[Pkg-mozext-maintainers] Bug#901556: enigmail contains unbuildable artifacts

[Daniel Kahn Gillmor]

Package: enigmail
Version: 2:2.0-1
Severity: serious
Tags: upstream
Justification: Policy 2.1.3 (DFSG §3)

Enigmail starting in version 2.0 contains a pre-built copy of
OpenPGP.js, without source code that can build that artifact.

The best way to handle this would be to put OpenPGP.js into debian
(see https://bugs.debian.org/787774), but i've tried to do this and
the node dependency tree is too much for me to handle.

the next-best way to handle this would be to put just the sources of
OpenPGP.js into enigmail and have the enigmail build itself generate
the necessary OpenPGP.js built artifacts.  I've tried to do this with
debian/missing-sources/ but even from there i'm unable to generate the
compiled artifacts that enigmail wants to use.  I've asked upstream
about this, and it doesn't sound feasible for them to do it upstream
either: I don't believe that upstream has ever built OpenPGP.js from
source.

The third option (which i'm pursuing now) is to strip out OpenPGP.js
from enigmail and ensure that it works with only GnuPG (it's mostly
GnuPG in the first place).

Until that's done, i don't believe enigmail is DFSG-free, because it
does not include the source code for all of its parts.

in frustration,

        --dkg

-- System Information:
Debian Release: buster/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'testing'), (500, 'oldstable'), (200, 'unstable-debug'), (200, 'unstable'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.16.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages enigmail depends on:
ii  gnupg                    2.2.8-2
ii  gnupg-agent              2.2.8-2
ii  gnupg2                   2.2.8-2
ii  gpg-agent [gnupg-agent]  2.2.8-2
ii  icedove                  1:52.4.0-1
ii  thunderbird              1:52.8.0-1

Versions of packages enigmail recommends:
ii  pinentry-gnome3 [pinentry-x11]  1.1.0-1+b1
ii  pinentry-gtk2 [pinentry-x11]    1.1.0-1+b1
ii  pinentry-qt [pinentry-x11]      1.1.0-1+b1

enigmail suggests no packages.

-- no debconf information