Bugzilla – Bug 1212259
MozillaThunderbird: bundled rnp/Botan, and supporting pluggable OpenPGP providers
Last modified: 2024-03-24 17:25:21 UTC
Mozilla Thunderbird bundles a number of libraries for OpenPGP support: * rnp: https://github.com/rnpgp/rnp and openSUSE:Factory/rnp * (bundled in rnp) https://github.com/rnpgp/sexp * Botan (rnp has an experimental OpenSSL backend too) We should look into un-bundling here due to: * general packaging policy - avoiding bundled libs * especially for crypto routines: shared crypto policy, and maybe to use OpenSSL FIPS? * incorrectly attributed bugs, e.g. bug 1212253 (CVE-2023-29479) considered against MozillaThunderbird and missed for rnp. * there are other compatible and pluggable providers of the Thunderbird plugin: https://gitlab.com/sequoia-pgp/sequoia-octopus-librnp Background: RH dropping Botan https://bugzilla.redhat.com/show_bug.cgi?id=1837512 FC splitting plugin: https://src.fedoraproject.org/rpms/thunderbird/c/edf3b30dbedcb43be087001509711b481dfce8f8?branch=rawhide FC system rnp: https://src.fedoraproject.org/rpms/thunderbird/c/0a585f45242a8fc024dfc1761acbe64e3473b2e5?branch=rawhide
Martin, what do you think?
Should be doable in principle. Thunderbird seems to have the build-options to use system-rnp, and also to choose the backend for it (botan or openssl). However, this also means more potential problems with version-mismatches etc. And librnp is not yet available at all in SLE, as far as I can see, and botan is not even in Factory. We'd probably also need to involve security, hence cc-ing Marcus.
Addendum: Using sequoia-octupus would be an interesting option, actually. It would fix the somewhat annoying "Split brain" regarding keyrings. Not sure, if this would be more work or the same amount, as getting librnp to SLE.
Just for completeness: In mozilla:experimental there is a slightly differently packaged Thunderbird with an -openpgp subpackage which can be replaced with sequoia-octopus-librnp since two years. I'm running it (but only rarely use PGP) by default. But that is only partially covering the request here I assume since it only covers the case for external components providing a full drop in replacement for librnp (as sequoia-octopus does).
sexp: https://build.opensuse.org/request/show/1093171 rnp: https://build.opensuse.org/package/rdiff/home:AndreasStieger/rnp?opackage=rnp&oproject=security%3Aprivacy&rev=2
This is an autogenerated message for OBS integration: This bug (1212259) was mentioned in https://build.opensuse.org/request/show/1093176 Factory / rnp https://build.opensuse.org/request/show/1093177 Factory / sexp
The split of the package MozillaThunderbird into MozillaThunderbird-openpgp-librnp is now also in project mozilla (work done by Adam Mizerski)