Bug#837177: icedove: the feed url could not be found

[Carsten Schoenert]

Hello Jens,

On Sat, Dec 03, 2016 at 04:07:02PM +0100, Jens Reyer wrote:
> Thunderbird 52.0 ESR will be released 2017-03-07. If I understood the
> release model correctly, 52.2 ESR will be the first version of this
> series that will be uploaded to stretch. It will be released on 2017-06-13.
> 
> No hard opinion if this bug needs to be fixed in the meantime, but
> personally I'd prefer so.
> 
> Attached you'll find a ready made patch series. For this I added
> comm-central as hg/git remote and then cherry-picked the 3 commits from
> the upstream bug on patch-queue master. There was only one merge
> conflict, and I'm confident I resolved it correctly. I didn't "quilt
> refresh" the patches, so there are some whitespace warnings.
> 
> Previously I already tested successfully that it works as expected. Now
> I successfully rebuilt 45.5.1-1 with this patch and run this version.

that sound good.
I've no hard objections against adding this patch, it's currently just
not my first priority as I'm working (again) in preparing the
recurring of Thunderbird packages.

Once the new Thunderbird packages on the way it's obviously a next step
to pick up your patch and fixing this issue. Unfortunately we are
suffering now from #844357 the build issues in mips*.

So, I just can say again thank you for providing patches, we will add
them as soon as possible.

Regards
Carsten

Bug#837177: icedove: the feed url could not be found

[Jens Reyer]

control: tags -1 + patch

Hi Carsten

On 25.10.2016 07:28, Carsten Schoenert wrote:
> On Mon, Oct 24, 2016 at 10:22:58PM +0200, Jens Reyer wrote:
>> The changes have been committed upstream by now (Target Milestone:
>> Thunderbird 52.0).
> 
> thanks for figuring out and adding additional information to thisd bug
> report.
> I'm currently unsure if we will fins to include this upstream changes
> into the next uploads as we are preparing the switch back to thunderbird
> packages. The plan is to serve Thunderbird packages for the Stretch
> release.

Thunderbird 52.0 ESR will be released 2017-03-07. If I understood the
release model correctly, 52.2 ESR will be the first version of this
series that will be uploaded to stretch. It will be released on 2017-06-13.

No hard opinion if this bug needs to be fixed in the meantime, but
personally I'd prefer so.

Attached you'll find a ready made patch series. For this I added
comm-central as hg/git remote and then cherry-picked the 3 commits from
the upstream bug on patch-queue master. There was only one merge
conflict, and I'm confident I resolved it correctly. I didn't "quilt
refresh" the patches, so there are some whitespace warnings.

Previously I already tested successfully that it works as expected. Now
I successfully rebuilt 45.5.1-1 with this patch and run this version.

Greets
jre
>From 23a5fbefa8135ebcb702bb4234187132baf2cb3f Mon Sep 17 00:00:00 2001
From: Jens Reyer 
Date: Sat, 3 Dec 2016 15:07:22 +0100
Subject: [PATCH] improve RSS feeds invalid certificate handling

Closes: #837177

Signed-off-by: Jens Reyer 
---
 ...ment-verify-mode-in-the-subscribe-dialog-.patch | 335 
 ...ds-with-an-invalid-certificate-fail-wit-1.patch |  40 +++
 ...eeds-with-an-invalid-certificate-fail-wit.patch | 349 +
 debian/patches/series  |   3 +
 4 files changed, 727 insertions(+)
 create mode 100644 debian/patches/fixes/Bug-497488-Implement-verify-mode-in-the-subscribe-dialog-.patch
 create mode 100644 debian/patches/fixes/Bug-497488-RSS-feeds-with-an-invalid-certificate-fail-wit-1.patch
 create mode 100644 debian/patches/fixes/Bug-497488-RSS-feeds-with-an-invalid-certificate-fail-wit.patch

