Please merge Torbutton 1.2.0~rc5-1 (universe) from Debian unstable (main)

Debian->Ubuntu debdiff. Subscribing u-u-s for Sponsorship.

Unsubscribing u-u-s, pending an ack from Mozilla Extensions Team.
(Big) David, resubscribe u-u-s once acked. ;)

Hello David,

We're not shipping Iceweasel, so you can safely remove iceweasel dependency. We're also trying not to mention Iceweasel and Icedove in Description fields, in order not to confuse users. Changing Iceweasel to Firefox and Icedove to Thunderbird would be nice.
You don't need to remove a part of description. It's usable, and by removing it we are making diff bigger than needed.
You don't need to create usr/lib/iceweasel/extensions dir in torbutton-extension.dirs file, and link it in torbutton-extension.links file.

Also, it looks like iceweasel-torbutton.* files are still in the debian/ dir. I think they are useless, since that package doesn't exist. I'll ask for another opinion. As far as I can see, you should remove them.

The rest looks good.

Hello David,

Few more corrections are needed. src/install.rdf mentions that torbutton is compatible with Firefox 2 - 3.0a1pre. Please try to bump maxVersion for Firefox to 3.* in install.rdf and test if it works well in Firefox 3. If it doesn't we need to remove firefox package from Depends, as it provides Firefox 3.

Also, you should add possible firefox-2 dependency, since that is the name of the package that provides Firefox 2. So, possible version of Depends line are:

firefox | firefox-3.0 | firefox-2 - in case it works both with Firefox 3 and 2
firefox-2 - in case it's not working with latest Firefox 3 in intrepid.

Thunderbird dependency should be dropped. It seems that this extensions is compatible with TB up to 1.5 version. Intrepid currently ships Thunderbird 2, so this extension won't work in it.

Please make additional changes in torbutton-extensions.dirs and torbutton-extension.links file, which will reflect the changes in Depends. Firefox 2 extensions are in /usr/lib/firefox/extensions and Firefox 3 extensions are in /usr/lib/firefox-addons/extensions, so be sure to use that directories in .links file.

Thank you for your work on this package.

Thanks for taking the time to review this, but due to lack of time and lack of knowledge of mozilla extensions, I am going to leave this to someone to do properly. Marking as incomplete. Thanks again!

Actually, it says 3.1a1pre not 3.0a1pre, so Firefox 3 works. This version closes a bug in Debian about that torbutton was missing Firefox 3 support. (See the changelog)

David: is that enough to get you started again or should I give it a try?

@Sveinung: I think you should give it a try. I am really busy at the moment so dont have enough time to do it proper justice

I have made a try here. I also changed the changelog to be more
readable, reflect what was removed and to give you credit since your
name would not appear in the "Changed by" line.

Please note that I have never merged a package from Debian to Ubuntu
(and included old Ubuntu changes) before, so it might be a good idea
to check it more than usual. When that is said it appears to be
Lintian clean, I was able to build it under Intrepid and when I tested
it on check.torproject.net (in hardy) it worked.

Changeing status back to In Progress and assigning to me since I have made a try.

Hello Sveinung,

I have look into this debdiff and it looks good. The needed changes
are mostly correction of typos and maybe rewording in changelog entry
in order to make it more clear:

1.) I would change "debian/iceweasel-torbutton.* are still
debian/firefox-torbutton.*". In previous upload, we changed them to
torbutton-extension.*, so you can keep that message:
* Modification of debian/iceweasel-torbutton.dirs,
  debian/iceweasel-torbutton.install and debian/iceweasel-torbutton.links
  to take into account firefox extensions directory and renaming them
  to the new binary package schema (torbutton-extension.*)
In this upload, we are removing iceweasel-torbutton.*, so that
shouldn't be mentioned in "Remaining Ubuntu changes" part, but as a
new change:
* Remove iceweasel-torbutton.*, since Ubuntu doesn't ship Iceweasel

2.) "Link into where Firefox, not Iceweacel, looks" has a typo. Should
be "Iceweasel"

3.) "Depend on Firfox 3 and 2 instead of Iceweacel" has typos. Should
be "Firefox" and "Iceweasel". Also, I think it's correct to say
"Firefox 3 or 2", instead of using "and".

