Bug#909000: [Pkg-mozext-maintainers] Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-23 Thread Daniel Kahn Gillmor
Control: clone 909000 -2
Control: retitle -2 apt: error message "apt install enigmail" failure is 
misleading
Control: reassign -2 apt 1.4.8
Control: severity -2 minor

On Mon 2018-10-22 08:28:50 -0400, Fabián Rodríguez wrote:
> This also fails in a clean Stretch install:
>
> # apt install enigmail
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> Some packages could not be installed. This may mean that you have
> requested an impossible situation or if you are using the unstable
> distribution that some required packages have not yet been created
> or been moved out of Incoming.
> The following information may help to resolve the situation:
>
> The following packages have unmet dependencies:
>   enigmail : Depends: thunderbird (>= 1:52.0) but it is not going to be 
> installed or
>   icedove (>= 1:52.0)
> E: Unable to correct problems, you have held broken packages.

I just want to note that this error message specifically appears to be a
bug in apt -- the reason apt won't let you install enigmail is because
the version of thunderbird in debian-security stretch/updates
(thunderbird 1:60.0) is marked with:

   Breaks: enigmail (<< 2:2~)

That's correct, because versions of enigmail prior to 2.0 do not work on
thunderbird 60 any longer.

it would be nice if apt improved the reporting here, to identify that
the cause of the problem is a conflict between the currently installed
version of thunderbird, and the desired version of enigmail.

Compare the differences with neither thunderbird nor enigmail installed:

root@stretch:~# apt install enigmail
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 enigmail : Depends: thunderbird (>= 1:52.0) but it is not going to be
 installed or
  icedove (>= 1:52.0)
  E: Unable to correct problems, you have held
 broken packages.
 root@stretch:~# apt install enigmail thunderbird
 Reading package lists... Done
 Building dependency tree
 Reading state information... Done
 Some packages could not be installed. This may mean that you have
 requested an impossible situation or if you are using the unstable
 distribution that some required packages have not yet been created
 or been moved out of Incoming.
 The following information may help to resolve the situation:

The following packages have unmet dependencies:
 thunderbird : Breaks: enigmail (< 2:2~) but 2:1.9.9-1~deb9u1 is to be
 installed
 E: Unable to correct problems, you have held broken packages.
 root@stretch:~#


the latter error message is clearly the correct one, but it doesn't
show in the former attempt.

--dkg


signature.asc
Description: PGP signature


Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-22 Thread Paul van der Vlis
Op 22-10-18 om 14:28 schreef Fabián Rodríguez:

> For now the only workaround seems to be manual installation via
> Thunderbird's addons.

No, see my earlier message in this bug with the title "workarround".
Works fine for me.

With regards,
Paul van der Vlis

-- 
Paul van der Vlis Linux systeembeheer Groningen
https://www.vandervlis.nl/



Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-22 Thread Fabián Rodríguez

This also fails in a clean Stretch install:

# apt install enigmail
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 enigmail : Depends: thunderbird (>= 1:52.0) but it is not going to be 
installed or

 icedove (>= 1:52.0)
E: Unable to correct problems, you have held broken packages.

For now the only workaround seems to be manual installation via 
Thunderbird's addons.




Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-08 Thread W. Martin Borgert

Quoting Daniel Kahn Gillmor :

thanks for testing! it appears that i failed to push earlier, but it
should now be pushed to salsa.


Yes, it is there, it build and installs fine and I could decrypt
and verify existing email. I then couldn't test further, because
I need the exchange calendar add-on, so I had to go back to
1:52.9.1-1~deb9u1 (see #906730: "calendar-exchange-provider:
Add-on is not compatible with Thunderbird 60.0"). I have
thunderbird on "hold" to refuse 60.0 until calendar works again.



Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-08 Thread Daniel Kahn Gillmor
On Mon 2018-10-08 16:05:39 +0200, W. Martin Borgert wrote:

>> In the meantime, for enigmail, i've pushed a debian/stretch branch into
>> salsa with commit id b6e978d64af1defdfed876b09c8a57acb796ad72 as
>
> Did you push? I can't find the id. I would like to test.

thanks for testing! it appears that i failed to push earlier, but it
should now be pushed to salsa.

> Btw. having it in bpo9 would be very good. I know, that this is abuse of
> backports. But whatever we do, it's better than letting users install
> via "Add-ones Manager".

the trouble with putting the updated enigmail in bpo9 is that it depends
on the fixes for GnuPG (see #910398) -- it will fail in pretty nasty
(and sometimes subtle) ways unless and until those changes are
available.  I'd love to hear other suggestions for how to do this, but i
don't see any better options than the approach outlined here,
unfortunately.  I'd be thrilled if someone else has a better approach.

--dkg



Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-08 Thread W. Martin Borgert

Hi Daniel,


In the meantime, for enigmail, i've pushed a debian/stretch branch into
salsa with commit id b6e978d64af1defdfed876b09c8a57acb796ad72 as


Did you push? I can't find the id. I would like to test.

Btw. having it in bpo9 would be very good. I know, that this is abuse of
backports. But whatever we do, it's better than letting users install
via "Add-ones Manager".

Cheers



Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-05 Thread Daniel Kahn Gillmor
On Tue 2018-10-02 14:31:13 -0500, Daniel Kahn Gillmor wrote:
> I'm now working on figuring out what updates are needed to GnuPG in
> debian stable (stretch) to be able to get the enigmail test suite to
> pass.  Hopefully they'll be minor, and comprehensible.

Turns out there were a half-dozen upstream GnuPG changes that needed
backporting to stretch to make the enigmail test suite pass.

Additionally, the Enigmail test suite itself needs a bit of cleanup to
deal sensibly with the older version of GnuPG (in particular, rapidly
setting up and tearing down ephemeral GnuPG homedirs during the test
suite causes problems for the older version of gpg-agent, reported
upstream as https://gitlab.com/enigmail/enigmail/merge_requests/30)

I've requested for the release team to consider the changes for GnuPG in
stretch here:

  https://bugs.debian.org/910398

If the security team (or other people interested in enigmail) want to
follow up on that report, i'd appreciate it.

In the meantime, for enigmail, i've pushed a debian/stretch branch into
salsa with commit id b6e978d64af1defdfed876b09c8a57acb796ad72 as
2:2.0.8-5~deb9u1, which i've tested against the proposed gnupg2
2.1.18-8~deb9u3.

I welcome review of both of the GnuPG and Enigmail branches.

  --dkg


signature.asc
Description: PGP signature


Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-03 Thread Daniel Kahn Gillmor
On Wed 2018-10-03 11:38:41 +0200, Jonas Meurer wrote:
> That's great news! Thanks a ton for working so hard on getting Enigmail
> 2.0 to run without OpenPGP.js. Will these changes be adapted upstream or
> will upstream keep using OpenPGP?

some of my changes are not upstreamable because i've punted on windows
compatibility to focus on getting it working on debian.

however, upstream seems committed to trying to get it to work without
OpenPGP.js in the future, so i hope that will be an option at some
point.

--dkg


signature.asc
Description: PGP signature


Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-03 Thread Jonas Meurer
Hi dkg,

Am 02.10.2018 um 21:31 schrieb Daniel Kahn Gillmor:
> On Mon 2018-09-17 15:44:03 -0400, Daniel Kahn Gillmor wrote:
>>  * i subsequently discovered that the enigmail test suite was inadequate
>>for the Autocrypt Setup Message -- i'm currently working on fixing
>>that. (this is #908510)
> 
> I'm happy to report that the enigmail test suite fully passes in both
> debian unstable and debian testing (buster) today, without OpenPGP.js.

That's great news! Thanks a ton for working so hard on getting Enigmail
2.0 to run without OpenPGP.js. Will these changes be adapted upstream or
will upstream keep using OpenPGP?

