[Pkg-mozext-maintainers] Regression update for Thunderbird in jessie-security (aka oldstable)?

[Carsten Schoenert]

Hello Debian Security Team,

unfortunately the introduction of Thunderbird ESR52 packages in
jessie-security was bringing some regression for users of the Enigmail
extension due we have forgotten to add a breaks against the version of
enigmail in Jessie.
This was resulting in the following bug reports:

Bug report against Thunderbird
https://bugs.debian.org/869789

Bug Report against Enigmail
https://bugs.debian.org/869774

Thunderbird greater or equal version ESR 52.0 needs the Enigmail
extension version 1.9.6 or greater. As Daniel pointed out in #869774
there are some other issues found within the Enigmail extension which
solved by 1.9.8.1 and user should use them on TB52.
While writing this email Jessie has only version 1.8.2.

> $ rmadison enigmail | grep oldstable
> enigmail   | 2:1.7.2-3        | oldstable-kfreebsd | source, kfreebsd-amd64, kfreebsd-i386
> enigmail   | 2:1.8.2-4~deb7u1 | oldoldstable       | source, amd64, armel, armhf, i386, ia64, kfreebsd-amd64, kfreebsd-i386, mips, mipsel, powerpc, s390, s390x, sparc
> enigmail   | 2:1.8.2-4~deb8u1 | oldstable          | source, amd64, arm64, armel, armhf, i386, mips, mipsel, powerpc, ppc64el, s390x

Because of the not increased version of enigmail that is breaking with
Thunderbird all users of oldstable with updated Thunderbird packages
have now a not working Enigmail extension due API incompatibilities.

We would like to prepare a new version of Thunderbird for oldstable with
a corrected version for enigmail that's breaking Thunderbird.

I've seen Daniel has prepared a new update for the enigmail package for
olsdtable that will solve the problem for users with Jessie. Daniel,
thanks for quickly working on that!

What's the opinion of the security team for another update of the
existing Thunderbird packages in oldstable?
I mean, we can't solve the problem of the needed version of Enigmail for
users of Jessie, we just can add a proper Breaks to the control file.
But doping so would need potentially somewhere manually updates on some
users side.
OTOH we can add the correct Breaks for Thunderbird with version 52.3.0
which should arrive in the next two weeks or so.

I fully agree with Daniel that the enigmail extension is some kind of
special of all the various Mozilla extensions and we should always take
care that even oldstable has a working combination of Thunderbird and
Enigmail. I think the possibility of using encryption is really
important today.
Maybe blame me as I've totally forgotten to take a deeper look at the
symbiotic relationship of Enigmail and Thunderbird after the release of
TB ESR52. But due the long standing problems we had while building
Thunderbird (mostly me have worked on that for over 2 months!) and the
end of the freeze process for Stretch has taken much energy.

We need some auto testing stuff that will help to discover such problems
early as there are also some other typical extensions that maybe break
by every new ESR version of Thunderbird.
Hopefully we find some time to talk about that all at DebCamp/DebConf?

-- 
Regards
Carsten Schoenert