that’s whacked

Dovecot 1.1.11 + managesieve + CMU Sieve Solaris pkgs

Wednesday, Mar 11. 2009  –  Category: Grommit, OpenSolaris

I’d been looking for a good way to do server-side mail filtering with client side configuration… and short of some lame CGI interfaces to editing your .procmailrc, I hadn’t found much until I discovered Sieve a few days ago.  To skip a long and boring story, I rebuilt a bunch of packages (yay for JDS’s spec build system) for the following:

• Dovecot IMAP server (1.1.11)
• Dovecot’s CMU Sieve plugin (1.1.6)
• Dovecot’s managesieve plugin (0.10.5)

Quick summary: Dovecot is a wicked awesome IMAP server.  Sieve provides a way of doing mail filtering.  managesieve is an protocol to allow users to modify their sieve filters via the IMAP protocol.

I use Roundcube Webmail on my server, and there is a super-nice Roundcube Managesieve plugin available.

So I built and installed my Dovecot packages, installed the Roundcube Managesieve plugin, and I’m off and flying with awesome client-configurable mail filtering while allowing the mail filtering itself to be done server-side.

I’ve made the packages available here (14 MB download).  This SVr4 pkg contains SFEdovecot, SFEdovecot-cmusieve, SFEdovecot-managesieve, and the SFEdovecot-root (configuration files) packages.

Ubuntu & Songbird, sitting in a tree…..

Thursday, Dec 11. 2008  –  Category: OpenSource, Songbird

I’ve spent the past two days down in Mountain View.  Yesterday I spent some time at the Ubuntu Developer Summit meeting with the great guys from the Ubuntu Mozilla-team to see about integrating Songbird into Ubuntu (ideally Jaunty, but we’ll see).  It’s a pretty common request from our Ubuntu users to get a Songbird .deb into Ubuntu’s repositories so users can easily ‘apt-get install songbird’.  Unfortunately, it’s not as easy as simply taking the GetDeb.net Songbird package and plopping that into an apt repo.

There are concerns from both the Ubuntu & Songbird side.  I’ll try to cover some of the major ones here:

• Security updates and backports for XULRunner. Ubuntu has XULRunner already… Firefox uses it in fact.  They want Songbird to use the system XULRunner so they only have to sustain and maintain one copy of XULRunner.  As it is currently, Songbird has its own private patched copy of XULRunner, which means the Ubuntu Mozilla-team would need to backport security fixes to both the system XULRunner and Songbird’s XULRunner.
• So why doesn’t Ubuntu just use Songbird’s XULRunner for both Firefox & Songbird?  Agreements with Mozilla.  In order to use the Firefox branding and trademarks, Ubuntu needs to maintain an approved XULRunner build that Mozilla blesses.  Putting in Songbird’s patches may regress Firefox which would lead to bad user impressions of Firefox and thus taint Mozilla & Firefox’s brand and image.
• Supporting Releases.  This is somewhat related to the security/backporting issue… but POTI (the company developing Songbird) only supports the most recently released version of Songbird.  We release roughly every 3 months… quite frequently!  So, we just released Songbird 1.0 last week.  If a XULRunner exploit comes out, we won’t back-port it Songbird 0.7 or 0.6 which we released earlier this year.  Ubuntu has a release guarantee which more or less means they would need to support a release or two back… not to mention their LTS (long term support) policy which means they’d be supporting ancient versions of Songbird which we (POTI) wouldn’t even think once (let alone twice) about supporting.

So what can we do?  There’s definitely a ton of user interest from Ubuntu users who want Songbird available… one of the ideas asac and I were tossing around was putting a Songbird package into universe instead of main.  The difference is subtle to the end-user (both are apt-get installable), but main has stricter support and security guarantees than universe does.  Check out the Ubuntu page detailing more on the differences.

Putting a Songbird package into the universe would allow for users to be able to install it, whilst allowing Ubuntu to have some more leeway in terms of having a less-restrictive sustaining guarantee.  It’s definitely a nascent idea at the moment, but hopefully we’ll make some progress on proceeding down this path so that Songbird will be a one command install away for Ubuntu users… stay tuned.

Update: My wording was perhaps poor… I didn’t mean to give the impression that there is not security in universe, or that security policies are somehow lax vs. main.  Specifically, universe might be a better option than main because instead of having to backport individual patches to the supported-release version (as would have to happen in main), we could instead just rev to the latest Songbird release (thus shifting some of the maintenance from the Ubuntu Mozilla-team over to the Songbird developers).  This doesn’t alleviate all concerns though as we still need to ensure we have a process for keeping Songbird packages in universe up to date.

Update 2: I’ve had it pointed out that my wording on “into universe instead of main” was also confusing.  Prior to Wednesday, I didn’t realise the difference between universe & main (not being an Ubuntu user myself).. and was under the impression that it was just a single level of packages/repositories… hence the “instead of” wording.  Certainly asac and the Ubuntu guys undoubtedly had been planning universe all along.