[nacl] MIR

[Sebastien Bacher]

[MIR] nacl

* Availability

Built for all supported architectures. In sync with Debian.
https://launchpad.net/ubuntu/+source/nacl/20110221-6.1

* Rationale

It's an optional depends of libssh (used for curve25519) which is enabled in Debian and which we currently turn off in Ubuntu.

* Security

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=nacl
https://security-tracker.debian.org/tracker/source-package/nacl

The first url lists some results which seem to be chromium issue, there is on nacl CVE which is unfixed
https://security-tracker.debian.org/tracker/CVE-2015-0565
Debian marked is as 'unimportant'

* Quality assurance

- The desktop-packages team is going to be subscribed to the package on launchpad once security team gives a +1 (or alternative option is to send a change to Debian to disable the option on Ubuntu)

https://launchpad.net/ubuntu/+source/nacl/+bugs
https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=nacl

No bug reports

The upstream tests are done as part of the build and there is an autopkgtest.
https://autopkgtest.ubuntu.com/packages/nacl

* Dependencies

The dependencies are in main. Note that no package is going to be promoted but libssh includes a statically build copy.

* Standards compliance

4.2 standards version, debhelper compat 11, simple dh rules

* Maintenance

There is no much upstream activity. The package maintained in Debian and in sync in Ubuntu. The Desktop Team is going to be responsive to issues in Ubuntu.