPAlias } = ChromeUtils.import(
+  "chrome://openpgp/content/modules/OpenPGPAlias.jsm"
+);
+
+const { OpenPGPTestUtils } = ChromeUtils.import(
+  "resource://testing-common/mozmill/OpenPGPTestUtils.jsm"
+);
+
+const keyDir = "../../../../../test/browser/openpgp/data/keys";
+const mailNewsDir = "../../../../../../mailnews/test/data";
+
+// Alice's key: EB85BB5FA33A75E15E944E63F231550C4F47E38E
+// Bob's key:   D1A66E1A23B182C9980F788CFBFCC82A015E7330
+// Carol's key: B8F2F6F4BD3AD3F82DC446833099FF1238852B9F
+
+const tests = [
+  {
+    info: "Should find Alice's key directly",
+    filename: undefined,
+    to: "alice@openpgp.example",
+    expectedMissing: false,
+    expectedAliasKeys: null,
+  },
+  {
+    info: "Key absent, no alias defined for address",
+    filename: `${mailNewsDir}/alias-1.json`,
+    to: "nobody@openpgp.example",
+    expectedMissing: true,
+    expectedAliasKeys: null,
+  },
+  {
+    info:
+      "File maps Alice's address to Bob's (id) and Carol's (fingerprint) keys",
+    filename: `${mailNewsDir}/alias-1.json`,
+    to: "alice@openpgp.example",
+    expectedMissing: false,
+    expectedAliasKeys: [
+      "D1A66E1A23B182C9980F788CFBFCC82A015E7330",
+      "B8F2F6F4BD3AD3F82DC446833099FF1238852B9F",
+    ],
+  },
+  {
+    info: "File maps Alice's address to an absent key",
+    filename: `${mailNewsDir}/alias-2.json`,
+    to: "alice@openpgp.example",
+    expectedMissing: true,
+    expectedAliasKeys: null,
+  },
+  {
+    info: "File maps Alice's address to Alice's key (unnecessary alias)",
+    filename: `${mailNewsDir}/alias-3.json`,
+    to: "alice@openpgp.example",
+    expectedMissing: false,
+    expectedAliasKeys: ["EB85BB5FA33A75E15E944E63F231550C4F47E38E"],
+  },
+  {
+    info: "File maps an address to several keys, all available",
+    filename: `${mailNewsDir}/alias-4.json`,
+    to: "nobody@example.com",
+    expectedMissing: false,
+    expectedAliasKeys: [
+      "EB85BB5FA33A75E15E944E63F231550C4F47E38E",
+      "D1A66E1A23B182C9980F788CFBFCC82A015E7330",
+      "B8F2F6F4BD3AD3F82DC446833099FF1238852B9F",
+    ],
+  },
+  {
+    info: "File maps an address to several keys, one not available",
+    filename: `${mailNewsDir}/alias-5.json`,
+    to: "nobody@example.com",
+    expectedMissing: true,
+    expectedAliasKeys: null,
+  },
+  {
+    info: "File maps the domain to Carol's key",
+    filename: `${mailNewsDir}/alias-6.json`,
+    to: "someone@example.com",
+    expectedMissing: false,
+    expectedAliasKeys: ["B8F2F6F4BD3AD3F82DC446833099FF1238852B9F"],
+  },
+  {
+    info: "Multiple rules, should match domain1 rule",
+    filename: `${mailNewsDir}/alias-7.json`,
+    to: "someone@domain1.example.com",
+    expectedMissing: false,
+    expectedAliasKeys: ["EB85BB5FA33A75E15E944E63F231550C4F47E38E"],
+  },
+  {
+    info: "Multiple rules, should match domain2 rule",
+    filename: `${mailNewsDir}/alias-7.json`,
+    to: "contact@domain2.example.com",
+    expectedMissing: false,
+    expectedAliasKeys: ["D1A66E1A23B182C9980F788CFBFCC82A015E7330"],
+  },
+  {
+    info: "Multiple rules, should match email contact@domain1 rule",
+    filename: `${mailNewsDir}/alias-7.json`,
+    to: "contact@domain1.example.com",
+    expectedMissing: false,
+    expectedAliasKeys: [
+      "D1A66E1A23B182C9980F788CFBFCC82A015E7330",
+      "EB85BB5FA33A75E15E944E63F231550C4F47E38E",
+    ],
+  },
+  {
+    info: "Multiple rules, shouldn't match",
+    filename: `${mailNewsDir}/alias-7.json`,
+    to: "contact@domain2.example",
+    expectedMissing: true,
+    expectedAliasKeys: null,
+  },
+  {
+    info: "Mixed case test a",
+    filename: `${mailNewsDir}/alias-8.json`,
+    to: "a@UPPERDOM.EXAMPLE",
+    expectedMissing: false,
+    expectedAliasKeys: ["EB85BB5FA33A75E15E944E63F231550C4F47E38E"],
+  },
+  {
+    info: "Mixed case test b",
+    filename: `${mailNewsDir}/alias-8.json`,
+    to: "b@lowerdom.example",
+    expectedMissing: false,
+    expectedAliasKeys: ["D1A66E1A23B182C9980F788CFBFCC82A015E7330"],
+  },
+  {
+    info: "Mixed case test c",
+    filename: `${mailNewsDir}/alias-8.json`,
+    to: "C@MIXed.EXample",
+    expectedMissing: false,
+    expectedAliasKeys: ["B8F2F6F4BD3AD3F82DC446833099FF1238852B9F"],
+  },
+  {
+    info: "Mixed case test d",
+    filename: `${mailNewsDir}/alias-13.json`,
+    to: "NAME@DOMAIN.NET",
+    expectedMissing: false,
+    expectedAliasKeys: ["D1A66E1A23B182C9980F788CFBFCC82A015E7330"],
+  },
+  {
+    info: "Mixed case test e",
+    filename: `${mailNewsDir}/alias-14.json`,
+    to: "name@domain.net",
+    expectedMissing: false,
+    expectedAliasKeys: ["D1A66E1A23B182C9980F788CFBFCC82A015E7330"],
+  },
+  {
+    info: "Mixed case test f",
+    filename: `${mailNewsDir}/alias-15.json`,