diff --git a/debian/patches/fixes/Bug-497488-Implement-verify-mode-in-the-subscribe-dialog-.patch b/debian/patches/fixes/Bug-497488-Implement-verify-mode-in-the-subscribe-dialog-.patch
new file mode 100644
index 000..d6e5b34
--- /dev/null
+++ b/debian/patches/fixes/Bug-497488-Implement-verify-mode-in-the-subscribe-dialog-.patch
@@ -0,0 +1,335 @@
+From: alta88 
+Date: Tue, 18 Oct 2016 12:02:00 +0200
+Subject: Bug 497488 - Implement verify mode in the subscribe dialog for
+ existing feed urls. r=mkmelin
+
+Origin: https://hg.mozilla.org/comm-central/rev/141676b80c81e2a3daeeac6ad21da35086ae0240
+Bug-Debian: https://bugs.debian.org/837177
+Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=497488
+Applied-Upstream: Thunderbird 52.0
+
+Signed-off-by: Jens Reyer 
+
+# Conflicts:
+#	mailnews/extensions/newsblog/content/FeedUtils.jsm
+---
+ .../chrome/messenger-newsblog/newsblog.properties  |   1 +
+ mailnews/extensions/newsblog/content/Feed.js   |  30 +++---
+ mailnews/extensions/newsblog/content/FeedUtils.jsm |   2 +-
+ .../newsblog/content/feed-subscriptions.js | 119 ++---
+ .../newsblog/content/feed-subscriptions.xul|   2 +-
+ 5 files changed, 102 insertions(+), 52 deletions(-)
+
+diff --git a/mail/locales/en-US/chrome/messenger-newsblog/newsblog.properties b/mail/locales/en-US/chrome/messenger-newsblog/newsblog.properties
+index 3abbc23..c1a3c97 100644
+--- a/mail/locales/en-US/chrome/messenger-newsblog/newsblog.properties
 b/mail/locales/en-US/chrome/messenger-newsblog/newsblog.properties
+@@ -13,6 +13,7 @@ subscribe-feedMoved=Feed subscription moved.
+ subscribe-feedCopied=Feed subscription copied.
+ subscribe-feedRemoved=Feed unsubscribed.
+ subscribe-feedNotValid=The Feed URL is not a valid feed.
++subscribe-feedVerified=The Feed URL has been verified.
+ subscribe-networkError=The Feed URL could not be found. Please check the name and try again.
+ subscribe-noAuthError=The Feed URL is not authorized.
+ subscribe-loading=Loading, please wait…
+diff --git a/mailnews/extensions/newsblog/content/Feed.js b/mailnews/extensions/newsblog/content/Feed.js
+index a4b8555..7e47260 100755
+--- a/mailnews/extensions/newsblog/content/Feed.js
 b/mailnews/extensions/newsblog/content/Feed.js
+@@ -20,6 +20,7 @@ var FeedCache =
+ let index = this.normalizeHost(aUrl);
+ if (index in this.mFeeds)
+   return this.mFeeds[index];
++
+ return null;
+   },
+ 
+@@ -111,13 +112,10 @@ Feed.prototype =
+ // Before we do anything, make sure the url is an http url.  This is just
+ // a sanity check so we don't try opening mailto urls, imap urls, etc. that
+ // the user may have tried to 

Bug#837177: icedove: the feed url could not be found

[Carsten Schoenert]

Hello Jens,

On Mon, Oct 24, 2016 at 10:22:58PM +0200, Jens Reyer wrote:
> Hi again,
> 
> I again had issues subscribing to a feed getting only the meaningless
> error message "The Feed URL could not be found. Please check the name
> and try again".
> 
> So I tested a new version of the patches from the upstream bug: now I
> got a meaningful error message ("[URL] uses an invalid security
> certificate.") and was offered to add a security certificate
> exception. Problem solved.
> 
> The changes have been committed upstream by now (Target Milestone:
> Thunderbird 52.0).

thanks for figuring out and adding additional information to thisd bug
report.
I'm currently unsure if we will fins to include this upstream changes
into the next uploads as we are preparing the switch back to thunderbird
packages. The plan is to serve Thunderbird packages for the Stretch
release.

