Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1279977 > unrolled thread

Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter Thorsten Glaser <tg@mirbsd.de> - 2026-01-28 02:10 +0100
    Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter Thorsten Glaser <tg@debian.org> - 2026-01-29 18:20 +0100
    Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter Thorsten Glaser <tg@debian.org> - 2026-01-29 18:30 +0100
    Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter Paul Fisher <paul@pfish.zone> - 2026-02-09 21:20 +0100
      Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter Thorsten Glaser <tg@debian.org> - 2026-02-09 21:50 +0100
        Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter Paul Fisher <paul@pfish.zone> - 2026-02-15 22:10 +0100
          Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter Paul Fisher <paul@pfish.zone> - 2026-02-17 23:00 +0100
            Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter Thorsten Glaser <tglaser@b1-systems.de> - 2026-03-06 02:30 +0100
    Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter Thorsten Glaser <tglaser@b1-systems.de> - 2026-03-06 02:00 +0100

#1279977 — Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter

Package: wnpp
Severity: wishlist
Owner: Thorsten Glaser <tg@mirbsd.de>
X-Debbugs-Cc: debian-devel@lists.debian.org, tglaser@b1-systems.de

* Package name    : openarc
  Version         : 1.3.0
* URL             : https://github.com/flowerysong/OpenARC
* License         : 2-clause BSD; sendmail OSS
  Programming Lang: C
  Description     : ARC (authenticated Received chain) milter

OpenARC is an open source library for adding Authenticated Received
Chain (ARC) support to applications and an example filter application
using the milter protocol.

ARC is an experimental protocol defined in RFC 8617. It provides an
authenticated chain of custody for a message, allowing message handlers
to see who has handled it before and what those prior handlers claim the
message's authentication status was at that point.

ARC is still experimental and its specification may change. This package
is intended for use by operators willing to take part in the experiment
and provide their feedback to the development team.

----

I’ll be working RSN on packaging this up for $dayjob, so I’d like to put
it into Debian proper to avoid work duplication and so more people have
something from the effort. I’ll need to make the packaging backport
cleanly to bookworm and trixie (but that should be no problem).

If possible, I’d like for someone else to (at least co‑)maintain this
though, as the users are coworkers, not myself. I can do the usual to
keep an eye on bugs and something and do occasional updates of course,
otherwise I’d not upload it, but if someone else wants to volunteer…

While the RFC still lists it as experimental, it’s from 2019, with
errata, but still. It could conceivably be included in a stable release
with post-release updates if needed for spec compliance later on, or
excluded from stable releases for now; I’ll leave that up to the (S)RM.

[toc] | [next] | [standalone]

#1280138

Dixi quod…

>On Wed, 28 Jan 2026, Nicolas Peugnet wrote:

>> So you might simply want to contact the current maintainers and
>> suggest a change of upstream.

>David, would you agree to do so and put it into unstable, so it

Hm, that eMail address bounces.

Tobias, do you have a working address for David Bürgin?
You seem to have been the last sponsor…

bye,
//mirabilos
-- 
15:41⎜<Lo-lan-do:#fusionforge> Somebody write a testsuite for helloworld :-)

[toc] | [prev] | [next] | [standalone]

#1280145

On Wed, 28 Jan 2026, Nicolas Peugnet wrote:

> Note that a package for openarc is already in debian, but it has never
> been released to unstable, only experimental

Ah! That’s also why my search didn’t find it…

> and it tracks the original upstream
> from thetrusteddomain-project: https://tracker.debian.org/pkg/openarc
>
> So you might simply want to contact the current maintainers and
> suggest a change of upstream.

Excellent idea.

David, would you agree to do so and put it into unstable, so it
can eventually land in releases?

Michael already has a WIP package for this, and, if desirable,
I could also give it a look-over first. This also means we have
two comaintainers already.

bye,
//mirabilos
-- 
Sometimes they [people] care too much: pretty printers [and syntax highligh-
ting, d.A.] mechanically produce pretty output that accentuates irrelevant
detail in the program, which is as sensible as putting all the prepositions
in English text in bold font.	-- Rob Pike in "Notes on Programming in C"

[toc] | [prev] | [next] | [standalone]

#1281432

When it rains, it pours, I guess. I didn’t notice this ITP or the
previous experimental package when I started on my own OpenARC
adventure last week, so I ended up learning how to make a Debian
package and making babby’s first package for OpenARC myself. It needs
some polish before it is ready for primetime, but I have a version in
an Ubuntu PPA [1] that I have installed on pfish.zone and (I think) is
fully working (check the full headers on this message).