+    to: "name@domain.net",
+    expectedMissing: false,
+    expectedAliasKeys: ["D1A66E1A23B182C9980F788CFBFCC82A015E7330"],
+  },
+  {
+    info: "JSON with bad syntax, should find Alice's key directly",
+    filename: `${mailNewsDir}/alias-9.json`,
+    to: "alice@openpgp.example",
+    expectedMissing: false,
+    expectedAliasKeys: null,
+    expectException: true,
+  },
+  {
+    info: "JSON with missing keys entry, should find Alice's key directly",
+    filename: `${mailNewsDir}/alias-10.json`,
+    to: "alice@openpgp.example",
+    expectedMissing: false,
+    expectedAliasKeys: null,
+  },
+  {
+    info: "JSON with empty keys entry, should find Alice's key directly",
+    filename: `${mailNewsDir}/alias-11.json`,
+    to: "alice@openpgp.example",
+    expectedMissing: false,
+    expectedAliasKeys: null,
+  },
+  {
+    info: "JSON with bad type keys entry, should find Alice's key directly",
+    filename: `${mailNewsDir}/alias-12.json`,
+    to: "alice@openpgp.example",
+    expectedMissing: false,
+    expectedAliasKeys: null,
+  },
+];
+
+/**
+ * Initialize OpenPGP add testing keys.
+ */
+add_task(async function setUp() {
+  do_get_profile();
+
+  await OpenPGPTestUtils.initOpenPGP();
+
+  await OpenPGPTestUtils.importPublicKey(
+    null,
+    do_get_file(`${keyDir}/alice@openpgp.example-0xf231550c4f47e38e-pub.asc`)
+  );
+
+  await OpenPGPTestUtils.importPublicKey(
+    null,
+    do_get_file(`${keyDir}/bob@openpgp.example-0xfbfcc82a015e7330-pub.asc`)
+  );
+
+  await OpenPGPTestUtils.importPublicKey(
+    null,
+    do_get_file(`${keyDir}/carol@example.com-0x3099ff1238852b9f-pub.asc`)
+  );
+});
+
+add_task(async function testAlias() {
+  let aliasFilename = "openpgp-alias-rules.json";
+  let profileDir = Services.dirsvc.get("ProfD", Ci.nsIFile);
+
+  for (let test of tests) {
+    if (test.filename) {
+      info(`Running alias test with rules from: ${test.filename}`);
+
+      // Copy test file to profile directory (which is a relative path),
+      // because load function only works with simple filenames
+      // or absolute file URLs.
+
+      let inFile = do_get_file(test.filename);
+      inFile.copyTo(profileDir, aliasFilename);
+
+      try {
+        await OpenPGPAlias._loadFromFile(aliasFilename);
+        Assert.ok(
+          !("expectException" in test) || !test.expectException,
+          "expected no load exception"
+        );
+      } catch (ex) {
+        console.log(
+          "exception when loading alias file " + aliasFilename + " : " + ex
+        );
+        Assert.ok(
+          "expectException" in test && test.expectException,
+          "expected load exception"
+        );
+      }
+    } else {
+      info(`Running alias test without rules`);
+      OpenPGPAlias._clear();
+    }
+    info(test.info);
+
+    let addresses = [test.to];
+    let resultDetails = {};
+
+    let isMissing = await EnigmailKeyRing.getValidKeysForAllRecipients(
+      addresses,
+      resultDetails
+    );
+
+    Assert.ok(
+      (isMissing && test.expectedMissing) ||
+        (!isMissing && !test.expectedMissing),
+      "Should have the expected result from getValidKeysForAllRecipients"
+    );
+
+    if (isMissing || test.expectedMissing) {
+      continue;
+    }
+
+    let errorMsgObj = { value: "" };
+    let logFileObj = {};
+    let encryptArgs = EnigmailEncryption.getCryptParams(
+      "",
+      test.to,
+      "",
+      "SHA256",
+      EnigmailConstants.SEND_ENCRYPTED,
+      0,
+      errorMsgObj,
+      logFileObj
+    );
+
+    let foundAliasKeys = encryptArgs.aliasKeys.get(test.to.toLowerCase());
+
+    if (!test.expectedAliasKeys) {
+      Assert.ok(!foundAliasKeys, "foundAliasKeys should be empty");
+    } else {
+      Assert.equal(foundAliasKeys.length, test.expectedAliasKeys.length);
+
+      test.expectedAliasKeys.forEach((val, i) => {
+        Assert.ok(foundAliasKeys.includes(val));
+      });
+
+      let encryptResult = {};
+      let encrypted = await RNP.encryptAndOrSign(
+        "plaintext",
+        encryptArgs,
+        encryptResult
+      );
+
+      Assert.ok(
+        !encryptResult.exitCode,
+        "RNP.encryptAndOrSign() should exit ok"
+      );
+
+      Assert.ok(encrypted.includes("END PGP MESSAGE"));
+    }
+  }
+});
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/test/unit/rnp/test_encryptAndOrSign.js thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/test/unit/rnp/test_encryptAndOrSign.js
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/test/unit/rnp/test_encryptAndOrSign.js	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/test/unit/rnp/test_encryptAndOrSign.js	2021-04-08 08:36:21.000000000 +0000
@@ -200,6 +200,7 @@
     let encryptResult = {};
 
