1828465 - Update RNP to 0.16.3

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, enhancement)

Description

[Rob Lemley [:rjl]]

As discussed in Matrix, now that RNP 0.16.3 is out, update the in-tree copy so it's on a properly released version.

Might try getting it to work with mach vendor as well.

Comment 1

[Kai Engert [:KaiE:]]

We should accelerate this task.

In the meantime, v0.17.0 was released.
I would like comm-central to use v0.17.0 soon, but for the 102.x branch, I would prefer to remain at v0.16.x

We should start by using 0.16.3 on c-c as a first step, so it gets tested, then uplift to esr102, and then in another step, upgrade c-c to 0.17.0

Comment 2

[Kai Engert [:KaiE:]]

Something is still wrong with the update_rnp.sh script.
It still fails on the first run, second run works.

However, when running "update_rnp.sh v0.16.3" twice, I get a wrong version number.
File third_party/rnp/src/lib/version.h is changed to version number 0.17.0 which is version used on the github tip.

I suspect the update script doesn't use the version number parameter for all operations, but might use the tip sometimes.

Comment 3

[Kai Engert [:KaiE:]]

The other identifiers (github commit id) seem to be correct.
https://github.com/rnpgp/rnp/releases/tag/v0.16.3
2f2bab6

And the code in the thunderbird tree matches the code from that tag.

I'll manually fix version.h and attach that for review.

Comment 4

[Kai Engert [:KaiE:]]

Attachment: Bug 1828465 - Update to RNP version v0.16.3 . r=rjl

Comment 5

[Kai Engert [:KaiE:]]

We should also update the minimum version check to require this version.

Comment 6

[Kai Engert [:KaiE:]]

https://hg.mozilla.org/comm-central/rev/8be9354061a02366a95010d81e56c6078e12b3d0

Comment 7

[Kai Engert [:KaiE:]]

(In reply to Kai Engert (:KaiE:) from comment #5)

We should also update the minimum version check to require this version.

Reopening to track this.

Comment 8

[Kai Engert [:KaiE:]]

Attachment: Bug 1828465 - Upgrade minimum RNP version to 0.16.3. r=rjl

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/1f1e7030c02a
Upgrade minimum RNP version to 0.16.3. r=rjl

Comment 10

[Kai Engert [:KaiE:]]

Comment on attachment 9331108 [details]
Bug 1828465 - Update to RNP version v0.16.3 . r=rjl

We should pick up this updated library version, which contains security fixes. We have already cherry-picked on fix, but the library contains an additional fix, which currently has only minor relevance because of our current OpenPGP implementation.

Nevertheless, having the full update is better for consistency. And changing the minimum library version expected will help distributors learn what we're expect them to, should they distribute RNP as a separate library.

[Approval Request Comment]
Regression caused by (bug #): no
User impact if declined: none
Testing completed (on c-c, etc.): yes
Risk to taking this patch (and alternatives if risky): low

Comment 11

[Wayne Mery (:wsmwk)]

Comment on attachment 9331108 [details]
Bug 1828465 - Update to RNP version v0.16.3 . r=rjl

[Triage Comment]
Approved for esr102

Comment 12

[Wayne Mery (:wsmwk)]

Comment on attachment 9331387 [details]
Bug 1828465 - Upgrade minimum RNP version to 0.16.3. r=rjl

[Triage Comment]
Approved for esr102

Comment 13

[Rob Lemley [:rjl]]

Thunderbird 102.11.1:
https://hg.mozilla.org/releases/comm-esr102/rev/58a1f968140b
https://hg.mozilla.org/releases/comm-esr102/rev/43a0613855c6