I threw that work up onto Salsa:

https://salsa.debian.org/pfish/openarc

I cribbed a good bit from the OpenDKIM (and OpenDMARC) packaging
process, though I actually built it by starting with the debmake guide
and working from there. You can feel free to steal my work, or I can
fix it up the rest of the way myself (with a little help and
guidance), or you can just do your own thing.

[1]: https://launchpad.net/~thetorpedodog/+archive/ubuntu/openarc/

[toc] | [prev] | [next] | [standalone]

#1281437

On Mon, 9 Feb 2026, Paul Fisher wrote:

>When it rains, it pours, I guess. I didn’t notice this ITP or the
>previous experimental package when I started on my own OpenARC

;-)

>adventure last week, so I ended up learning how to make a Debian
>package and making babby’s first package for OpenARC myself. It needs
>some polish before it is ready for primetime, but I have a version in
>an Ubuntu PPA [1] that I have installed on pfish.zone and (I think) is
>fully working (check the full headers on this message).

Another one…

>I threw that work up onto Salsa:
>
>https://salsa.debian.org/pfish/openarc

I’m currently looking at Michael’s (which looks pretty good so far)
but can have a look at whether you spotted anything new that would
be good to merge.

Meanwhile I’ve been trying to get a contact to the maintainer of
the package currently in experimental, to perhaps take it over.

bye,
//mirabilos
-- 
/⁀\ The UTF-8 Ribbon
╲ ╱ Campaign against
 ╳  HTML eMail! Also,
╱ ╲ header encryption!

[toc] | [prev] | [next] | [standalone]

#1282321

On Mon, Feb 9, 2026 at 3:38 PM Thorsten Glaser <tg@debian.org> wrote:
> I’m currently looking at Michael’s (which looks pretty good so far)
> but can have a look at whether you spotted anything new that would
> be good to merge.

I think the only really interesting thing I did was to disable
backgrounding so that systemd directly starts the main openarc process
rather than having openarc fork itself and exit immediately:

https://salsa.debian.org/pfish/openarc/-/blob/67f1c6ec1542457fad68ab0c4a419a5045ddd55b/debian/openarc.conf#L37

On the other side, I could also see wanting to have it fork so that
OpenARC, OpenDKIM, and OpenDMARC all behave the same by default.

Overall I would also agree that Michael’s is probably better overall
(which is not surprising, considering that he has, you know,
experience).

[toc] | [prev] | [next] | [standalone]

#1282587

In the course of working on something else I noticed something in the
existing experimental package: it effectively tries to create
/run/openarc twice (once in the postinst script, and then again with
tmpfiles.d). Also, they disagreed on what mode it should be created in
(post-install: 0755, tmpfiles.d: 0750; post-install wins).

Between cleaning up that duplication and using sysusers.d to create
the openarc user, I think we can eliminate the postinst script
entirely. I uploaded a change which uses RuntimeDirectory=openarc to
create /run/openarc, replacing both postinst and tmpfiles. It’s built
on top of Michael’s latest commit:

https://salsa.debian.org/pfish/openarc/-/commit/a3b779ceda51749c88272858c30974b64ce70752

[toc] | [prev] | [next] | [standalone]

#1284846

On Tue, 17 Feb 2026, Paul Fisher wrote:

>(post-install: 0755, tmpfiles.d: 0750; post-install wins).

Except after a reboot. I did wonder about that postinst part,
especially as it references dpkg-statoverride which only works
for directories actually shipped IIUC. Perhaps this was copied
from another package that had a directory elsewhere than /run?

(IMHO correct would be 02750.)

But, yes, getting rid of that postinst would not be bad.

>Between cleaning up that duplication and using sysusers.d to create

I’m… let’s just say not a systemd person.

Perhaps, if Michael and you want to maintain this, and I just
chime in with what I do know, and forward ↔ our tester…

bye,
//Thorsten
-- 
Thorsten Glaser
Linux / Unix Developer
Tel.: +49 160 91168501
E-Mail: tglaser@b1-systems.de

B1 Systems GmbH
Osterfeldstraße 7 / 85088 Vohburg / https://www.b1-systems.de/
GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt, HRB 3537

[toc] | [prev] | [next] | [standalone]

#1284843

On Wed, 28 Jan 2026, Thorsten Glaser wrote:

>I’ll be working RSN on packaging this up for $dayjob, so I’d like to put

I’ve only now been able to get back to this. The maintainer
situation is still unresolved and we might want to salvage
the package. I’m… unhappy with some things in Debian at the
current point in time, which may resolve either way, so I’m
doing a low-effort fixup for $dayjob to test, for now, as I
don’t know if I can maintain the package longer-term.