     let encryptArgs = {
+      aliasKeys: new Map(),
       armor: true,
       bcc: [],
       encrypt: true,
diff -Nru thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/test/unit/rnp/xpcshell.ini thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/test/unit/rnp/xpcshell.ini
--- thunderbird-78.9.0+build2/comm/mail/extensions/openpgp/test/unit/rnp/xpcshell.ini	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/extensions/openpgp/test/unit/rnp/xpcshell.ini	2021-04-08 08:36:21.000000000 +0000
@@ -8,3 +8,4 @@
 
 [test_encryptAndOrSign.js]
 [test_secretKeys.js]
+[test_alias.js]
diff -Nru thunderbird-78.9.0+build2/comm/mail/test/browser/shared-modules/OpenPGPTestUtils.jsm thunderbird-78.9.1+build1/comm/mail/test/browser/shared-modules/OpenPGPTestUtils.jsm
--- thunderbird-78.9.0+build2/comm/mail/test/browser/shared-modules/OpenPGPTestUtils.jsm	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/test/browser/shared-modules/OpenPGPTestUtils.jsm	2021-04-08 08:36:21.000000000 +0000
@@ -12,6 +12,9 @@
 const { EnigmailKeyRing } = ChromeUtils.import(
   "chrome://openpgp/content/modules/keyRing.jsm"
 );
+const { OpenPGPAlias } = ChromeUtils.import(
+  "chrome://openpgp/content/modules/OpenPGPAlias.jsm"
+);
 const { EnigmailFiles } = ChromeUtils.import(
   "chrome://openpgp/content/modules/files.jsm"
 );
@@ -46,6 +49,7 @@
   async initOpenPGP() {
     Assert.ok(await RNP.init(), "librnp did load");
     Assert.ok(await getEnigmailCore().getService({}), "EnigmailCore did load");
+    await OpenPGPAlias.load();
   },
 