> I'm now working on figuring out what updates are needed to GnuPG in
> debian stable (stretch) to be able to get the enigmail test suite to
> pass.  Hopefully they'll be minor, and comprehensible.
> 
> Apologies for the slow progress.

No need to apologize at all. Again, thanks a lot for working on this.
It's much appreciated :)

Cheers
 jonas



signature.asc
Description: OpenPGP digital signature


Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-10-02 Thread Daniel Kahn Gillmor
On Mon 2018-09-17 15:44:03 -0400, Daniel Kahn Gillmor wrote:
>  * i subsequently discovered that the enigmail test suite was inadequate
>for the Autocrypt Setup Message -- i'm currently working on fixing
>that. (this is #908510)

I'm happy to report that the enigmail test suite fully passes in both
debian unstable and debian testing (buster) today, without OpenPGP.js.

I'm now working on figuring out what updates are needed to GnuPG in
debian stable (stretch) to be able to get the enigmail test suite to
pass.  Hopefully they'll be minor, and comprehensible.

Apologies for the slow progress.

  --dkg


signature.asc
Description: PGP signature


Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-09-23 Thread Jonas Meurer
Hi dkg,

Am 17.09.2018 um 21:44 schrieb Daniel Kahn Gillmor:
> On Mon 2018-09-17 10:14:31 +0200, Jonas Meurer wrote:
>> yesterday, Thunderbird 1:60.0-2~deb9u1 got uploaded to Stretch (via
>> security). This thunderbird version breaks enigmail (<< 2:2~), which
>> leads to uninstallable/unusable Enigmail in Debian Stretch.
>>
>> May I suggest to backport Enigmail 2.0 to Debian Stretch as well?
> 
> Thanks for this report, Jonas!  it's definitely correct.
> 
> It's important to fix, but the dependency on more recent versions of
> GnuPG will be needed as well.  There are several problems that i'm
> trying to work through for enigmail in the limited time that i've got
> for this.

Thanks a ton for the detailed explanation. I see that there's no easy
solution to this. Unfortunately I don't have any cacapities available to
help you with solving the issue.

Kind regards
 jonas




signature.asc
Description: OpenPGP digital signature


Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-09-21 Thread Simon Richter
Hi,

pulling gnupg or enigmail from backports would only solve the problem
for new installations, but doesn't help users who have both thunderbird
and enigmail installed, only have stretch and stretch-security in the
sources.list (what I'd expect to be the majority) and are now trying to
run "apt upgrade":

Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
  icedove lightning thunderbird
0 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.

So this is blocking security upgrades.

   Simon



signature.asc
Description: OpenPGP digital signature


Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-09-20 Thread Markus Koschany
Hey,

just wanted to chime in here. I successfully backported the Buster
version of enigmail to Stretch by removing the versioned dependency on
gnupg. So far I haven't experienced any difficulties. Of course this
isn't a solution for the OpenPGP.js problem but at least to me it seems
that the gnupg version in Stretch works well with enigmail.

Regards,

Markus



signature.asc
Description: OpenPGP digital signature


Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-09-17 Thread Daniel Kahn Gillmor
On Mon 2018-09-17 10:14:31 +0200, Jonas Meurer wrote:
> yesterday, Thunderbird 1:60.0-2~deb9u1 got uploaded to Stretch (via
> security). This thunderbird version breaks enigmail (<< 2:2~), which
> leads to uninstallable/unusable Enigmail in Debian Stretch.
>
> May I suggest to backport Enigmail 2.0 to Debian Stretch as well?

Thanks for this report, Jonas!  it's definitely correct.

It's important to fix, but the dependency on more recent versions of
GnuPG will be needed as well.  There are several problems that i'm
trying to work through for enigmail in the limited time that i've got
for this.

Some background:

 * enigmail imported a copy of OpenPGP.js wholesale in version 2.0.x

 * unfortuantely, the version they imported isn't the actual preferred
   form of modification -- it's an assembled/"compiled" form of the
   project, using node.

