Re: [SOGo] Packaging Debian in SOGo

2011-04-06 Thread Clint Adams
Christian Roessner said: So, if projects can not be linked against OpenSSL, wouldn't be NSS the better choice than gnutls (also for other packages)? This video contains information about the flaws in many SSL/TLS toolkits: http://www.youtube.com/watch?v=y3cfEP05LDA -- users@sogo.nu

Re: [SOGo] Packaging Debian in SOGo

2011-04-06 Thread Jeroen Dekkers
At Thu, 7 Apr 2011 00:34:01 +, Clint Adams wrote: Christian Roessner said: So, if projects can not be linked against OpenSSL, wouldn't be NSS the better choice than gnutls (also for other packages)? This video contains information about the flaws in many SSL/TLS toolkits:

Re: [SOGo] Packaging Debian in SOGo

2011-04-03 Thread Christian Roessner
Sorry, I don't know about NSS (only name service switch ;-) ) NSS was orginally created by Netscape and now maintained by Mozilla. It is used by all Mozilla products, but also for example by OpenOffice.org and Chrome. See http://www.mozilla.org/projects/security/pki/nss/ for more

Re: [SOGo] Packaging Debian in SOGo

2011-04-03 Thread Christian Roessner
Am 02.04.2011 12:37, schrieb Jeroen Dekkers: At Sat, 02 Apr 2011 08:38:46 +0200, Christian Roessner wrote: I know, I will get flamed right now, but please do not use gnutls. Google for i.e. OpenLDAP and gnutls and follow the comments from Howard Chu, then you understand me. Or at least dear

Re: [SOGo] Packaging Debian in SOGo

2011-04-02 Thread Christian Roessner
I know, I will get flamed right now, but please do not use gnutls. Google for i.e. OpenLDAP and gnutls and follow the comments from Howard Chu, then you understand me. Or at least dear SOGo devs: please do not drop packges for Ubuntu/Debian on inverse, so people can use the openssl variant.

Re: [SOGo] Packaging Debian in SOGo

2011-04-02 Thread Jeroen Dekkers
At Sat, 02 Apr 2011 08:38:46 +0200, Christian Roessner wrote: I know, I will get flamed right now, but please do not use gnutls. Google for i.e. OpenLDAP and gnutls and follow the comments from Howard Chu, then you understand me. Or at least dear SOGo devs: please do not drop packges for

Re: [SOGo] Packaging Debian in SOGo

2011-04-01 Thread Christian Roessner
SOPE and SOGo use OpenSSL which is incompatible with the GPL due to the advertising clause. There are only 3 places where OpenSSL is used and it shouldn't be that hard to replace OpenSSL with GnuTLS or NSS. Would a patch doing that be accepted? I know, I will get flamed right now, but please

Re: [SOGo] Packaging Debian in SOGo

2011-04-01 Thread Jeroen Dekkers
At Fri, 01 Apr 2011 11:34:34 +0200, Christian Roessner wrote: SOPE and SOGo use OpenSSL which is incompatible with the GPL due to the advertising clause. There are only 3 places where OpenSSL is used and it shouldn't be that hard to replace OpenSSL with GnuTLS or NSS. Would a patch doing

Re: [SOGo] Packaging Debian in SOGo

2011-04-01 Thread Wolfgang Sourdeau
Hi Jeroen, If you are serious about maintaining that package then that's very good news! Regarding your concerns: - for libssl, we use the encryption code but we also make use of utility functions such as md5_something. I don't know if similar functions are offered by other libraries. The

[SOGo] Packaging Debian in SOGo

2011-03-31 Thread Jeroen Dekkers
Hi, I'm currently working on the Debian packaging of SOGo with the goal of getting it into Debian. There has been a request for package here: http://bugs.debian.org/584073. Some issues are raised there and I found a few myself. The things I haven't solved yet are: SOPE and SOGo use OpenSSL which