[Pkg-privacy-maintainers] obfs4proxy update & backport

[Ana Custura]

Hi all,

I've had a look at obfs4proxy. The current upstream version is 0.0.11.
However, starting with version 0.0.9, it depends on uTLS, a fork of a
fork of the go tls library not packaged in Debian [1].

For now I've prepared an upload for version 0.0.8, with several updates
to the packaging [2]. This version includes some bugfixes over 0.0.7,
it's probably still worth doing a backport for any bridge operators. If
anyone could review it, it would be much appreciated!

We have 2 options going forward: we can package yawning's fork of uTLS
or we can drop meek-lite support from the obfs4proxy package. We need to
carefully consider this, as it is the only meek client currently
packaged in Debian. I have built a package that drops meek-lite support
(which is easily disabled) of version 0.0.11.

There are some licensing issues that need to be resolved with yawning's
fork of uTLS [3] before we consider looking at packaging it.

Ana

[1] https://gitlab.com/yawning/utls

[2] https://mentors.debian.net/package/obfs4proxy

[3] https://gitlab.com/yawning/utls#why-dont-you-upstream-the-changes

On 13/07/2019 15:17, Ulrike Uhlig wrote:
> Hi!
>
> I'm currently at the Tor meeting in Stockholm and learnt that Tor would
> like to take better care of the bridges running obfs4. In order to do
> that they need obfs4proxy to be a bit more up-to-date in Debian
> (otherwise bridge operators do horrible things like installing it from
> Git and never seeing any updates, bah!).
>
> It looks like Michael Stapelberg was the one taking care of this package
> last (in 2018), while uploaders are still Lunar and Ximin. I was
> wondering if
>
> - Michael: you'd like to update that package to the current upstream
>   version
> - others from the privacy team want to go ahead and do that update as
>   part of a team upload
> - Lunar and Ximin (last uploads in 2016) would like to be deleted from
>   the Uploader field.
>
> Ana Custura proposed her help by maintaining a backport.
>
> What do you all think about that?
>
> Cheers!
> Ulrike

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-privacy-maintainers/attachments/20190718/6a131a64/attachment-0001.sig>