On Mon 2018-09-17 10:14:31 +0200, Jonas Meurer wrote: > yesterday, Thunderbird 1:60.0-2~deb9u1 got uploaded to Stretch (via > security). This thunderbird version breaks enigmail (<< 2:2~), which > leads to uninstallable/unusable Enigmail in Debian Stretch. > > May I suggest to backport Enigmail 2.0 to Debian Stretch as well?
Thanks for this report, Jonas! it's definitely correct. It's important to fix, but the dependency on more recent versions of GnuPG will be needed as well. There are several problems that i'm trying to work through for enigmail in the limited time that i've got for this. Some background: * enigmail imported a copy of OpenPGP.js wholesale in version 2.0.x * unfortuantely, the version they imported isn't the actual preferred form of modification -- it's an assembled/"compiled" form of the project, using node. * I asked enigmail upstream whether he had ever built OpenPGP.js from source, and he had not -- he simply copied their distributed bundle. * the DFSG-free way to get that into debian is to get OpenPGP.js into debian -- see https://bugs.debian.org/787774 for that ITP. * i tried off and on for weeks to figure out how to make that happen cleanly, but eventually gave up because of the explosion of node packaging that would have been required. even if i'd been able to follow the dependency tree to its ends (which was problematic for lots of reasons), i don't think i can responsibly maintain all those node packages :( * instead, i realized that the OpenPGP.js node package was only needed by enigmail for a few things, in particular to avoid needing a newer version of GnuPG. * there were a few small changes that needed to be made to GnuPG to make enigmail pass its test suites properly without OpenPGP.js, so i got them made upstream in GnuPG. * then i stripped OpenPGP.js from enigmail, and bumped enigmail's dependency on GnuPG. * new versions of thunderbird apparently change the behavior of some of the enigmail tests -- see #907984 and #906885 * i subsequently discovered that the enigmail test suite was inadequate for the Autocrypt Setup Message -- i'm currently working on fixing that. (this is #908510) If i can get that fixed, then i can look into porting the improvements to GnuPG needed by enigmail's test suite into the stable version of GnuPG. Sadly, i'm pretty behind on this, but i would welcome help. --dkg
signature.asc
Description: PGP signature