   /**
diff -Nru thunderbird-78.9.0+build2/comm/mail/themes/linux/mail/compose/messengercompose.css thunderbird-78.9.1+build1/comm/mail/themes/linux/mail/compose/messengercompose.css
--- thunderbird-78.9.0+build2/comm/mail/themes/linux/mail/compose/messengercompose.css	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/themes/linux/mail/compose/messengercompose.css	2021-04-08 08:36:21.000000000 +0000
@@ -336,7 +336,7 @@
 }
 
 #languageStatusButton {
-  height: 22px;
+  min-height: 22px;
 }
 
 /* Styles for the default system dark theme */
diff -Nru thunderbird-78.9.0+build2/comm/mail/themes/linux/mail/messenger.css thunderbird-78.9.1+build1/comm/mail/themes/linux/mail/messenger.css
--- thunderbird-78.9.0+build2/comm/mail/themes/linux/mail/messenger.css	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/themes/linux/mail/messenger.css	2021-04-08 08:36:22.000000000 +0000
@@ -108,6 +108,7 @@
 :root[lwt-tree-brighttext] .otr-container,
 :root[lwt-tree-brighttext] .crypto-button,
 :root[lwt-tree-brighttext] .calendar-list-create,
+:root[lwt-tree-brighttext] #quick-filter-bar > hbox,
 :root[lwt-tree-brighttext] #searchTerms {
   --toolbarbutton-hover-background: var(--lwt-toolbarbutton-hover-background, rgba(255, 255, 255, .25));
   --toolbarbutton-hover-bordercolor: var(--lwt-toolbarbutton-hover-background, rgba(255, 255, 255, .5));
diff -Nru thunderbird-78.9.0+build2/comm/mail/themes/shared/mail/accountManage.css thunderbird-78.9.1+build1/comm/mail/themes/shared/mail/accountManage.css
--- thunderbird-78.9.0+build2/comm/mail/themes/shared/mail/accountManage.css	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/themes/shared/mail/accountManage.css	2021-04-08 08:36:22.000000000 +0000
@@ -250,6 +250,10 @@
   margin-inline-end: 12px;
 }
 
+#whiteListAbURI richlistitem {
+  padding-inline-start: 10px;
+}
+
 #whiteListAbURI checkbox {
   -moz-user-focus: none;
 }
@@ -257,7 +261,9 @@
 /* ::::: SMTP Server Panel :::::: */
 
 .smtpServerListItem {
-  padding-inline-start: 3px;
+  -moz-box-align: center;
+  padding-inline-start: 10px;
+  height: 34px;
 }
 
 #smtpServerInfoBox {
diff -Nru thunderbird-78.9.0+build2/comm/mail/themes/shared/mail/messageHeader.css thunderbird-78.9.1+build1/comm/mail/themes/shared/mail/messageHeader.css
--- thunderbird-78.9.0+build2/comm/mail/themes/shared/mail/messageHeader.css	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/themes/shared/mail/messageHeader.css	2021-04-08 08:36:21.000000000 +0000
@@ -591,6 +591,14 @@
   font-size: 0.9em;
 }
 
+#signatureKeyId,
+#encryptionKeyId,
+.openpgp-key-id,
+.openpgp-key-name {
+  user-select: text;
+  cursor: text;
+}
+
 #openpgpImportButton {
   list-style-image: url("chrome://messenger/skin/icons/encryption-key.svg");
   -moz-context-properties: fill;
diff -Nru thunderbird-78.9.0+build2/comm/mail/themes/shared/mail/preferences/preferences.css thunderbird-78.9.1+build1/comm/mail/themes/shared/mail/preferences/preferences.css
--- thunderbird-78.9.0+build2/comm/mail/themes/shared/mail/preferences/preferences.css	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/themes/shared/mail/preferences/preferences.css	2021-04-08 08:36:22.000000000 +0000
@@ -516,15 +516,18 @@
   background-image: none;
 }
 
+#containerBox richlistbox richlistitem:hover,
 #preferencesContainer richlistbox richlistitem:hover {
   background-color: var(--in-content-item-hover);
 }
 
+#containerBox richlistitem[selected="true"],
 #preferencesContainer richlistitem[selected="true"] {
   background-color: var(--in-content-item-selected-unfocused);
   color: inherit;
 }
 
