Bug#704180: Use p11-kit to replace nssckbi

2021-02-07 Thread Holger Fischer
Hi, Bullseye will be frozen soon. Let's manage to get this sorted out b4 😀️. What is the status here. How can I help to get this feature implemented. BTW: I think #926388 is a duplicate BR DI(FH) Holger Fischer, MSc

Bug#704180: Use p11-kit to replace nssckbi

2019-01-14 Thread David Woodhouse
On Mon, 2019-01-14 at 10:33 -0500, Daniel Kahn Gillmor wrote: > On Sun 2019-01-13 19:07:42 +0100, Andreas Metzler wrote: > > The coding would be straightforward afaict. > > > > https://salsa.debian.org/gnutls-team/p11-kit/commits/tmp-704180-divertnss > > I like the looks of this, though perhaps w

Bug#704180: Use p11-kit to replace nssckbi

2019-01-14 Thread Daniel Kahn Gillmor
On Sun 2019-01-13 20:40:08 +0100, Laurent Bigonville wrote: > The problem is that if nothing is pulling the new package in the default > installation, nobody will ever use it. hm, this is true, but it's also likely to be true for a non-default debconf choice as well, right? most people keep thei

Bug#704180: Use p11-kit to replace nssckbi

2019-01-14 Thread Daniel Kahn Gillmor
On Sun 2019-01-13 19:07:42 +0100, Andreas Metzler wrote: > The coding would be straightforward afaict. > > https://salsa.debian.org/gnutls-team/p11-kit/commits/tmp-704180-divertnss I like the looks of this, though perhaps we want to name the new package p11-kit-trust to be more in line with the na

Bug#704180: Use p11-kit to replace nssckbi

2019-01-13 Thread Laurent Bigonville
Le 11/01/19 à 18:28, Daniel Kahn Gillmor a écrit : On Fri 2019-01-11 18:17:26 +0100, Laurent Bigonville wrote: The problem is what/who will decide if this package is installed? If that package is being pulled by on other package for some reason, that means that the local administrator will not b

Bug#704180: Use p11-kit to replace nssckbi

2019-01-13 Thread Andreas Metzler
On 2019-01-11 Daniel Kahn Gillmor wrote: > On Thu 2019-01-10 21:48:22 +, David Woodhouse wrote: >> On Thu, 2019-01-10 at 15:53 -0500, Daniel Kahn Gillmor wrote: >>> what's the advantage of using alternatives instead of a package- >>> specific displacement? >> None really, as long as you put i

Bug#704180: Use p11-kit to replace nssckbi

2019-01-11 Thread Daniel Kahn Gillmor
On Fri 2019-01-11 18:17:26 +0100, Laurent Bigonville wrote: > The problem is what/who will decide if this package is installed? If > that package is being pulled by on other package for some reason, that > means that the local administrator will not be able to revert the > decision of the packag

Bug#704180: Use p11-kit to replace nssckbi

2019-01-11 Thread Laurent Bigonville
Le 11/01/19 à 17:17, Daniel Kahn Gillmor a écrit : On Thu 2019-01-10 21:48:22 +, David Woodhouse wrote: On Thu, 2019-01-10 at 15:53 -0500, Daniel Kahn Gillmor wrote: what's the advantage of using alternatives instead of a package- specific displacement? None really, as long as you put it i

Bug#704180: Use p11-kit to replace nssckbi

2019-01-11 Thread Daniel Kahn Gillmor
On Thu 2019-01-10 21:48:22 +, David Woodhouse wrote: > On Thu, 2019-01-10 at 15:53 -0500, Daniel Kahn Gillmor wrote: >> what's the advantage of using alternatives instead of a package- >> specific displacement? > > None really, as long as you put it in a separate p11-kit-trust package > as Fed

Bug#704180: Use p11-kit to replace nssckbi

2019-01-11 Thread Daniel Kahn Gillmor
On Fri 2019-01-11 08:09:02 +, David Woodhouse wrote: > Looking back, I see this bug was opened with the comment "With the > recent switch of wheezy-security's iceweasel to using the > embedded copy of nss..." > > That was 2014 though. Is it no longer the case? i can confirm that it is no longe

Bug#704180: Use p11-kit to replace nssckbi

2019-01-11 Thread David Woodhouse
On Thu, 2019-01-10 at 19:14 +0100, Laurent Bigonville wrote: > > However, am I right in thinking that we have multiple packages all > > shipping their *own* special version of the NSS libraries, instead of > > using the system one? Each instance of libnssckbi.so (in firefox, > > thunderbird, etc.)

Bug#704180: Use p11-kit to replace nssckbi

2019-01-10 Thread David Woodhouse
On Thu, 2019-01-10 at 15:53 -0500, Daniel Kahn Gillmor wrote: > what's the advantage of using alternatives instead of a package- > specific displacement? None really, as long as you put it in a separate p11-kit-trust package as Fedora/RHEL do. You don't want installation of the p11-kit package i

Bug#704180: Use p11-kit to replace nssckbi

2019-01-10 Thread Daniel Kahn Gillmor
On Thu 2019-01-10 19:14:06 +0100, Laurent Bigonville wrote: > If I'm searching for a file called libnssckbi.so in the archive, the > only other occurrence is in package libapache2-mod-nss. afaict, that's just a symlink: etc/apache2/nssdb/libnssckbi.so -> /usr/lib/$ARCH_TRIPLET/nss/libnssckbi

Bug#704180: Use p11-kit to replace nssckbi

2019-01-10 Thread David Woodhouse
On Wed, 2019-01-09 at 14:04 -0500, Daniel Kahn Gillmor wrote: > On Wed 2019-01-09 16:39:36 +0100, Laurent Bigonville wrote: > > So what is the status of this? > > > > In RHEL 7 they made the switch to p11-kit and libnssckbi.so is an > > alternative between the file shipped by nss and p11-kit-trus

Bug#704180: Use p11-kit to replace nssckbi

2019-01-10 Thread Laurent Bigonville
Le 10/01/19 à 19:03, David Woodhouse a écrit : On Wed, 2019-01-09 at 14:04 -0500, Daniel Kahn Gillmor wrote: On Wed 2019-01-09 16:39:36 +0100, Laurent Bigonville wrote: So what is the status of this? In RHEL 7 they made the switch to p11-kit and libnssckbi.so is an alternative between the file

Bug#704180: Use p11-kit to replace nssckbi

2019-01-09 Thread Daniel Kahn Gillmor
On Wed 2019-01-09 16:39:36 +0100, Laurent Bigonville wrote: > So what is the status of this? > > In RHEL 7 they made the switch to p11-kit and libnssckbi.so is an > alternative between the file shipped by nss and p11-kit-trust.so shipped > by p11-kit (with p11-kit version being the default). > >

Bug#704180: Use p11-kit to replace nssckbi

2019-01-09 Thread Laurent Bigonville
Hello, So what is the status of this? In RHEL 7 they made the switch to p11-kit and libnssckbi.so is an alternative between the file shipped by nss and p11-kit-trust.so shipped by p11-kit (with p11-kit version being the default). Should we switch debian by default to p11-kit as well?