[Pkg-privacy-maintainers] obfs4proxy update & backport

[Ulrike Uhlig]

Hi Ana,

I've been wanting to reply since July, but I was not able to do that, sorry!

On 18.07.19 19:54, Ana Custura wrote:
> I've had a look at obfs4proxy. The current upstream version is 0.0.11.

Thank you!

> However, starting with version 0.0.9, it depends on uTLS, a fork of a
> fork of the go tls library not packaged in Debian [1].
> 
> For now I've prepared an upload for version 0.0.8, with several updates
> to the packaging [2]. This version includes some bugfixes over 0.0.7,
> it's probably still worth doing a backport for any bridge operators. If
> anyone could review it, it would be much appreciated!

That's great, thank you. I'm not sure I can help with the review. Is
anybody else up for it? Could you provide a link to your work repository
maybe?

> We have 2 options going forward: we can package yawning's fork of uTLS
> or we can drop meek-lite support from the obfs4proxy package. We need to
> carefully consider this, as it is the only meek client currently
> packaged in Debian. I have built a package that drops meek-lite support
> (which is easily disabled) of version 0.0.11.

Could this be uploaded to experimental?

> There are some licensing issues that need to be resolved with yawning's
> fork of uTLS [3] before we consider looking at packaging it.

I understand that yawning's code is released under GnuGPL v3, while the
original code is BSD3 Clause "New" [4].

I would need to look into this more in detail, would you like me to do that?

Cheers,
ulrike

> [1] https://gitlab.com/yawning/utls
> [2] https://mentors.debian.net/package/obfs4proxy
> [3] https://gitlab.com/yawning/utls#why-dont-you-upstream-the-changes

[4] https://github.com/refraction-networking/utls/blob/master/LICENSE