+#containerBox richlistbox:focus > richlistitem[selected="true"],
 #preferencesContainer richlistbox:focus > richlistitem[selected="true"] {
   background-color: var(--in-content-item-selected);
   color: var(--in-content-selected-text) !important;
diff -Nru thunderbird-78.9.0+build2/comm/mail/themes/windows/mail/compose/messengercompose.css thunderbird-78.9.1+build1/comm/mail/themes/windows/mail/compose/messengercompose.css
--- thunderbird-78.9.0+build2/comm/mail/themes/windows/mail/compose/messengercompose.css	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mail/themes/windows/mail/compose/messengercompose.css	2021-04-08 08:36:22.000000000 +0000
@@ -404,7 +404,7 @@
 }
 
 #languageStatusButton {
-  height: 22px;
+  min-height: 22px;
 }
 
 /* ::::: address book sidebar ::::: */
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/base/prefs/content/am-junk.xhtml thunderbird-78.9.1+build1/comm/mailnews/base/prefs/content/am-junk.xhtml
--- thunderbird-78.9.0+build2/comm/mailnews/base/prefs/content/am-junk.xhtml	2021-03-29 16:02:07.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/base/prefs/content/am-junk.xhtml	2021-04-08 08:36:22.000000000 +0000
@@ -121,7 +121,7 @@
 
       <separator class="thin"/>
 
-      <description width="1">&ispHeadersWarning.label;</description>
+      <description class="indent tip-caption" width="1">&ispHeadersWarning.label;</description>
 
     </html:fieldset>
     </html:div>
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/extensions/smime/msgReadSMIMEOverlay.js thunderbird-78.9.1+build1/comm/mailnews/extensions/smime/msgReadSMIMEOverlay.js
--- thunderbird-78.9.0+build2/comm/mailnews/extensions/smime/msgReadSMIMEOverlay.js	2021-03-29 16:02:08.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/extensions/smime/msgReadSMIMEOverlay.js	2021-04-08 08:36:22.000000000 +0000
@@ -534,11 +534,13 @@
     // Use textContent for label XUl elements to enable text wrapping.
     let name = document.createXULElement("label");
     name.classList.add("openpgp-key-name");
+    name.setAttribute("context", "copyPopup");
     name.textContent = keyInfo
       ? keyInfo.userId
       : myl10n.formatValueSync("openpgp-unknown-key-id");
 
