Ubuntu 22.04 LTS has only RNP v0.15.2

[ni4]

Description

...which was released in 2022 and misses a lot of features and security updates.
Also Ubuntu 24.04 has only v0.17.0, while latest v0.17.1 has some additional features and Botan 3.0/updated OpenSSL 3.0 support.

[ni4]

@dkg I see you a maintainer for RNP on Ubuntu packages list, how should we proceed to update versions? Which actions should be taken from our side? Thanks!

[adrien-n]

Hi,

I work at Canonical and stumbled upon this report by chance. I don't think @dkg uploads to Ubuntu. He uploads to Debian and since Ubuntu is a downstream of Debian, it syncs the packages when there have been no changes to the packages' previous version in Ubuntu.

Updating packages in released Ubuntu versions can be done for security issues or other changes but there is a process with reviews and the reasons need to be stated explicitly. Moreover, changes are scrutinized to avoid possibly different behaviors (a goal in Ubuntu is to have people keep unattended-upgrades, which they won't do if stuff changes without warning). Such updates are also usually patch cherry-picks rather than full versions.

As I'm not very familiar with rnp, if you can come up with a more detailled list of the changes you have in mind, I can give you an assessment of the likelihood they get included.

There is also documentation for that (probably too much); the first step is [filling a bug on launchpad](at https://bugs.launchpad.net/ubuntu/+source/rnp) using the SRU template .

[ni4]

@adrien-n Thanks for your detailed comment! As RNP is comparably new library, there were huge number of changes between v0.15.2 and v0.17.0 (new APIs, internal codebase changes, whatever else), so most likely this will not fit the cherry picking strategy. Now I think that this should not be a major problem as main library user - Thunderbird - in most cases build RNP from sources.