4.) Check if the debdiff has an empty line at the end (line #162). If
it has, please remove it.

Thank you for your work :).

> 1.) I would change "debian/iceweasel-torbutton.* are still
> debian/firefox-torbutton.*". In previous upload, we changed them to
> torbutton-extension.*, so you can keep that message:
> * Modification of debian/iceweasel-torbutton.dirs,
> debian/iceweasel-torbutton.install and debian/iceweasel-torbutton.links
> to take into account firefox extensions directory and renaming them
> to the new binary package schema (torbutton-extension.*)
> In this upload, we are removing iceweasel-torbutton.*, so that
> shouldn't be mentioned in "Remaining Ubuntu changes" part, but as a
> new change:
> * Remove iceweasel-torbutton.*, since Ubuntu doesn't ship Iceweasel
Not sure if I understood that one correct. If iceweasel-torbutton.*
already have been moved (in a previous Ubuntu version), how can you
remove it now but keep its new location? Isn't that a remaining change
from Ubuntu? I did add those entries to the changelog anyway, since it
could be you wanted to record the changes in this from the new Debian
AND from the old Ubuntu package, but it would be nice to know if I
understood you correct.

> 2.) "Link into where Firefox, not Iceweacel, looks" has a typo. Should
> be "Iceweasel"
>
> 3.) "Depend on Firfox 3 and 2 instead of Iceweacel" has typos. Should
> be "Firefox" and "Iceweasel". Also, I think it's correct to say
> "Firefox 3 or 2", instead of using "and".
Fixed. (Sorry about those. I believed that Lintian included a spell checker)

> 4.) Check if the debdiff has an empty line at the end (line #162). If
> it has, please remove it.
Removed

Thank you for your review :)
Sveinung Kvilhaugsvik

Looks good. Ack from Mozilla Extensions team. Please resubscribe ubuntu-universe-sponsors, unassign yourself and set the status to "Confirmed". Thanks for the merge :).

About the change for iceweasel-torbutton.* and torbutton-extension.*... Moving of iceweasel-torbutton.* to torbutton-extension.* happened in the previous upload, so that is fine to keep it in remaining Ubuntu changes. But, according to previous changelog entry there were still iceweasel-torbutton.* files, which we removed now. That's why I asked you to indicate that as a new change :).

Torbutton 1.2.0 is now in Debian. Should I try to merge the new version instead?

I have attached a debdiff against the new version if it is preferred.
It works on
my Hardy system (tested at http://check.torproject.net/).

Hi,

Unfortunately your merge of 1.2.0 doesn't appear to be attached
to the bug, so I can't review it.

Also, we are now in feature freeze, so I think that this will need
a feature freeze exception. Compatibility with the only version of
firefox it is planned to ship in Intrepid is a pretty compelling reason
though. Please follow the process described at

  https://wiki.ubuntu.com/FreezeExceptionProcess

to request the exception.

Thanks,

James

> Unfortunately your merge of 1.2.0 doesn't appear to be attached
> to the bug, so I can't review it.
Ops! Sorry about that. Here it it is.

Thanks,

Are you going to apply for a feature freeze exception?

Thanks,

James

> Are you going to apply for a feature freeze exception?
Yes, but I'm not sure I will have time to do it before after the weekend.

In case anyone else wants to file one before that: feature list
(upstreams): https://svn.torproject.org/svn/torbutton/trunk/src/CHANGELOG
(also attached)

Seems like Torbutton have changed in Ubuntu since I made my debdiff.
Here is a new one where I have tried to merge the Ubuntu changes.
(Added abrowser as a dependency to control and added the changelog
entry)

Debdiff from the version currently in Intrepid (1.0.4-3ubuntu2) and
diffstat on it.

