• Dovecot IMAP server (1.1.11)
• Dovecot’s CMU Sieve plugin (1.1.6)
• Dovecot’s managesieve plugin (0.10.5)

I use Roundcube Webmail on my server, and there is a super-nice Roundcube Managesieve plugin available.

So I built and installed my Dovecot packages, installed the Roundcube Managesieve plugin, and I’m off and flying with awesome client-configurable mail filtering while allowing the mail filtering itself to be done server-side.

I’ve made the packages available here (14 MB download).  This SVr4 pkg contains SFEdovecot, SFEdovecot-cmusieve, SFEdovecot-managesieve, and the SFEdovecot-root (configuration files) packages.

There are concerns from both the Ubuntu & Songbird side.  I’ll try to cover some of the major ones here:

• Security updates and backports for XULRunner. Ubuntu has XULRunner already… Firefox uses it in fact.  They want Songbird to use the system XULRunner so they only have to sustain and maintain one copy of XULRunner.  As it is currently, Songbird has its own private patched copy of XULRunner, which means the Ubuntu Mozilla-team would need to backport security fixes to both the system XULRunner and Songbird’s XULRunner.
• So why doesn’t Ubuntu just use Songbird’s XULRunner for both Firefox & Songbird?  Agreements with Mozilla.  In order to use the Firefox branding and trademarks, Ubuntu needs to maintain an approved XULRunner build that Mozilla blesses.  Putting in Songbird’s patches may regress Firefox which would lead to bad user impressions of Firefox and thus taint Mozilla & Firefox’s brand and image.
• Supporting Releases.  This is somewhat related to the security/backporting issue… but POTI (the company developing Songbird) only supports the most recently released version of Songbird.  We release roughly every 3 months… quite frequently!  So, we just released Songbird 1.0 last week.  If a XULRunner exploit comes out, we won’t back-port it Songbird 0.7 or 0.6 which we released earlier this year.  Ubuntu has a release guarantee which more or less means they would need to support a release or two back… not to mention their LTS (long term support) policy which means they’d be supporting ancient versions of Songbird which we (POTI) wouldn’t even think once (let alone twice) about supporting.

Putting a Songbird package into the universe would allow for users to be able to install it, whilst allowing Ubuntu to have some more leeway in terms of having a less-restrictive sustaining guarantee.  It’s definitely a nascent idea at the moment, but hopefully we’ll make some progress on proceeding down this path so that Songbird will be a one command install away for Ubuntu users… stay tuned.

Update: My wording was perhaps poor… I didn’t mean to give the impression that there is not security in universe, or that security policies are somehow lax vs. main.  Specifically, universe might be a better option than main because instead of having to backport individual patches to the supported-release version (as would have to happen in main), we could instead just rev to the latest Songbird release (thus shifting some of the maintenance from the Ubuntu Mozilla-team over to the Songbird developers).  This doesn’t alleviate all concerns though as we still need to ensure we have a process for keeping Songbird packages in universe up to date.

Update 2: I’ve had it pointed out that my wording on “into universe instead of main” was also confusing.  Prior to Wednesday, I didn’t realise the difference between universe & main (not being an Ubuntu user myself).. and was under the impression that it was just a single level of packages/repositories… hence the “instead of” wording.  Certainly asac and the Ubuntu guys undoubtedly had been planning universe all along.