Evolution data server (libcamel) can only use SHA-1 as hash

[Daniel Silverstone]

Binary package hint: evolution-data-server

Binary package hint: libcamel-provider-1.2

When sending a PGP signed message in Evolution, the signature algorithm is locked down to SHA1.

With the recent concern about SHA1 signatures, many people, including myself, are migrating to new GPG keys and SHA256 or SHA512 signatures by default. However those of us who use Evolution are unable to migrate properly yet because Evolution fails us in this respect.

Bug #381290 contains a patch to stop Evolution's composer locking it down to SHA1, but camel is unable to use the SHA2 family of hashes.

The attached patch adds support for the SHA2 family of hashes and makes SHA256 the default hash.

[C de-Avillez (hggdh2)]

Setting Triaged/WishList, and adding the same upstream link as in bug 381290. Upstream would be the best place to discuss this, byt the way.

There is at least only point here, though: if the GNUpg/PGP key to be used is a DSA key, then the hash will still be just 160 bits long. Only DSA2 or RSA allows for larger hashes. It is uncertain if there would be a real gain in this case.

[Daniel Silverstone (dsilvers)]

The important thing here is that security is one of the few areas where it isn't safe to provide "one-size-fits-all" because people have differing requirements. By allowing evolution (and libcamel) to cope with the other micalgs it at least can coexist usefully with the PGP requirements of others. I'd settle for a variant which runs gpg and then determines what kind of signature it made, before filling out the micalg field; unfortunately that requires a larger change than the one attached.

[Launchpad Janitor (janitor)]

This bug was fixed in the package evolution-data-server - 2.32.0-0ubuntu1

---------------
evolution-data-server (2.32.0-0ubuntu1) natty; urgency=low

  [ Mathieu Trudel-Lapierre ]
  * Upstream release 2.32.0
    - [groupwise] EDS crashed when checking contacts (LP: #623794)
    - Do not expose off_t in public API, use goffset instead (LP: #584536)
    - Allow normal, non-vFolder, Trash and Junk folder (LP: #13983, #64762)
      (LP: #135485, #280325, #365270)
    - Corruption of mailbox and can't expunge trash (LP: #281093, #287811)
      (LP: #360667, #410723, #483058)
    - Allow change of signature hash algorithm (LP: #381290, #381295, #635937)
    - Evolution forgets password on any error (LP: #245589, #272414)
    - EContact/EVCard can re-order phone and email attributes (LP: #460255)
    - Crash in gnome_keyring_item_info_free from e-passwords.c (LP: #530760)
      (LP: #578864)
    - Properly free unused message infos periodically (LP: #507972)
    - Crash in imap_body_decode at camel-imap-utils.c:979 (LP: #554367)
    - Be able to disallow selection of a certain ESource (LP: #198392)
    - assertion failed: (reply == msg) in cs_waitinfo() (LP: #455020, #475147)
    - Use thread safe G_DEFINE_TYPE/G_DEFINE_TYPE_EXTENDED (LP: #477186)
    - Always ref returned info from message_info_from_uid (LP: #341909)
  * debian/patches/01_build_with_deprecated_symbols.patch: dropped,
    applied upstream.
  * debian/patches/01_imapx_lockup.patch: dropped, applied upstream.
  * debian/patches/60_google_backend_lookup.patch: dropped, applied upstream.
  * debian/patches/65_evolution-color.patch: seems it's no longer needed;
    color setting has been overhauled upstream and this patch won't apply
    anymore anyway.
  * debian/patches/108-git-fix-eproxy-and-https.patch: dropped, applied upstream
  * debian/patches/107-git-consider-local-inbox-as-inbox.patch: refreshed.
  * Additional dropped cherry-picked patches (now in source):
    - 102-Bug-630135-No-UI-feedback-when-imapx-connection-fail.patch
    - 103-Bug-630150-imapx-attempts-to-connect-to-server-when-.patch
    - 104-Bug-630152-imapx_parser_thread-registers-wrong-opera.patch
    - 105-Bug-629916-imapx-fails-to-handle-errors-in-imapx_com.patch
    - 106-Bug-630149-imapx_sync-never-returns-error.patch
  * update to correctly install to evolution-data-server-2.32 instead of 2.30
    in various paths:
    - debian/evolution-data-server-common.install
    - debian/libcamel1.2-dev.install
    - debian/libebackend1.2-dev.install
    - debian/libebook1.2-dev.install
    - debian/libecal1.2-dev.install
    - debian/libedata-book1.2-dev.install
    - debian/libedata-cal1.2-dev.install
    - debian/libedataserver1.2-dev.install
    - debian/libedataserverui1.2-dev.install
    - debian/libegroupwise1.2-dev.install
    - debian/libgdata1.2-dev.install
    - debian/libgdata-google1.2-dev.install
  * debian/control: the gdata stuff was moved to an external library, so
    dropping the creation of the libgdata* packages and adding Build-Depends
    and Depends for libgdata7/libgdata-dev >= 0.6.3.
  * removed debian/libgdata*.install: since it's not being built in e-d-s
    anymore, dropping these unnecessar...