Bugzilla Bug 18142

Yesterday a new version of balsa was released including a security fix which is
related to rmutts recent buffer overflow, as balsa uses libmutt. I think this
should be worth the immediate upgrade in portage.
I made an ebuild based on the curren 2.0.9 one including support for the new
GPG-feature through the "crypt" USE variable.

Not sure what priority to give it, so I'll stick to "enhancement".
Balsa 1.4 is also affected by the buffer overflow, but portage is way behind
here, the new version is 1.4.3, but I can't test it as I have none of the
related Gnome1-stuff.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Created an attachment (id=9792) [details]
the new ebuild

reporter sorry this took like forever again. Both versions added to ~ . Arch
please test and move to stable respective versions for your arch, so i can
close this one.

I'm running it for a month now with absolutely no problems new in this version
compared to 2.0.9, diplomaticly said. :)
GPG-support is primitive for this version, but fully functional so far. In
retrospect there's a little bug in the ebuild.
for crypt, the dependency should be "=app-crypt/gpgme-0.3.14" only. Newer
versions won't work (0.4.0 popped up in portage-testing), and gpg itself will
be triggered by gpgme, and therefor doesn't need to be included.

forgot to mention I only tested x86... but I guess you would have guessed that
correctly.

since gpg support is still considered experimental, i didn't add it to the
ebuild just yet.

As balsa 2.0.10 was recently marked stable across all arches to fix a security
bug, it should fix this problem.  balsa-2.0.10 and dependencies are marked
stable on sparc.

well, not really.. you should also mark 1.4.3 stable

Ahh, thanks for pointing that out.  It has been marked stable for sparc.

I think you are correct to consider gpgme as non-stable yet, but wouldn't it be
a good idea to get it into "testing = ~x86"? I thought that's the idea behind
it.

So you could keep two parallel ebuilds of balsa, adding "-r1" with gpgme. If
you ever have to change the stable one, mark it "-r2" and bump the testing one
to "-r3". No good? :)

common misconception, ~x86 is for known stable stuff that hasn't been tested
well, not for experimental stuff. And revision bumping that way makes for
unreliable ebuilds (someone has a problem, i ask them for exact version, they
say -r2 , but what r2 is that exactly .. the new stable or the former
'testing').

Nope as it stands right now, people who want it should enable it themselves
(not like that is a big deal).

oh, didn't know that.
There's so much stuff in ~x86 I can't even compile... epiphany for example. *g* misunderstanding by me. So I should also send bug reports for non-perfect ~x86 - stuff?

And yes, who really wants it can hack it quickly. :) next balsa will have widely perfectioned gpg-support.

epipiphany doesnt compile ? if you have a proper 1.3 mozilla it should be no
problem, but feel free to open a  bug about it.

closing this one, ppc also please test and mark stable as requested !