I sent that previous email too soon! I wanted to still add the following:
The upstream of the current project (TrustedDomainProject) has indicated
that they are interested in decommissioning OpenARC; they have
officially reached out to flowerysong (the maintainer of the updated
OpenARC software that is being packaged in this thread) if they can just
point their repo at his [0].
Already back in 2024 I reached out to flowerysong about this fork and
whether he was going to maintain it[1]. At that point in time, he was
not sure what his commitment was going to be, but since then he has
created releases, fixed a lot of bugs, fixed issues that were brought up
on his, and the TDP's issue tracker. Here are some of the more important
(I think) fixes, which would already warrant switching to it. He
* addressed the differences between the early ARC drafts, implemented
by the original
OpenARC, and the final RFC 8617 specification;
* fixed multiple buffer overruns and other memory-safety issues;
* fixed a use-after-free in the milter;
* substantially reworked Authentication-Results parsing and
ARC-Authentication
Results generation;
* added OpenSSL 3 compatibility;
* improved test coverage and cleaned up the build system;
* addressed real-world interoperability problems, including ARC
signatures rejected by
Microsoft/O365;
* and he continues to make build and portability fixes.
I have also checked the licensing. The fork retains the existing
BSD-style licence and original copyright notices, while adding copyright
attribution for "OpenARC contributors"; I don't see a licence change
that would prevent Debian from continuing to distribute it.
I hope this helps!
Kind regards,
Edmund
[0]:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126523;msg=50[1]:
https://github.com/flowerysong/OpenARC/discussions/22
--
Edmund Lodewijks <[email protected]>
TZ: UTC+2 / GMT+2