The new version of Torbutton will work with Firefox 3. It has
additional features like blocking scripts and plugins that could leak
traffic from Tor. This avoids people listening to the connection or at
the destination to figure out the real IP.

This change will support Firefox 3. There's no Firefox 2 in Intrepid.
Also it give enhanced security. (See above)

It lacks Thunderbird support unlike the old one.

Testing:
* I am currently using this. It works fine.
http://check.torproject.net/ confirms I am using Tor
* I have attached the buildlog from pbuilder as buildlog.txt
* It installs without problems on my system.
* It works. Attached screenshot as proof

Install log:
# dpkg -i /var/cache/pbuilder/intrepid-amd64/result/torbutton-extension_1.2.0-1ubuntu1_all.deb
(Les database ... 217332 filer og katalogar er installerte.)
Gjer klar til å byta ut torbutton-extension 1.2.0-1ubuntu1 (ved bruk av .../torbutton-extension_1.2.0-1ubuntu1_all.deb) ...
Pakkar ut erstattinga torbutton-extension ...
Set opp torbutton-extension (1.2.0-1ubuntu1) ...

I am not able to find any Ubuntu specific changes to strings. I have an extremely limited understanding of the Ubuntu process, but I guess this means that an UserInterfaceFreeze Exception is not required. In case it is: There are changes in the user interface when it comes to configure the new features. But as previously said: the alternative is to have a Torbutton that don't work with Firefox.

Is this enough information to apply for a feature freeze exception? If it is, should it be done now or after my changes are reviewed?

On Sun, 2008-10-05 at 18:04 +0000, Sveinung Kvilhaugsvik wrote:
> Is this enough information to apply for a feature freeze exception? If
> it is, should it be done now or after my changes are reviewed?

The release team will review the changes as they decide whether to
grant the exception.

Please subscribe motu-release and they will review your request.

Thanks,

James

motu-release ack #1 from me.

If torbutton isnt maintained in the firefox-extensions project bzr
repository on launchpad yet, go ahead.

On Mon, Oct 06, 2008 at 01:34:53PM -0000, Cesare Tirabassi wrote:
> motu-release ack #1 from me.
>
> ** Changed in: torbutton (Ubuntu)
> Status: Confirmed => New
>

 - Alexander

It's not.

James

ACK #2, FFe granted.

This bug was fixed in the package torbutton - 1.2.0-1ubuntu1

---------------
torbutton (1.2.0-1ubuntu1) intrepid; urgency=low

  [ David Futcher and Sveinung Kvilhaugsvik ]
  * Merge from Debian unstable. (LP: #247867)
    Remaining Ubuntu changes:
    - Modified Ubuntu maintainer field
    - Modification of debian/iceweasel-torbutton.dirs,
      debian/iceweasel-torbutton.install and debian/iceweasel-torbutton.links
      to take into account firefox extensions directory and renaming them
      to the new binary package schema (torbutton-extension.*)
    - Change of the description to reflect the firefox compatibility
    - Binary package name stays 'torbutton-extension'
    - Link into where Firefox, not Iceweasel, looks
  * Depend on Firefox 3 or 2 instead of Iceweasel
  * Removed Thunderbird stuff from Ubuntu since Thunderbird is no longer
    supported
  * Remove iceweasel-torbutton.*, since Ubuntu doesn't ship Iceweasel

torbutton (1.2.0-1) unstable; urgency=low

  * New upstream version.
  * Bump Standards-Version to 3.8.0, no further changes required.
  * Fix upstream version mangling in watch file. (Closes: #493902)
  * Ship upstream README file.

torbutton (1.2.0~rc5-1) unstable; urgency=low

  * New upstream release:
    - adds compatibility with iceweasel 3.0 (Closes: #488341)
    - remove compatibility with icedove, so drop the icedove-torbutton
      package.
  * Update get-orig-source target to use the new upstream repository
    (using svn).
  * Add a watch file.
  * Point Homepage to its new location.
  * Modify the Description to reflect new features.
  * Add a debian/README.source file describing get-orig-source.
  * Add XS-Vcs-* fields now that the package is in collab-maint.
  * Update debian/copyright.
  * Many thanks to Arnaud Renevier for his work on this release!

