From qc161282@sac.sfbay.sun.com Mon Nov 2 22:19:48 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nA36Jlgf002945 for ; Mon, 2 Nov 2009 22:19:47 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id nA36JgbW014608; Tue, 3 Nov 2009 14:19:46 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSI00I05S8VST00@nwk-avmta-2.sfbay.sun.com>; Mon, 02 Nov 2009 22:19:43 -0800 (PST) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSI00JWES8V6VE0@nwk-avmta-2.sfbay.sun.com>; Mon, 02 Nov 2009 22:19:43 -0800 (PST) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nA36JhiH015301; Mon, 02 Nov 2009 22:19:43 -0800 (PST) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nA36JgAt002940; Mon, 02 Nov 2009 22:19:42 -0800 (PST) Received: (from qc161282@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id nA36Jfru002936; Mon, 02 Nov 2009 22:19:41 -0800 (PST) Date: Mon, 02 Nov 2009 22:19:41 -0800 (PST) From: Qing-Ming Jeff Cai Subject: Seahorse Update and Seahorse Plugins [LSARC/2009/598 FastTrack timeout 11/10/2009] To: LSARC-ext@sun.com Message-id: <200911030619.nA36Jfru002936@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 12812 Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Seahorse Update and Seahorse Plugins 1.2. Name of Document Author/Supplier: Author: Jeff Cai 1.3 Date of This Document: 02 November, 2009 4. Technical Description This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Seahorse Update and Seahorse Plugins for OpenSolaris 1.2. Name of Document Author/Supplier: Author: Jeff Cai 1.3 Date of This Document: 21 October, 2009 4. Technical Description 1. Introduction 1.1. Project/Component Working Name: Seahorse Update and Seahorse Plugins 1.2. Name of Document Author/Supplier: Author: Jeff Cai Sponsor: Jeff Cai 1.3. Date of This Document: 10/29/2009 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: LSARC 1.4.3. The Director/VP who is "Sponsoring" this project: Robert O'Dea 1.4.4. The name of your business unit: Software - OPG 1.5. Email Aliases: 1.5.1. Responsible Manager: harry.lu@sun.com 1.5.2. Responsible Engineer: jeff.cai@sun.com 1.5.3. Marketing Manager: glynn.foster@sun.com 1.5.4. Interest List: brian.cameron@sun.com darren.moffat@sun.com wyllys.ingersoll@sun.com 2. Project Summary 2.1. Project Description: Seahorse is a GNOME application for managing SSH, PGP keys and GNOME keyrings. This update enables PGP support of Seahorse after GnuPG's integration. Thus with Seahorse a user can create and manage PGP keys. Seahorse Plugins integrates with nautilus and gedit for encryption/decryption operations. After GnuPG's integration, the PGP security support is also enabled in Evolution. Please refer to sections below for more information about how GnuPG is used in Nautilus, gedit, and Evolution. 4. Technical Description: As a frontend of GnuPG, all operations on PGP keys are implemented by GnuPG or GPGME. After enabling PGP supports in Seahorse, following new features are added. 4.1 Create and Manage PGP keys To create a PGP key using seahorse, the user needs to give a description of what the key is to be used for. The user needs to specify the encryption type (DSA Elgamal, RSA or DSA), the key strength (768-4096) and the passphrase for the key. The user can list or delete PGP keys. The user can also change the passphrase for them. Seahorse invokes the interface functions provided by GPGME or 'gpg' command line to finish all these operations. 4.2 Exporting and Importing PGP Keys Seahorse can import PGP keys from the clipboard or a key file the same way as SSH keys. Seahorse allows users to specify a PGP key file. Then Seahorse invokes APIs provided by GPGME to import the key. Users can also export PGP private or public keys to files. 