1848104 - Upgrade Thunderbird to use Botan version 3 (Botan 2 is EOL)

Status: NEW

(MailNews Core :: Security: OpenPGP, task, P1)

Description

[Kai Engert [:KaiE:]]

Eventually it will be necessary to upgrade Thunderbird to use version 3.x of the Botan library.

Timing is currently unknown.

Comment 1

[Kai Engert [:KaiE:]]

Attachment: WIP: Bug 1848104 - botan 3 import

Comment 2

[Rob Lemley [:rjl]]

Botan-2 reached EOL at the end of 2024. So this will definitely need to be worked on in the next few months.

Comment 3

[Rob Lemley [:rjl]]

Hit a snag.
Botan 3 uses c++20 standard. Unfortunately, the Linux builds currently are on gcc 8 with its libstdc++ (#include <span> came up first when compiling)... <span> is not available until gcc-10.1

Easiest option is to update the sysroot used to compile Thunderbird. That would mean dropping support for older Linux distributions.

Notably:

Ubuntu 20.04LTS - 2025-04
Rocky 8 - 2024-04
OpenSUSE Leap 15 (uses gcc-7!!)

Comment 4

[Kai Engert [:KaiE:]]

(In reply to Rob Lemley [:rjl] from comment #2)

Botan-2 reached EOL at the end of 2024. So this will definitely need to be worked on in the next few months.

Given this EOL plan, we should upgrade Daily to Botan 3 soon.

Distributions will have to find ways to build.
They might be able to bring in a more modern compiler, using an optional package, for building Botan.

Comment 5

[Rob Lemley [:rjl]]

Attachment: WIP: Bug 1848104 - Add Botan moz.yaml for vendoring.

Comment 6

[Rob Lemley [:rjl]]

I have Botan 3.5 building with an updated Linux sysroot based on Debian Bullseye. The sysroot is not final yet, but it's not needed for local builds. I have a little more to sort out tomorrow with my patches. The Botan patch is too big for phab; I need to trim it down more and split it up first.

Comment 7

[Magnus Melin [:mkmelin]]

https://botan.randombit.net/#botan2 is EOL now. Seems we need to urgently update our version.

Comment 9

[Kai Engert [:KaiE:]]

Rob, is it possible to give this a higher priority?
Based on comment 6 I understand you're already working on it, so assigning it to you.