 -- Sveinung Kvilhaugsvik <email address hidden> Mon, 11 Aug 2008 01:36:16 +0200

What about Hardy? It's a security issue, it really needs to be fixed there...

On 02/05/2009 07:07 AM, Michał Gołębiowski wrote:
> What about Hardy? It's a security issue, it really needs to be fixed
> there...
>

I dont see anything that states its a security release. Can you please
provide the bug # and links. Dont forget we can always back port it to
Hardy, however i cant find any security fixes.

--
Sincerely Yours,
    John Vivirito

https://launchpad.net/~gnomefreak
https://wiki.ubuntu.com/JohnVivirito
Linux User# 414246

"How can i get lost, if i have no where to go"
    -- Metallica from Unforgiven III

It's connected to this bug: https://bugs.launchpad.net/ubuntu/+source/torbutton/+bug/273027
Hardy's torbutton-extension package is too old, and therefore not compatible with Firefox 3.

Maybe I used wrong words, it's not about the security of the system, but of the single person that wants more privacy, which is sometimes important. They install the package and they can think they're save, whereas it doesn't work at all.

Even if the 'security' word is inappropriate, I believe it should be backported, as the current Hardy's package is simply useless.

On 02/05/2009 08:26 AM, Michał Gołębiowski wrote:
> It's connected to this bug: https://bugs.launchpad.net/ubuntu/+source/torbutton/+bug/273027
> Hardy's torbutton-extension package is too old, and therefore not compatible with Firefox 3.
>
> Maybe I used wrong words, it's not about the security of the system, but
> of the single person that wants more privacy, which is sometimes
> important. They install the package and they can think they're save,
> whereas it doesn't work at all.
>
> Even if the 'security' word is inappropriate, I believe it should be
> backported, as the current Hardy's package is simply useless.
>
This should be a fairly minor change in the version in Hardy but i agree
maybe we should backport current stable release the release that is used
in the bug report is not stable or we wait until final release of this
tor version. I would rather we didnt introduce bugs to a LTS release if
we can avoid it.

--
Sincerely Yours,
    John Vivirito

https://launchpad.net/~gnomefreak
https://wiki.ubuntu.com/JohnVivirito
Linux User# 414246

"How can i get lost, if i have no where to go"
    -- Metallica from Unforgiven III

The current version of Debian's iceweasel-torbutton package is 1.2.0-1, so I suppose it's stable.

Should I file another bug connected to Hardy's torbutton-extension version?

On 02/05/2009 03:00 PM, Michał Gołębiowski wrote:
Looks like it was fixed already. see comment:
https://bugs.edge.launchpad.net/ubuntu/+source/torbutton/+bug/247867/comments/29

--
Sincerely Yours,
    John Vivirito

https://launchpad.net/~gnomefreak
https://wiki.ubuntu.com/JohnVivirito
Linux User# 414246

"How can i get lost, if i have no where to go"
    -- Metallica from Unforgiven III

@John Vivirito
No, it's fixed in Intrepid and I'm talking about Hardy...

On Fri, Feb 06, 2009 at 05:52:27PM -0000, Michał Gołębiowski wrote:
> @John Vivirito
> No, it's fixed in Intrepid and I'm talking about Hardy...
>

we dont add new upstream versions to already released ubuntu
versions. You can try to get a backport in ubuntu-backports
though. See: https://wiki.ubuntu.com/UbuntuBackports

 - Alexander

@Alexander Sack
So I suppose the older version should be fixed in repositories? It can be harder than just upgrading to the new one.

I don't think that keeping in repositories completely unusable packages is a good idea...