mailpile: 0.4.1 -> 0.5.2 #23058

spinus · 2017-02-21T21:28:37Z

Motivation for this change

New version of mailpile is out, current version is waaaay to old.

Things done

Tested using sandboxing
(nix.useSandbox on NixOS,
or option build-use-sandbox in nix.conf
on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- Linux
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

mention-bot · 2017-02-21T21:28:40Z

@spinus, thanks for your PR! By analyzing the history of the files in this pull request, we identified @domenkozar, @matejc and @dezgeg to be potential reviewers.

spinus · 2017-02-21T21:31:05Z

I a problem with upgrading this package, I can't build it properly. There is no issues when I run "python setup.py bdist_wheel" when I run this manually outside of nixpkgs tree. Maybe someone knows what the issue could be and what is potential solution?

Mic92 · 2017-02-22T00:48:43Z

pkgs/applications/networking/mailreaders/mailpile/default.nix

@@ -2,12 +2,12 @@

 python2Packages.buildPythonApplication rec {
  name = "mailpile-${version}";
-  version = "0.4.1";
+  version = "0.5.2";

  src = fetchgit {


this should be upgraded to fetchFromGithub.

The repo uses git submodules which aren't included in the Github tarball.

hmm, I moved to fetchFromGitHub but it still building, I'll try to verify later if it's working

Mic92 · 2017-02-22T08:13:00Z

Build is fixed now, but the released pre-release is still to old. At least gpg integration did not work for me.

spinus · 2017-02-22T11:22:05Z

@Mic92 thank you for fixing it, I'll try to work on it.

FRidh · 2017-02-22T12:42:12Z

pkgs/applications/networking/mailreaders/mailpile/default.nix

    rev = "refs/tags/${version}";
-    sha256 = "118b5zwfwmzj38p0mkj3r1s09jxg8x38y0a42b21imzpmli5vpb5";
+    sha256 = "1d2b776x9134sv67pylfkvf1dd4vs5pvgrngpmshrsjgsib13dx5";
  };

  patchPhase = ''


I think its better to have postPatch here. That way one can still pass in patches.

spinus · 2017-03-01T09:04:16Z

it looks like this packages was not released for a long time, I just used master for now. Any ideas if we should keep latest officially released one or stick with master? (maybe we should have 0.5.2 and master as unstable package)

FRidh · 2017-03-01T09:14:14Z

(maybe we should have 0.5.2 and master as unstable package)

Yes.

Mic92 · 2017-03-01T09:14:47Z

@spinus if this is required to get gpg working, I am ok with that. Also mailpile is still in early development.

spinus · 2017-03-02T00:17:24Z

I wrote to mailpile developers to ask about little clarification on that, here is what I've got:

If you can, please remove 0.5.2 from NixOS. It is very buggy and
has serious known security vulnerabilities.

There will be a release candidate for 1.0 sometime this year;
until then I am asking the community to please NOT package
Mailpile at all, as packages will give a false expectation of
stability, will attract the wrong kind of user and will
ultimately disappoint people.

I know that's not what people want to hear, but that's the
current state of things.

So the question is, should we remove mailpile from nixos as it's not ready yet, or we want to keep it anyway (in this case I assume we should clearly communicate that this software is not ready to be used "in production"). What do you think people?

FRidh · 2017-03-02T06:58:30Z

Simple, remove it, the maintainer is very clear about it...

BjarniRunar · 2017-03-02T08:08:44Z

Thanks @FRidh and @spinus for reaching out! Please feel free to be in touch at any time if you have questions, this should only be a temporary situation.

grahamc · 2017-03-06T13:51:10Z

Can we get a list of these known vulnerabilities, then:

set meta.knownVulnerabilities on 17.03, unstable
mark it as broken on 16.09

BjarniRunar · 2017-03-06T15:52:56Z

I don't have a curated list of vulnerabilities; I have a bug tracker full of open and closed issues, some of which almost certainly have a security impact.

BjarniRunar · 2017-03-06T15:55:29Z

Basically, you've now demonstrated exactly why I'm asking this not be packaged. We don't have the stability, processes or resources to support that. It should never have been packaged in the first place. The only "consolation" is that those old releases were so buggy that I'd be amazed if anyone ever managed to use them for anything of import.

grahamc · 2017-03-06T22:58:40Z

I've marked it as broken in our stable distribution: 8605d31 as we can't remove it from that.

I marked it as insecure on next-stable (17.03, 85b47bb) and unstable (6111f6a) just in case the removal doesn't happen. Removing it is a bit tricky due to the service, but would happily merge a PR doing that.