 * I asked enigmail upstream whether he had ever built OpenPGP.js from
   source, and he had not -- he simply copied their distributed bundle.

 * the DFSG-free way to get that into debian is to get OpenPGP.js into
   debian -- see https://bugs.debian.org/787774 for that ITP.

 * i tried off and on for weeks to figure out how to make that happen
   cleanly, but eventually gave up because of the explosion of node
   packaging that would have been required.  even if i'd been able to
   follow the dependency tree to its ends (which was problematic for
   lots of reasons), i don't think i can responsibly maintain all those
   node packages :(

 * instead, i realized that the OpenPGP.js node package was only needed
   by enigmail for a few things, in particular to avoid needing a newer
   version of GnuPG.

 * there were a few small changes that needed to be made to GnuPG to
   make enigmail pass its test suites properly without OpenPGP.js, so i
   got them made upstream in GnuPG.

 * then i stripped OpenPGP.js from enigmail, and bumped enigmail's
   dependency on GnuPG.

 * new versions of thunderbird apparently change the behavior of some of
   the enigmail tests -- see #907984 and #906885

 * i subsequently discovered that the enigmail test suite was inadequate
   for the Autocrypt Setup Message -- i'm currently working on fixing
   that. (this is #908510)

If i can get that fixed, then i can look into porting the improvements
to GnuPG needed by enigmail's test suite into the stable version of
GnuPG.  Sadly, i'm pretty behind on this, but i would welcome help.

--dkg


signature.asc
Description: PGP signature


Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-09-17 Thread Lee Garrett
The problem here is that the newer enigmail from buster depends on gnupg (>=
2.2.8-2~), which is only available in stretch-backports. If there is no way to
make it work with gnupg from stable, I proprose to remove enigmail from
stable, and offer it via stretch-backports.

Whatever the eventual solution may be, it would be great to solve this issue
very soon, as this is currently breaking things for users in stable.

On Mon, 17 Sep 2018 10:14:31 +0200 Jonas Meurer  wrote:
> Source: enigmail
> Version: 2:1.9.9-1~deb9u1
> Severity: grave
> 
> Dear maintainers,
> 
> yesterday, Thunderbird 1:60.0-2~deb9u1 got uploaded to Stretch (via
> security). This thunderbird version breaks enigmail (<< 2:2~), which
> leads to uninstallable/unusable Enigmail in Debian Stretch.
> 
> May I suggest to backport Enigmail 2.0 to Debian Stretch as well?
> 
> Cheers
>  jonas
> 
> -- System Information:
> Debian Release: 9.5
>   APT prefers stable-updates
>   APT policy: (500, 'stable-updates'), (500, 'stable')
> Architecture: amd64 (x86_64)
> Foreign Architectures: i386
> 
> Kernel: Linux 4.9.0-8-amd64 (SMP w/4 CPU cores)
> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) (ignored: 
> LC_ALL set to en_US.UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) (ignored: 
> LC_ALL set to en_US.UTF-8)
> Shell: /bin/sh linked to /bin/dash
> Init: systemd (via /run/systemd/system)
> 
> -- no debconf information
> 
> 



Bug#909000: Enigmail 2.0 needed in Stretch after Thunderbird 60 upload

2018-09-17 Thread Jonas Meurer
Source: enigmail
Version: 2:1.9.9-1~deb9u1
Severity: grave

Dear maintainers,

yesterday, Thunderbird 1:60.0-2~deb9u1 got uploaded to Stretch (via
security). This thunderbird version breaks enigmail (<< 2:2~), which
leads to uninstallable/unusable Enigmail in Debian Stretch.

May I suggest to backport Enigmail 2.0 to Debian Stretch as well?

Cheers
 jonas

-- System Information:
Debian Release: 9.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-8-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) (ignored: LC_ALL 
set to en_US.UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set 
to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

-- no debconf information