Bug 12388 – Missing source code of certificate control panel applet

Bug 12388 - Missing source code of certificate control panel applet


Summary:	Missing source code of certificate control panel applet

Status:	VERIFIED FIXED

Product:	Settings and Maintenance
Component:	Control panel
Version:	unspecified
Platform:	N900 Maemo

Importance:	Unspecified enhancement with 2 votes (vote)
Target Milestone:	---
Assigned To:	Juhani Mäkelä
QA Contact:	control-panel-bugs

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree

Reported:	2011-09-10 18:58 UTC by Pali Rohár
Modified:	2011-12-02 16:28 UTC (History)
CC List:	3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note

You need to log in before you can comment on or make changes to this bug.

Description Pali Rohár (reporter) 2011-09-10 18:58:28 UTC

SOFTWARE VERSION: 
(Settings > General > About product)

EXACT STEPS LEADING TO PROBLEM: 
(Explain in detail what you do (e.g. tap on OK) and what you see (e.g. message
Connection Failed appears))
1. 
2. 
3. 

EXPECTED OUTCOME: 

ACTUAL OUTCOME: 

REPRODUCIBILITY: 
(always, less than 1/10, 5/10, 9/10)

EXTRA SOFTWARE INSTALLED: 

OTHER COMMENTS: 

Certificate control panel applet is in package maemosec-certman-applet. This
package is only in downloads.maemo.nokia.com apt repository and only binary
form. In armel deb package is this license file:

/usr/share/doc/maemosec-certman-applet/copyright

===
This package was debianized by Juhani Mäkelä <ext-juhani.3.makela@nokia.com>.

Copyright (C) 2009 Nokia Corporation

 This library is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public
 License as published by the Free Software Foundation; either
 version 2 of the License, or (at your option) any later version.

 This library is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 Lesser General Public License for more details.

 You should have received a copy of the GNU Lesser General Public
 License along with self library; if not, write to the
 Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
 MA 02110-1301, USA.

On Debian systems, the complete text of the GNU Library General
Public License can be found in `/usr/share/common-licenses/LGPL-2'.
===

So If maemosec-certman-applet is under LGPL license, where is source code?

Comment 1 Juhani Mäkelä nokia

2011-09-13 13:13:53 UTC

The embedded licence file is in conflict with the intended license all right.
Assigned to myself, I'll take this up with the Nokia legal team to find a
resolution.

Comment 2 Pali Rohár (reporter) 2011-11-13 21:51:47 UTC

I got source code from Nokia. It is really GPL, so I published it here:
http://talk.maemo.org/showthread.php?t=79957

Comment 3 Juhani Mäkelä nokia

2011-11-14 09:10:40 UTC

(In reply to comment #2)
> I got source code from Nokia. It is really GPL, so I published it here:
> http://talk.maemo.org/showthread.php?t=79957

Hm, doesn't seem like the regular procedures were followed. Usually there is
some kind of a formal decision about releasing and then the maintainer, which
would be me, is told to make the source available in a public Git repository. I
haven't heard of any such decision.

That is also quite an old version (0.0.9) that was part of the original PR1.0
release. The one in PR1.3 would be 0.1.3 and 0.1.4 also exists that fixes
MB#12448.

On the other hand 0.0.9 is the last release that can be built without a
dependency to libcomapp-dev which is (also) closed source, so for a FOSS
substitute this really is the right version. It misses some features like the
"Add new certificate" button but it works and can be used so its better than
nothing I guess.

Comment 4 Pali Rohár (reporter) 2011-11-14 10:56:13 UTC

libcomapp is open source library and source code is on: 
http://repository.maemo.org/pool/fremantle/free/libc/libcomapp/

in repository is missing -dev and -dbg binary libcomapp package, but with dsc 
source code it is possible to build both (-dev and -dbg). and osso-pdf-viewer
depends on this library (which is open source too - now in CSSU)...

Comment 5 Jonathan Wilson 2011-11-18 12:36:40 UTC

So are we allowed to use the source code we have (0.0.9) or not? And is there
any possibility of getting the more recent 0.1.4 version (with the "install"
button, blacklisting of revoked certificates and other features)?

Comment 6 Juhani Mäkelä nokia

2011-11-18 14:17:09 UTC

(In reply to comment #5)
> So are we allowed to use the source code we have (0.0.9) or not?

Yes, you are. They were given as a response to a request sent to
sourcecode.request@nokia.com by the procedure documented in the Settings ->
About product feature of N900. Whatever hassle there is about the licence is
Nokia's internal headache.

> And is there any possibility of getting the more recent 0.1.4 version 
> (with the "install" button, blacklisting of revoked certificates and 
> other features)?

Yes, there is. The formal process of opening the sources was started this week.

Comment 7 Jonathan Wilson 2011-11-18 15:13:43 UTC

So is there the possibility to get any other N900 source code? (or more
specifically to get someone to look into whether specific code is something
that can be released or if it contains "secret" stuff that makes releasing
difficult or time-consuming)

Comment 8 Juhani Mäkelä nokia

2011-11-18 16:11:27 UTC

(In reply to comment #7)
> So is there the possibility to get any other N900 source code? (or more
> specifically to get someone to look into whether specific code is something
> that can be released or if it contains "secret" stuff that makes releasing
> difficult or time-consuming)

I'm not really in a position to comment that, but personally I'd estimate the
chances are slim simply because there aren't many left to do that kind of work:

http://www.networkworld.com/news/2009/031709-nokia-layoffs.html

This case is special though since an old and defective source code version was
given out through a proper channel, the left hand not knowing what the right
one is doing. Let's hope it works out at least this once.

Comment 9 Juhani Mäkelä nokia

2011-12-02 11:37:54 UTC

All is well when the end is well. The source has now been officially assigned
the LGPLv2 licence by Nokia contribution ticket #671 and is available at

https://gitorious.org/maemo-5-certificate-manager/maemo-security-certman-applet

Thanks, Pali for your persistence.

Comment 10 Pali Rohár (reporter) 2011-12-02 16:28:33 UTC

Thanks Juhani Mäkelä for official source code!