On Sat, 20 Oct 2018 16:00:21 +0200 Andrea della Porta <sfaragnaus@gmail.com> wrote: > Package: wnpp > Severity: wishlist > Owner: Andrea della Porta <sfaragnaus@gmail.com> > > * Package name : libciepki1 > Version : 1.0-1 > Upstream Author : Andrea della Porta <sfaragnaus@gmail.com> > * URL : http://github.com/italia/cie-middleware-linux > * License : (BSD-3-Clause) > Programming Lang: (C++) > Description : PKCS11 driver for Italian CIE > > ciepki allows any PKCS11 enabled application to leverage > the cryptographic and authentication facilities of > the Italian CIE. > Binaries to change/unlock PIN are also provided. > This will be the main middleware to use with any Italian ID card. Hello, thanks for volunteering to package this piece of software. Is there any progress on the packaging effort? > Source code is provided through github as above but this package > will be a binary only one since teh cachelib will be slightly changed > to provide added security though encryption, and the key/iv should > not be exposed. Cachelib reference implementation on github is almost > identical except for the lacking encrypted data. > I guess I will need a sponsor to push it to non-free repository. > > This is not clear to me: if the driver is DFSG-free under the terms of the 3-clause BSD license, why would you want to package it for the non-free archive? Could you please clarify this "added security though encryption" thing? What do you mean "the key/iv should not be exposed"? Sounds like security through obscurity, which is (almost) never a good idea. I see that Joonas Kylmälä (who reads us in Cc) commented your ITP bug. I share some of his concerns/doubts. Please let us know. Thanks for your time! -- http://www.inventati.org/frx/ There's not a second to spare! To the laboratory! ..................................................... Francesco Poli . GnuPG key fpr == CA01 1147 9CD2 EFDF FB82 3925 3E1C 27E1 1F69 BFFE
Attachment:
pgpqm3qVYO9oy.pgp
Description: PGP signature