FRidh · 2017-03-10T12:35:11Z

pkgs/applications/networking/mailreaders/mailpile/default.nix


 python2Packages.buildPythonApplication rec {
  name = "mailpile-${version}";
-  version = "0.4.1";
+  version = "0.5.x-git-master-20170301";


pname = "mailpile"; version = "unstable-2017-03-01"; name = "${pname}-${version}";

FRidh · 2017-03-10T12:37:04Z

I've mentioned one more improvement in case one do wants to get it in. Merging this upgrade I don't mind now that it is marked as insecure.

spinus · 2017-04-07T20:25:28Z

ok, as mailpile is marked as insecure and there is advice not to releases for anything below 1.0 I assume we can close that

@spinus

Adaptation of NixOS#23058 by @spinus to 1.0.0rc1. See NixOS#23058 and NixOS#28111 for discussion. This patch keeps the warnings. But I think it is useful to have a sanely working version in nixpkgs, even if it is still considered insecure, just to follow the upstream development by actually running it instead of reading the log.

mailpile: 0.4.1 -> 0.5.2

d9657b3

Mic92 reviewed Feb 22, 2017

View reviewed changes

fpletz added 2.status: work-in-progress 8.has: package (update) labels Feb 22, 2017

mailpile: fix build

d4152aa

FRidh reviewed Feb 22, 2017

View reviewed changes

mailpile: 0.5.2 -> git-master-20170301

3e660a3

spinus force-pushed the mailpile-upgrade branch from 87f040c to 3e660a3 Compare March 1, 2017 09:01

FRidh requested changes Mar 10, 2017

View reviewed changes

spinus closed this Apr 7, 2017

jeaye mentioned this pull request Aug 10, 2017

Mailpile now available as 1.0rc1 #28111

Closed

oxij mentioned this pull request Feb 10, 2018

mailpile: 0.4.1 -> 1.0.0rc1 #34799

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

mailpile: 0.4.1 -> 0.5.2 #23058

mailpile: 0.4.1 -> 0.5.2 #23058

spinus commented Feb 21, 2017

mention-bot commented Feb 21, 2017

spinus commented Feb 21, 2017

Mic92 Feb 22, 2017

fpletz Feb 22, 2017

spinus Mar 1, 2017

Mic92 commented Feb 22, 2017 •

edited

spinus commented Feb 22, 2017

FRidh Feb 22, 2017

spinus Mar 1, 2017

spinus commented Mar 1, 2017

FRidh commented Mar 1, 2017

Mic92 commented Mar 1, 2017

spinus commented Mar 2, 2017 •

edited

FRidh commented Mar 2, 2017

BjarniRunar commented Mar 2, 2017

grahamc commented Mar 6, 2017

BjarniRunar commented Mar 6, 2017

BjarniRunar commented Mar 6, 2017

grahamc commented Mar 6, 2017 •

edited

FRidh Mar 10, 2017

FRidh commented Mar 10, 2017

spinus commented Apr 7, 2017

mailpile: 0.4.1 -> 0.5.2 #23058

mailpile: 0.4.1 -> 0.5.2 #23058

Conversation

spinus commented Feb 21, 2017

Motivation for this change

Things done

mention-bot commented Feb 21, 2017

spinus commented Feb 21, 2017

Mic92 Feb 22, 2017

Choose a reason for hiding this comment

fpletz Feb 22, 2017

Choose a reason for hiding this comment

spinus Mar 1, 2017

Choose a reason for hiding this comment

Mic92 commented Feb 22, 2017 • edited

spinus commented Feb 22, 2017

FRidh Feb 22, 2017

Choose a reason for hiding this comment

spinus Mar 1, 2017

Choose a reason for hiding this comment

spinus commented Mar 1, 2017

FRidh commented Mar 1, 2017

Mic92 commented Mar 1, 2017

spinus commented Mar 2, 2017 • edited

FRidh commented Mar 2, 2017

BjarniRunar commented Mar 2, 2017

grahamc commented Mar 6, 2017

BjarniRunar commented Mar 6, 2017

BjarniRunar commented Mar 6, 2017

grahamc commented Mar 6, 2017 • edited

FRidh Mar 10, 2017

Choose a reason for hiding this comment

FRidh commented Mar 10, 2017

spinus commented Apr 7, 2017

Mic92 commented Feb 22, 2017 •

edited

spinus commented Mar 2, 2017 •

edited

grahamc commented Mar 6, 2017 •

edited