Enigmail in Debian

[Daniel Kahn Gillmor]

Hi Andy--

On Wed 2013-11-20 14:58:52 -0500, Andy Ruddock wrote:
> I have accounts for which I've used both Iceape and Icedove for a number
> of years.
> Recently changes to Icedove meant that the version of Enigmail shipped
> with Debian would no longer work with both packages.

Yes, this is due to the fact that iceape in debian appears to be
significantly outdated, unfortunately.

It appears that 2.7.12 is the latest version of iceape in debian
(uploaded back in january), while 2.22.1 is the latest version of
seamonkey upstream (released a few weeks ago):

  http://packages.qa.debian.org/i/iceape.html
  http://www.seamonkey-project.org/

even 2.7.12 itself appears to be a hand-rolled "upstream" release, and
isn't listed on the seamonkey news page:

  http://www.seamonkey-project.org/news

> When is support for both packages likely to be restored? Currently my
> options are to either hold the old version of Icedove or stop using
> Enigmail with Iceape - neither option is particularly appealing.

The problem is that up until gecko 17 or so, specific enigmail versions
were tied pretty closely to a particular gecko runtime.

As of gecko 17 (and enigmail 1.5.2 or 1.6) and going forward, enigmail
should be much more flexible in its version alignments.

So one approach would be to get a modern (> 2.17, if i'm understanding
the seamonkey versioning scheme correctly) version of seamonkey/iceape
into debian.  This might also help with the 57 currently-open security
issues with the version of iceape in debian:

 https://security-tracker.debian.org/tracker/source-package/iceape

Another approach would be to make an "enigmail-iceape" package that is
effectively a clone of the enigmail package, but working from an older
version.  If i'm reading the enigmail download page, though, it would
need to be 1.4.1.  that package would need to change the guid associated
with the extension, though, and would need to modify the install.rdf to
ensure that it isn't used with anything but iceape.

I'm not prepared to maintain this particular package, but if someone
wants to try, i'd recommend looking at the existing git repository for
debian packaging:

  git://git.debian.org/pkg-mozext/enigmail

If you (or anyone) wants to take a crack at making a new packaging
branch there, with the appropriate changes, i'd be willing to take a
look at the proposed changesets.

But overall, i'm not confident that you want to be connecting iceape
directly to the dirty dirty internets at the moment, given the broad
attack surface it seems to have.

Sorry for the unsatisfying answers.

Regards,

     --dkg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 965 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-mozilla-maintainers/attachments/20131127/5a3d9e82/attachment.sig>