Please remove electrum from the archive

[Thomas Ward]

This is a request for BLACKLISTING and REMOVAL of the Electrum Bitcoin Wallet program from the repositories.

This request comes with the following considerations:
(1) The Electrum Wallet upstream latest release is 2.4. The version in all our repositories are at least one year old.

(2) Debian has identified issues with the 2.0+ code which prevents updating, including but not limited to (please refer to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792231#22) :
    (a) tlslite dependency for the package and code was removed
    (b) 2.0+ code has poor handling of certificate verification, including not verifying the use purpose of a certificate, meaning there is an MITM vector when it reaches out to Electrum servers.

(3) There were multiple additional changes in 2.0+ which can break reverse compatibility, including:
    (a) A bitcoin blockchain soft-fork on July 4th, 2015, which only the newer Electrum versions know about.
    (b) There are significant client-to-server communication improvements, security, and bug fixes, which only exist in the 2.0+ code.
    (c) Wallet seed codes from newer versions cannot work with the older versions that exist.

After a discussion in #ubuntu-motu with Iain Lane, he suggested poking the security team. After further discussion in #ubuntu-hardened with Steve Beattie, and Seth Arnold, briefly, upon which I said it was my belief it should be removed from Wily and a sync blacklist imposed, it was said by Steve Beattie that it seems a sensible course of action to remove Electrum from Wily and impose a sync blacklist.

There are no reverse dependencies, nor reverse build dependencies that I could identify.

[Thomas Ward (teward)]

Additional discussion with infinity (Adam Conrad) has led to the point that we should probably dummy-out the prior versions for a similar reason we did the `bitcoin` source package.

Note that I intend to do that as an SRU, but I have other priorities on my list for now.

[Adam Conrad (adconrad)]

Removing packages from wily:
 electrum 1.9.8-4 in wily
  electrum 1.9.8-4 in wily amd64
  electrum 1.9.8-4 in wily arm64
  electrum 1.9.8-4 in wily armhf
  electrum 1.9.8-4 in wily i386
  electrum 1.9.8-4 in wily powerpc
  electrum 1.9.8-4 in wily ppc64el
  python-electrum 1.9.8-4 in wily amd64
  python-electrum 1.9.8-4 in wily arm64
  python-electrum 1.9.8-4 in wily armhf
  python-electrum 1.9.8-4 in wily i386
  python-electrum 1.9.8-4 in wily powerpc
  python-electrum 1.9.8-4 in wily ppc64el
Comment: See LP: #1481033
Remove [y|N]? y
1 package successfully removed.

Also blacklisted.

[Thomas Ward (teward)]

An update:

The better reason, now, after discussion with Adam Conrad is, that "This program, similar to the Bitcoin package, will have changes which break reverse compatibility with older versions. While they do not have changes as frequently as Bitcoin which would break reverse functionality, the current delta between the versions in Ubuntu and versions in Debian Unstable poses an incompatibility problem. It is also very likely that there will be similar incompatibilities in the future as the electrum program, and the Bitcoin network, change."

To that end, we should still blacklist and remove the package, because there will be future reverse-incompatible breakages.

[Thomas Ward (teward)]

Attached here is a debdiff for retroactive 'nullification' of the package for electrum, for Trusty. Precedent for this exists because of the removal of the 'bitcoin' package which was a similar situation of new versions breaking reverse compatibility, and as the network evolves older software versions are obsoleted and become incompatible with newer requirements.

[Mathew Hodson (mhodson)]

Bug #1499094 was also reported. It seems like it is just a duplicate of this bug.

[Thomas Ward (teward)]

After discussion with Adam Conrad of the team governing this bug is being considered as a different request in a different category and is being handled as such (standard triage procedures are not applicable in this case). Blacklisting and removing a package in a devel release has a different handling procedure than SRUs that make a 'dummy' package take place of an existing one and is a sort of special case, as I understand it (based on discussions with Adam Conrad).

In either case, do not mark this bug as a duplicate of the related bug - this is being considered as a separate (but related) bug with different handling criterion than the bug you marked this one a dupe of. (Adam Conrad unduped this bug after he and I discussed in #ubuntu-release on IRC)

[Thomas Ward (teward)]

And I forgot to put a vivid debdiff here. I'll go poke that now...

[Thomas Ward (teward)]

Oop, wait, i'm a little confused with two bugs. This one, regarding blacklisting and removal is different from the SRU-like replace-with-dummy-packages one you've linked, Mathew. They're handled differently in this case.

[Didier Roche-Tolomelli (didrocks)]

I just removed the "trusty" task on this bug as it's handled as a SRU as you said (so that this bug is completely closed)