Evolution forces SHA1 cipher for PGP signatures

[Daniel Silverstone]

Binary package hint: evolution

When sending a PGP signed message in Evolution, the signature algorithm is locked down to SHA1.

With the recent concern about SHA1 signatures, many people, including myself, are migrating to new GPG keys and SHA256 or SHA512 signatures by default. However those of us who use Evolution are unable to migrate properly yet because Evolution fails us in this respect.

[Daniel Silverstone (dsilvers)]

This attached patch stops the Evolution composer from *forcing* SHA1, instead allowing camel to choose the default cipher, whatever that might be.

This does not fully solve the problem but is the first step along the way.

[Daniel Silverstone (dsilvers)]

The second half of this problem is in bug #381295

[Pedro Villavicencio (pedro)]

Thanks for the report, that's known upstream and you can track it here: http://bugzilla.gnome.org/show_bug.cgi?id=304415

[Launchpad Janitor (janitor)]

This bug was fixed in the package evolution-data-server - 2.32.0-0ubuntu1

---------------
evolution-data-server (2.32.0-0ubuntu1) natty; urgency=low

  [ Mathieu Trudel-Lapierre ]
  * Upstream release 2.32.0
    - [groupwise] EDS crashed when checking contacts (LP: #623794)
    - Do not expose off_t in public API, use goffset instead (LP: #584536)
    - Allow normal, non-vFolder, Trash and Junk folder (LP: #13983, #64762)
      (LP: #135485, #280325, #365270)
    - Corruption of mailbox and can't expunge trash (LP: #281093, #287811)
      (LP: #360667, #410723, #483058)
    - Allow change of signature hash algorithm (LP: #381290, #381295, #635937)
    - Evolution forgets password on any error (LP: #245589, #272414)
    - EContact/EVCard can re-order phone and email attributes (LP: #460255)
    - Crash in gnome_keyring_item_info_free from e-passwords.c (LP: #530760)
      (LP: #578864)
    - Properly free unused message infos periodically (LP: #507972)
    - Crash in imap_body_decode at camel-imap-utils.c:979 (LP: #554367)
    - Be able to disallow selection of a certain ESource (LP: #198392)
    - assertion failed: (reply == msg) in cs_waitinfo() (LP: #455020, #475147)
    - Use thread safe G_DEFINE_TYPE/G_DEFINE_TYPE_EXTENDED (LP: #477186)
    - Always ref returned info from message_info_from_uid (LP: #341909)
  * debian/patches/01_build_with_deprecated_symbols.patch: dropped,
    applied upstream.
  * debian/patches/01_imapx_lockup.patch: dropped, applied upstream.
  * debian/patches/60_google_backend_lookup.patch: dropped, applied upstream.
  * debian/patches/65_evolution-color.patch: seems it's no longer needed;
    color setting has been overhauled upstream and this patch won't apply
    anymore anyway.
  * debian/patches/108-git-fix-eproxy-and-https.patch: dropped, applied upstream
  * debian/patches/107-git-consider-local-inbox-as-inbox.patch: refreshed.
  * Additional dropped cherry-picked patches (now in source):
    - 102-Bug-630135-No-UI-feedback-when-imapx-connection-fail.patch
    - 103-Bug-630150-imapx-attempts-to-connect-to-server-when-.patch
    - 104-Bug-630152-imapx_parser_thread-registers-wrong-opera.patch
    - 105-Bug-629916-imapx-fails-to-handle-errors-in-imapx_com.patch
    - 106-Bug-630149-imapx_sync-never-returns-error.patch
  * update to correctly install to evolution-data-server-2.32 instead of 2.30
    in various paths:
    - debian/evolution-data-server-common.install
    - debian/libcamel1.2-dev.install
    - debian/libebackend1.2-dev.install
    - debian/libebook1.2-dev.install
    - debian/libecal1.2-dev.install
    - debian/libedata-book1.2-dev.install
    - debian/libedata-cal1.2-dev.install
    - debian/libedataserver1.2-dev.install
    - debian/libedataserverui1.2-dev.install
    - debian/libegroupwise1.2-dev.install
    - debian/libgdata1.2-dev.install
    - debian/libgdata-google1.2-dev.install
  * debian/control: the gdata stuff was moved to an external library, so
    dropping the creation of the libgdata* packages and adding Build-Depends
    and Depends for libgdata7/libgdata-dev >= 0.6.3.
  * removed debian/libgdata*.install: since it's not being built in e-d-s
    anymore, dropping these unnecessar...