     let id = document.createXULElement("label");
+    id.setAttribute("context", "copyPopup");
     id.classList.add("openpgp-key-id");
     id.textContent = havePrimaryId2
       ? ` 0x${key.primaryKeyId} (0x${key.keyId})`
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-10.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-10.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-10.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-10.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,8 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "alice@openpgp.example"
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-11.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-11.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-11.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-11.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,9 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "alice@openpgp.example",
+      "keys": []
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-12.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-12.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-12.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-12.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,9 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "alice@openpgp.example",
+      "keys": "bad type, not an array"
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-13.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-13.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-13.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-13.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,11 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email":  "name@domain.net",
+      "keys": [
+        { "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-14.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-14.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-14.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-14.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,11 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "NAME@DOMAIN.NET",
+      "keys": [
+        { "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-15.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-15.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-15.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-15.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,11 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "NAME@domain.net",
+      "keys": [
+        { "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-1.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-1.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-1.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-1.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,12 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "alice@openpgp.example",
+      "keys": [
+        { "id": "FBFCC82A015E7330" },
+        { "fingerprint": "B8F2F6F4BD3AD3F82DC446833099FF1238852B9F" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-2.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-2.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-2.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-2.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,11 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "alice@openpgp.example",
+      "keys": [
+        { "fingerprint": "0123456789012345678901234567890123456789" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-3.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-3.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-3.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-3.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,11 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "alice@openpgp.example",
+      "keys": [
+        { "fingerprint": "EB85BB5FA33A75E15E944E63F231550C4F47E38E" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-4.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-4.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-4.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-4.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,13 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "nobody@example.com",
+      "keys": [
+        { "fingerprint": "EB85BB5FA33A75E15E944E63F231550C4F47E38E" },
+        { "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330" },
+        { "fingerprint": "B8F2F6F4BD3AD3F82DC446833099FF1238852B9F" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-5.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-5.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-5.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-5.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,14 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "nobody@example.com",
+      "keys": [
+        { "fingerprint": "EB85BB5FA33A75E15E944E63F231550C4F47E38E" },
+        { "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330" },
+        { "fingerprint": "B8F2F6F4BD3AD3F82DC446833099FF1238852B9F" },
+        { "fingerprint": "0123456789012345678901234567890123456789" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-6.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-6.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-6.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-6.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,11 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "domain": "example.com",
+      "keys": [
+        { "fingerprint": "B8F2F6F4BD3AD3F82DC446833099FF1238852B9F" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-7.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-7.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-7.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-7.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,24 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "domain": "domain1.example.com",
+      "keys": [
+        { "fingerprint": "EB85BB5FA33A75E15E944E63F231550C4F47E38E" }
+      ]
+    },
+    {
+      "domain": "domain2.example.com",
+      "keys": [
+        { "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330" }
+      ]
+    },
+    {
+      "email": "contact@domain1.example.com",
+      "keys": [
+        { "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330" },
+        { "id": "F231550C4F47E38E" }
+      ]
+    }
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-8.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-8.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-8.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-8.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,26 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+      "email": "c@mixED.exAMPLE",
+      "keys": [
+        { "fingerprint": "B8F2F6F4BD3AD3F82DC446833099FF1238852B9F" }
+      ]
+    },
+
+    {
+      "domain": "upperdom.example",
+      "keys": [
+        { "fingerprint": "EB85BB5FA33A75E15E944E63F231550C4F47E38E" }
+      ]
+    },
+
+    {
+      "domain": "LOWERDOM.EXAMPLE",
+      "keys": [
+        { "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330" }
+      ]
+    }
+
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-9.json thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-9.json
--- thunderbird-78.9.0+build2/comm/mailnews/test/data/alias-9.json	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/mailnews/test/data/alias-9.json	2021-04-08 08:36:22.000000000 +0000
@@ -0,0 +1,7 @@
+{
+  "description": "OpenPGP alias rules",
+  "rules": [
+    {
+    },
+  ]
+}
diff -Nru thunderbird-78.9.0+build2/comm/SOURCE_CHANGESET thunderbird-78.9.1+build1/comm/SOURCE_CHANGESET
--- thunderbird-78.9.0+build2/comm/SOURCE_CHANGESET	2021-03-29 16:02:10.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/SOURCE_CHANGESET	2021-04-08 08:36:25.000000000 +0000
@@ -1 +1 @@
-1a5cd2aa11de609116f258b413afcf113ed72f3a
\ No newline at end of file
+f3f1f4a0e32abbc74dfac8c697044c10d0d25cad
\ No newline at end of file
diff -Nru thunderbird-78.9.0+build2/comm/third_party/rnp/rnp.symbols thunderbird-78.9.1+build1/comm/third_party/rnp/rnp.symbols
--- thunderbird-78.9.0+build2/comm/third_party/rnp/rnp.symbols	2021-03-29 16:02:08.000000000 +0000
+++ thunderbird-78.9.1+build1/comm/third_party/rnp/rnp.symbols	2021-04-08 08:36:24.000000000 +0000
@@ -60,6 +60,7 @@
 rnp_key_get_protection_mode
 rnp_key_get_protection_type
 rnp_key_get_revocation_reason
+rnp_key_get_revocation_signature
 rnp_key_get_signature_at
 rnp_key_get_signature_count
 rnp_key_get_subkey_at
@@ -78,6 +79,7 @@
 rnp_key_is_revoked
 rnp_key_is_sub
 rnp_key_is_superseded
+rnp_key_is_valid
 rnp_key_lock
 rnp_key_packets_to_json
 rnp_key_protect
@@ -87,6 +89,7 @@
 rnp_key_to_json
 rnp_key_unlock
 rnp_key_unprotect
+rnp_key_valid_till
 rnp_load_keys
 rnp_locate_key
 rnp_op_encrypt_add_password
@@ -188,7 +191,9 @@
 rnp_signature_get_hash_alg
 rnp_signature_get_keyid
 rnp_signature_get_signer
+rnp_signature_get_type
 rnp_signature_handle_destroy
+rnp_signature_is_valid
 rnp_signature_packet_to_json
 rnp_supported_features
 rnp_supports_feature
@@ -197,10 +202,15 @@
 rnp_symenc_get_hash_alg
 rnp_symenc_get_s2k_iterations
 rnp_symenc_get_s2k_type
+rnp_uid_get_data
+rnp_uid_get_revocation_signature
 rnp_uid_get_signature_at
 rnp_uid_get_signature_count
+rnp_uid_get_type
 rnp_uid_handle_destroy
+rnp_uid_is_primary
 rnp_uid_is_revoked
+rnp_uid_is_valid
 rnp_unload_keys
 rnp_version
 rnp_version_commit_timestamp
diff -Nru thunderbird-78.9.0+build2/debian/build/rules.mk thunderbird-78.9.1+build1/debian/build/rules.mk
--- thunderbird-78.9.0+build2/debian/build/rules.mk	2020-10-28 15:03:42.000000000 +0000
+++ thunderbird-78.9.1+build1/debian/build/rules.mk	2021-04-02 06:33:22.000000000 +0000
@@ -121,7 +121,7 @@
 MOZ_BUILD_PGO = 0
 endif
 
