Package: enigmail Version: 2:2.0-1 Severity: serious Tags: upstream Justification: Policy 2.1.3 (DFSG ยง3)
Enigmail starting in version 2.0 contains a pre-built copy of OpenPGP.js, without source code that can build that artifact. The best way to handle this would be to put OpenPGP.js into debian (see https://bugs.debian.org/787774), but i've tried to do this and the node dependency tree is too much for me to handle. the next-best way to handle this would be to put just the sources of OpenPGP.js into enigmail and have the enigmail build itself generate the necessary OpenPGP.js built artifacts. I've tried to do this with debian/missing-sources/ but even from there i'm unable to generate the compiled artifacts that enigmail wants to use. I've asked upstream about this, and it doesn't sound feasible for them to do it upstream either: I don't believe that upstream has ever built OpenPGP.js from source. The third option (which i'm pursuing now) is to strip out OpenPGP.js from enigmail and ensure that it works with only GnuPG (it's mostly GnuPG in the first place). Until that's done, i don't believe enigmail is DFSG-free, because it does not include the source code for all of its parts. in frustration, --dkg -- System Information: Debian Release: buster/sid APT prefers testing-debug APT policy: (500, 'testing-debug'), (500, 'testing'), (500, 'oldstable'), (200, 'unstable-debug'), (200, 'unstable'), (1, 'experimental-debug'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.16.0-1-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages enigmail depends on: ii gnupg 2.2.8-2 ii gnupg-agent 2.2.8-2 ii gnupg2 2.2.8-2 ii gpg-agent [gnupg-agent] 2.2.8-2 ii icedove 1:52.4.0-1 ii thunderbird 1:52.8.0-1 Versions of packages enigmail recommends: ii pinentry-gnome3 [pinentry-x11] 1.1.0-1+b1 ii pinentry-gtk2 [pinentry-x11] 1.1.0-1+b1 ii pinentry-qt [pinentry-x11] 1.1.0-1+b1 enigmail suggests no packages. -- no debconf information