imapproxy out of date

[Richard Laager]

The version of imapproxy packaged, 1.2.7, is the last released version. Unfortunately, this version is from 2010. There have been several good changes to imapproxy, but no new release has been cut. Many of these changes have security implications.

Here's a list of selected changes in chronological order:
 - Warn against using port 993
 - Fix LOGIN command so that it handles literal arguments correctly
 - Fix possible buffer overflow issue
 - Add the ability to authenticate to the IMAP server using SASL plain
 - Fix server connection starvation and synchronization issues
 - When NO or BAD response is returned from the server against a LOGIN or
   AUTHENTICATE request, we now log the full server response and pass it
   back to the client (useful if client is watching for RFC 5530 response
   codes).
 - Fix server connection synchronization issues in the SELECT cache code
 - Allow configuration setting values to contain spaces
 - Fixed problem where default TLS CA data would never be loaded
 - Fixed bug in SSL context initialization
 - Added support for up to TLS v1.2
 - Added support for ECDHE ciphers
 - Added ability to manually specify TLS ciphers
 - Added server certificate validation

The last change was in January 2014. A daily tarball is available here:
http://squirrelmail.org/download.php#imap_proxy

We have been running the code from 2014 in production since 2015, and it's been solid. Here's a link to our PPA, which has the updated version, using the daily tarball from back then:
https://launchpad.net/~wiktel/+archive/ubuntu/ppa/+packages

[Richard Laager (rlaager)]

Attached is the debdiff from another approach to updating the package. This is based off the package in Yakkety, with the imapproxy SVN changes broken out into individual patches in debian/patches. (I used git-svn + git format-patch for this, and stripped the git markings).

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "up-imapproxy_1.2.7-1.3~rlaager1.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Michael Terry (mterry)]

FYI, this is orphaned and removed from testing in Debian. I'm not sure how much effort we want to put into this without any support in Debian.

[Richard Laager (rlaager)]

If it's orphaned in Debian, the obvious answer is that I should adopt it there. I'll do that.

[Mattia Rizzolo (mapreri)]

Yes, please deal with this in Debian. Either adopt it, or do a QA upload. I see you already turned the O into an ITA, great :)

Just file an RFS as usual to get sponsored there, making sure to also add 'LP: #1614062' to the debian upload to also close this one bug with that when the package is then synced.

Unsubscribing ubuntu-sponsors for now.

[Mattia Rizzolo (mapreri)]

So, this happened in Debian, and it's now synced in Ubuntu too.
closing.