-LLVM_VERSIONS = 11 10 8
+LLVM_VERSIONS = 12 11 10 8
 DEB_LLVM_VERSION = $(firstword $(foreach llvm_version, $(LLVM_VERSIONS), \
 	$(if $(shell which clang-$(llvm_version)), $(llvm_version))))
 
diff -Nru thunderbird-78.9.0+build2/debian/changelog thunderbird-78.9.1+build1/debian/changelog
--- thunderbird-78.9.0+build2/debian/changelog	2021-03-29 15:45:57.000000000 +0000
+++ thunderbird-78.9.1+build1/debian/changelog	2021-04-08 16:25:10.000000000 +0000
@@ -1,3 +1,26 @@
+thunderbird (1:78.9.1+build1-0ubuntu0.21.04.1~mt1) hirsute; urgency=medium
+
+  * New upstream stable release (78.9.1build1)
+
+ -- Rico Tzschichholz <ricotz@ubuntu.com>  Thu, 08 Apr 2021 18:25:10 +0200
+
+thunderbird (1:78.9.0+build2-0ubuntu3) hirsute; urgency=medium
+
+  * Cherry-pick an upstream commit to fix a build failure with clang 12
+    - debian/patches/upstream-d241931.patch
+
+ -- Olivier Tilloy <olivier.tilloy@canonical.com>  Wed, 07 Apr 2021 21:26:05 +0200
+
+thunderbird (1:78.9.0+build2-0ubuntu2) hirsute; urgency=medium
+
+  * Build with clang 12 where available (currently only hirsute)
+    - debian/build/rules.mk
+    - debian/control{,.in}
+  * Enable native Wayland support (LP: #1916469)
+    - debian/thunderbird.sh.in
+
+ -- Olivier Tilloy <olivier.tilloy@canonical.com>  Tue, 30 Mar 2021 17:27:07 +0200
+
 thunderbird (1:78.9.0+build2-0ubuntu1) hirsute; urgency=medium
 