Regards
Carsten

Bug#837177: icedove: the feed url could not be found

[Jens Reyer]

control: forwarded -1 https://bugzilla.mozilla.org/show_bug.cgi?id=497488
control: tags -1 + fixed-upstream


Hi again,

I again had issues subscribing to a feed getting only the meaningless
error message "The Feed URL could not be found. Please check the name
and try again".

So I tested a new version of the patches from the upstream bug: now I
got a meaningful error message ("[URL] uses an invalid security
certificate.") and was offered to add a security certificate
exception. Problem solved.

The changes have been committed upstream by now (Target Milestone:
Thunderbird 52.0).

Greets
jre

Bug#837177: icedove: the feed url could not be found

[Jens Reyer]

Followup-For: Bug #837177
Control: tags -1 - newcomer

[ Removing the tag newcomer which is meant for easy bugs with a known
solution, see https://www.debian.org/Bugs/Developer#tags ]


Summary:
I could reproduce this, but since yesterday it's working again *without*
updating icedove itself.
Possible upstream bug:
  https://bugzilla.mozilla.org/show_bug.cgi?id=497488

@mudongliang, can you confirm this?


I could reproduce this for the mentioned feed [1]. And also the feed [2]
stopped updating here on/after 2016-08-18 when I updated to
1:45.2.0-4+b1. If I tried to add these URLs as new feeds in icedove I
got "The feed URL could not be found. Please check the name and try again."

[1] https://linux.cn/rss.xml
[2] https://twigserial.wordpress.com/feed/

Other feeds still worked. The problematic feeds seem to have problems
with the certificate in common (firefox says "This website does not
supply identity information."). But not all https feeds were affected.

Last week I still could reproduce this in 1:45.3.0-1. However at the
same time for a new user on the same machine adding those feeds worked.

Since yesterday everything works as expected again. I verified this
using a backup of ~/.icedove from last month with both 1:45.3.0-1 and
1:45.4.0-1.


Maybe related:

1.)
On Oct 1 2016 I upgraded openssl 1.0.2h-1 -> 1.0.2j-1.

2.)
I think the general issue is being worked on in
https://bugzilla.mozilla.org/show_bug.cgi?id=497488 (RSS feeds with an
invalid certificate fail with a misleading 'url could not be found'
error, work if a certificate security exception is added manually).

2a)
I failed to get it working by adding a certificate security exception.
But (in hindsight) I assume this failed because I removed each and every
certificate for servers and authorities in icedove before (while working
on this bug, so this wasn't the original reason for my problems). So the
following might have worked:

First I saved the wordpress certificate from firefox and imported it in
icedove:
Preferences - Advanced - Certificates - View Certificates - Servers - Import

Then I tried:
Preferences - Advanced - Certificates - View Certificates - Servers -
Add Exception...
Add Security Exception: Location: https://twigserial.wordpress.com/feed/
- Get certificate
Then I got (not surprisingly in hindsight) "The certificate is not
trusted because it hasn't been verified as issued by a trusted authority
using a secure signature."
- Add exception

2b)
Initially I also failed to get it working with the patches in the
upstream bugreport (attachment 8795001 and 8795020, newer versions
available in the meantime). But I still lacked the authority
certificates at that time. Further I needed to refresh them which might
have gone wrong.


After readding the authority certificate http://pki.google.com/GIAG2.crt
(and maybe also http://g.symcb.com/crls/gtglobal.crl) yesterday my
patched icedove worked.

Following this I tested with an old, previously broken, backup of
~/.icedove and icedove 1:45.2.0-4+b1. This combination failed in the
past, but worked now.


So here the bug isn't found anymore, yet the exact solution or further
todo is unknown. Does running icedove and tampering with the
certificates change anything outside ~/.icedove?