Might also do this as QA upload, who knows. I’d argue that
this is a better thing than what’s currently in experimental,
and if Michael wants to be listed as maintainer…

I’ve started with Michael’s package as Paul’s is, indeed,
probably the worse starting point. Someone who actually knows
the systemd stuff might want to look into merging both. The
autogenerated d/copyright from Paul is differently bad than
the one from David/Michael, but AIUI it’s meant to document
what goes into the binary package only anyway so the latter
is good enough.

I’d have forked off David’s package BEFORE he relicenced his
debian/* to GPLv3+ though, it’s a mismatch with the licences
of the software. Consider all my changes, where ©-relevant,
to be dual-licenced GPLv3+ and “matches the licence of the
upstream source”, except for the patch of course, which is
only the latter.

I’m currently doing a “just good enough” fixing round with
builds on bookworm (with python3-miltertest dropped in),
trixie and sid. Small copyright review, postinst fix, B-D fix,
patch to fix errors in the format of one manpage, so far and
not bothering with lintian. I’ve pushed to a forked repo on
salsa: git@salsa.debian.org:tg/openarc.git

(override spelling-error-in-copyright, it’s both wrong (AE vs. BE)
and a verbatim copy from the licence so could not be changed even
if it were correct)

The delta from the upstream repo to the release tarball is epic:

tg@tgb1:~/Misc/Vendor/openarc $ git diff --stat v1.3.0 :!debian
 .clang-format                    |    30 -
 .editorconfig                    |    15 -
 .git-blame-ignore-revs           |    13 -
 .github/workflows/build-dist.yml |    33 -
 .github/workflows/build.yml      |    91 -
 .gitignore                       |    66 -
 .ruff.toml                       |     9 -
 Makefile.in                      |  1798 +++++++
 aclocal.m4                       |  1500 ++++++
 build-aux/compile                |   348 ++
 build-aux/config.guess           |  1754 +++++++
 build-aux/config.sub             |  1890 +++++++
 build-aux/depcomp                |   791 +++
 build-aux/install-sh             |   541 ++
 build-aux/ltmain.sh              | 11436 ++++++++++++++++++++++++++++++++++++++++
 build-aux/missing                |   215 +
 build-config.h.in                |   346 ++
 configure                        | 19905 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 contrib/.gitignore               |     1 -
 contrib/Makefile.in              |   769 +++
 contrib/init/Makefile.in         |   647 +++
 contrib/init/generic/Makefile.in |   524 ++
 contrib/init/redhat/.gitignore   |     1 -
 contrib/init/redhat/Makefile.in  |   526 ++
 contrib/init/redhat/openarc      |   101 +
 contrib/init/solaris/Makefile.in |   524 ++
 contrib/spec/.gitignore          |     1 -
 contrib/spec/Makefile.in         |   528 ++
 contrib/spec/openarc.spec        |   236 +
 contrib/systemd/.gitignore       |     1 -
 contrib/systemd/Makefile.in      |   525 ++
 contrib/systemd/openarc.service  |    22 +
 libopenarc/.gitignore            |     4 -
 libopenarc/arc.h                 |     2 +-
 libtool                          | 11939 ++++++++++++++++++++++++++++++++++++++++++
 m4/.gitignore                    |     5 -
 m4/libtool.m4                    |  8427 ++++++++++++++++++++++++++++++
 m4/ltoptions.m4                  |   437 ++
 m4/ltsugar.m4                    |   124 +
 m4/ltversion.m4                  |    24 +
 m4/lt~obsolete.m4                |    99 +
 openarc/.gitignore               |     6 -
 test/.gitignore                  |     1 -
 test/Makefile.in                 |   468 ++
 44 files changed, 66445 insertions(+), 278 deletions(-)

We might be better off starting from the repo, tbh; dh_autoreconf
will plug all these files anyway.

We might want to patch the code to fix the -Wformat-truncation
warnings, but they only happen in error code and are largely
theoretic, thus not a priority.

I managed to make all tests pass (on all three releases); the
remaining 6 skipped are because we only install one py3k version.
I’ll be handing this to the coworker who asked for it, to test
in operation.

bye,
//Thorsten
-- 
Thorsten Glaser
Linux / Unix Developer
Tel.: +49 160 91168501
E-Mail: tglaser@b1-systems.de

B1 Systems GmbH
Osterfeldstraße 7 / 85088 Vohburg / https://www.b1-systems.de/
GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt, HRB 3537

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web