   * New upstream stable release (78.9.0build2)
diff -Nru thunderbird-78.9.0+build2/debian/control thunderbird-78.9.1+build1/debian/control
--- thunderbird-78.9.0+build2/debian/control	2021-03-29 15:45:57.000000000 +0000
+++ thunderbird-78.9.1+build1/debian/control	2021-04-08 16:25:10.000000000 +0000
@@ -40,9 +40,9 @@
 	xvfb,
 	python3 (>= 3.5),
 	libffi-dev (>= 3.0.9) [powerpc ppc64el s390x],
-	clang-11 | clang-10 | clang-8,
-	libclang-11-dev | libclang-10-dev | libclang-8-dev,
-	llvm-11-dev | llvm-10-dev | llvm-8-dev,
+	clang-12 | clang-11 | clang-10 | clang-8,
+	libclang-12-dev | libclang-11-dev | libclang-10-dev | libclang-8-dev,
+	llvm-12-dev | llvm-11-dev | llvm-10-dev | llvm-8-dev,
 	cargo (>= 0.42),
 	rustc (>= 1.41.0),
 	nodejs (>= 10.21)
diff -Nru thunderbird-78.9.0+build2/debian/control.in thunderbird-78.9.1+build1/debian/control.in
--- thunderbird-78.9.0+build2/debian/control.in	2021-03-29 15:45:57.000000000 +0000
+++ thunderbird-78.9.1+build1/debian/control.in	2021-04-08 16:25:10.000000000 +0000
@@ -40,9 +40,9 @@
 	xvfb,
 	python3 (>= 3.5),
 	libffi-dev (>= 3.0.9) [powerpc ppc64el s390x],
-	clang-11 | clang-10 | clang-8,
-	libclang-11-dev | libclang-10-dev | libclang-8-dev,
-	llvm-11-dev | llvm-10-dev | llvm-8-dev,
+	clang-12 | clang-11 | clang-10 | clang-8,
+	libclang-12-dev | libclang-11-dev | libclang-10-dev | libclang-8-dev,
+	llvm-12-dev | llvm-11-dev | llvm-10-dev | llvm-8-dev,
 	cargo (>= 0.42),
 	rustc (>= 1.41.0),
 	nodejs (>= 10.21)
diff -Nru thunderbird-78.9.0+build2/debian/patches/series thunderbird-78.9.1+build1/debian/patches/series
--- thunderbird-78.9.0+build2/debian/patches/series	2021-03-29 15:45:57.000000000 +0000
+++ thunderbird-78.9.1+build1/debian/patches/series	2021-04-08 16:24:28.000000000 +0000
@@ -11,3 +11,4 @@
 ppc64el-workaround-bug-1555531.patch
 armhf-clang-no-integrated-as-for-neon.patch
 s390x-workaround-sqlite3-clang-optimization-hang.patch
+upstream-d241931.patch
diff -Nru thunderbird-78.9.0+build2/debian/patches/upstream-d241931.patch thunderbird-78.9.1+build1/debian/patches/upstream-d241931.patch
--- thunderbird-78.9.0+build2/debian/patches/upstream-d241931.patch	1970-01-01 00:00:00.000000000 +0000
+++ thunderbird-78.9.1+build1/debian/patches/upstream-d241931.patch	2021-04-08 16:24:28.000000000 +0000
@@ -0,0 +1,35 @@
+
+# HG changeset patch
+# User shravanrn@gmail.com <shravanrn@gmail.com>
+# Date 1597823374 0
+# Node ID d2419312024d5af620cf8ceabe57a822f6195147
+# Parent  106fff71bae26aa8c372966e8a4f6745e36db8e1
+Bug 1658401 - Update rlbox to fix clang 12 break on is_reference_v. r=dmajor, a=RyanVM
+
+Differential Revision: https://phabricator.services.mozilla.com/D86681
+
+diff --git a/third_party/rlbox/include/rlbox_type_traits.hpp b/third_party/rlbox/include/rlbox_type_traits.hpp
+--- a/third_party/rlbox/include/rlbox_type_traits.hpp
++++ b/third_party/rlbox/include/rlbox_type_traits.hpp
+@@ -38,20 +38,16 @@ constexpr bool is_func_ptr_v = (std::is_
+ 
+ template<typename T>
+ constexpr bool is_func_or_func_ptr = std::is_function_v<T> || is_func_ptr_v<T>;
+ 
+ template<typename T>
+ constexpr bool is_one_level_ptr_v =
+   std::is_pointer_v<T> && !std::is_pointer_v<std::remove_pointer_t<T>>;
+ 
+-template<typename T_To, typename T_From>
+-constexpr bool is_same_or_same_ref_v =
+-  std::is_same_v<T_To, T_From>&& std::is_reference_v<T_To&, T_From>;
+-
+ template<typename T_This, typename T_Target>
+ using add_const_if_this_const_t =
+   std::conditional_t<std::is_const_v<std::remove_pointer_t<T_This>>,
+                      std::add_const_t<T_Target>,
+                      T_Target>;
+ 
+ template<typename T>
+ using remove_const_from_pointer = std::conditional_t<
+
diff -Nru thunderbird-78.9.0+build2/debian/thunderbird.sh.in thunderbird-78.9.1+build1/debian/thunderbird.sh.in
--- thunderbird-78.9.0+build2/debian/thunderbird.sh.in	2020-10-28 15:03:42.000000000 +0000
+++ thunderbird-78.9.1+build1/debian/thunderbird.sh.in	2021-04-02 06:33:22.000000000 +0000
@@ -19,6 +19,9 @@
 
 export MOZ_APP_LAUNCHER
 
+# Enable native Wayland support (https://launchpad.net/bugs/1916469)
+export MOZ_ENABLE_WAYLAND=1
+
 while [ ! -x $MOZ_LIBDIR/$EXE ] ; do
     if [ -L "$MOZ_APP_LAUNCHER" ] ; then
         MOZ_APP_LAUNCHER=`readlink -f $MOZ_APP_LAUNCHER`