Greets
jre



-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable-debug'), (500,
'testing-debug'), (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages icedove depends on:
ii  debianutils   4.8
ii  fontconfig2.11.0-6.7
ii  libasound21.1.2-1
ii  libatk1.0-0   2.22.0-1
ii  libc6 2.24-3
ii  libcairo2 1.14.6-1+b1
ii  libdbus-1-3   1.10.10-1
ii  libdbus-glib-1-2  0.108-1
ii  libevent-2.0-52.0.21-stable-2+b1
ii  libffi6   3.2.1-6
ii  libfontconfig12.11.0-6.7
ii  libfreetype6  2.6.3-3+b1
ii  libgcc1   1:6.1.1-11
ii  libgdk-pixbuf2.0-02.36.0-1
ii  libglib2.0-0  2.50.0-1
ii  libgtk2.0-0   2.24.31-1
ii  libhunspell-1.4-0 1.4.1-2
ii  libicu57  57.1-4
ii  libnspr4  2:4.12-2
ii  libnss3   2:3.26-2
ii  libpango-1.0-01.40.3-2
ii  libpangocairo-1.0-0   1.40.3-2
ii  libpangoft2-1.0-0 1.40.3-2
ii  libpixman-1-0 0.34.0-1
ii  libsqlite3-0  3.14.2-1
ii  libstartup-notification0  0.12-4
ii  libstdc++66.1.1-11
ii  libvpx4   1.6.0-2
ii  libx11-6  2:1.6.3-1
ii  libxcomposite11:0.4.4-1
ii  libxdamage1   1:1.1.4-2+b1
ii  libxext6  2:1.3.3-1
ii  

Bug#837177: icedove: the feed url could not be found

[mudongliang]

Package: icedove
Version: 1:45.2.0-4+b1
Severity: normal
Tags: newcomer

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
 ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

I could not update my rss after "apt-get upgrade". I tried to remove the
rss and subscribe it with the url. The result is that icedove shows that the
feed url could not be found, for example,
https://linux.cn/rss.xml.
https://linuxtoy.org/feeds/all.atom.xml

With the same rss, I could subscribe in my another computer with Debian Jessie.
Maybe it is a bug of software updates.



-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.6.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages icedove depends on:
ii  debianutils   4.8
ii  fontconfig2.11.0-6.7
ii  libasound21.1.2-1
ii  libatk1.0-0   2.21.90-2
ii  libc6 2.23-5
ii  libcairo2 1.14.6-1+b1
ii  libdbus-1-3   1.10.10-1
ii  libdbus-glib-1-2  0.106-1
ii  libevent-2.0-52.0.21-stable-2+b1
ii  libffi6   3.2.1-4
ii  libfontconfig12.11.0-6.7
ii  libfreetype6  2.6.3-3+b1
ii  libgcc1   1:6.1.1-11
ii  libgdk-pixbuf2.0-02.34.0-1
ii  libglib2.0-0  2.49.6-1
ii  libgtk2.0-0   2.24.30-4
ii  libhunspell-1.4-0 1.4.1-2
ii  libicu57  57.1-3
ii  libnspr4  2:4.12-2
ii  libnss3   2:3.25-1
ii  libpango-1.0-01.40.2-1
ii  libpangocairo-1.0-0   1.40.2-1
ii  libpangoft2-1.0-0 1.40.2-1
ii  libpixman-1-0 0.33.6-1
ii  libsqlite3-0  3.14.1-1
ii  libstartup-notification0  0.12-4
ii  libstdc++66.1.1-11
ii  libvpx4   1.6.0-2
ii  libx11-6  2:1.6.3-1
ii  libxcomposite11:0.4.4-1
ii  libxdamage1   1:1.1.4-2+b1
ii  libxext6  2:1.3.3-1
ii  libxfixes31:5.0.2-1
ii  libxrender1   1:0.9.9-2
ii  libxt61:1.1.5-1
ii  psmisc22.21-2.1+b1
ii  zlib1g1:1.2.8.dfsg-2+b1

Versions of packages icedove recommends:
ii  hunspell-en-us [hunspell-dictionary]  20070829-6
ii  iceowl-extension  1:45.2.0-4+b1

Versions of packages icedove suggests:
pn  apparmor  
ii  fonts-lyx 2.2.0-2
ii  libgssapi-krb5-2  1.14.3+dfsg-1

-- no debconf information