Hello Debian Security Team, unfortunately the introduction of Thunderbird ESR52 packages in jessie-security was bringing some regression for users of the Enigmail extension due we have forgotten to add a breaks against the version of enigmail in Jessie. This was resulting in the following bug reports:
Bug report against Thunderbird https://bugs.debian.org/869789 Bug Report against Enigmail https://bugs.debian.org/869774 Thunderbird greater or equal version ESR 52.0 needs the Enigmail extension version 1.9.6 or greater. As Daniel pointed out in #869774 there are some other issues found within the Enigmail extension which solved by 1.9.8.1 and user should use them on TB52. While writing this email Jessie has only version 1.8.2. > $ rmadison enigmail | grep oldstable > enigmail | 2:1.7.2-3 | oldstable-kfreebsd | source, kfreebsd-amd64, > kfreebsd-i386 > enigmail | 2:1.8.2-4~deb7u1 | oldoldstable | source, amd64, armel, > armhf, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, > s390, s390x, sparc > enigmail | 2:1.8.2-4~deb8u1 | oldstable | source, amd64, arm64, > armel, armhf, i386, mips, mipsel, powerpc, ppc64el, s390x Because of the not increased version of enigmail that is breaking with Thunderbird all users of oldstable with updated Thunderbird packages have now a not working Enigmail extension due API incompatibilities. We would like to prepare a new version of Thunderbird for oldstable with a corrected version for enigmail that's breaking Thunderbird. I've seen Daniel has prepared a new update for the enigmail package for olsdtable that will solve the problem for users with Jessie. Daniel, thanks for quickly working on that! What's the opinion of the security team for another update of the existing Thunderbird packages in oldstable? I mean, we can't solve the problem of the needed version of Enigmail for users of Jessie, we just can add a proper Breaks to the control file. But doping so would need potentially somewhere manually updates on some users side. OTOH we can add the correct Breaks for Thunderbird with version 52.3.0 which should arrive in the next two weeks or so. I fully agree with Daniel that the enigmail extension is some kind of special of all the various Mozilla extensions and we should always take care that even oldstable has a working combination of Thunderbird and Enigmail. I think the possibility of using encryption is really important today. Maybe blame me as I've totally forgotten to take a deeper look at the symbiotic relationship of Enigmail and Thunderbird after the release of TB ESR52. But due the long standing problems we had while building Thunderbird (mostly me have worked on that for over 2 months!) and the end of the freeze process for Stretch has taken much energy. We need some auto testing stuff that will help to discover such problems early as there are also some other typical extensions that maybe break by every new ESR version of Thunderbird. Hopefully we find some time to talk about that all at DebCamp/DebConf? -- Regards Carsten Schoenert _______________________________________________ Pkg-mozext-maintainers mailing list Pkg-mozext-maintainers@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-mozext-maintainers