4.3 Signing the key Seahorse allows a user to sign a public PGP key with a private PGP key. It also provides UI to allow the user to revoke it. 4.4 Retrieve PGP public keys from servers or publish them to servers Keeps the user's and other's keys up to date by syncing keys periodically with remote key servers. Syncing will make sure that the user has the latest signatures made on all of the keys so that the web of trust will be the most useful. Seahorse provides support for HKP and LDAP key servers. HKP Servers HKP keyservers are ordinary web based keyservers such as the popular hkp://pgp.mit.edu:11371, also accessible at http://pgp.mit.edu. Seahorse uses libsoup to access HKP servers. LDAP Keyservers LDAP keyservers are less common, but use the standard LDAP protocol to serve keys. ldap://keyserver.pgp.com is a good LDAP server. Seahorse uses sunldap to access LDAP servers. 4.5 Seahorse plugin for gedit This plugin adds three menu items in the gedit's 'Edit' menu: Sign, Decrypt/Verify and Encrypt. These menu options allow the user to sign/verify or encrypt/decrypt the selected text. As a client of seahorse-daemon, it calls DBus interfaces provided in seahorse-daemon to finish all operations. 4.6 Seahorse plugin for Nautilus This plugin enables the user to sign/verify or encrypt/decrypt files in Nautilus. After a file is signed or encrypted in Nautilus, a file with the same name but with a pgp or sig extension will be created. The user can also verify/decrypt the file in Nautilus. Nautilus calls a command line helper program 'seahorse-tool' which uses GPGME to finish the encryption operations. 4.7 Encryption settings The user can use seahorse-preferences to configure some settings which include: * Default Key This is the key that will be used by applications and plugins to sign files. It will also be the key that files will be encrypted to if encrypt to self is selected. The default key id is saved in gconf ~/.gconf/desktop/pgp/default_key * When encrypting, always include myself as a recipient If the user does not select this checkbox, then the user is not included as a recipient, he will not be able to decrypt any files he encrypts. Sometimes the file will be encrypted using the other person's public key, then the file may be shared with that person in many ways such as email, a website, USB drive or IM messenger. If the sender just wants to send an encrypted file and he still has the non-encrypted copy, he doesn't need to encrypt to self. This setting is saved in gconf and its default value is 'true'. 4.8 Passphrase cache seahorse-agent helps the user cache the passphrase so that the user can perform many operations that require entering the passphrase without re-entering it every time. It takes place of gpg-agent. There are several configurations for the passphrase cache: * Never remember passphrases, * Remember passphreases for ... minutes, * Always remember passphrases whenever logged in * Ask me before using a cached passphrase 4.9 Encryption Applet Encryption Applet performs the various encryption operations using standard OpenPGP methods. It operates on both the Ctrl-C/V and the select/middle click clipboards. Simply copy the desired text using the method of the user's choice, select the encryption operation from the left click menu, follow the prompts and paste the new contents of the clipboard into your application or view them in a display window. 4.10 Enable PGP security for Evolution With the integration of GnuPG, PGP security is enabled in Evolution. The user can sign/verify or encrypt/descrypt email messages. Evolution calls 'gpg' command line to finish all the operations. 4.11 Interfaces: Following interfaces will be added: Exported Interfaces Interface Classification Comments --------------- -------------- ------------------ SUNWseahorse-plugins Uncommitted Package name SUNWseahorse-plugins-root Uncommitted Package name ~/.gconf/desktop/pgp Volatile Config file for seahorse-preferences. /usr/bin/seahorse-agent Volatile seahorse GPG agent for caching PGP passphrase. /usr/bin/seahorse-preferences Volatile preferences for configuring encryption and passphrases cache. /usr/bin/seahorse-tool Volatile a helper program that will encrypt/decrypt or sign/verify a file /usr/lib/bonobo/servers/ GNOME_SeahorseApplet.server Volatile the bonobo file for seahorse applet /usr/lib/gedit-2/plugins/ligseahorse-pgp.so Volatile seahorse plugin library for gedit /usr/lib/gedit-2/plugins/seahorse-pgp.gedit-plugin Volatile seahorse plugin description file for gedit /usr/lib/nautilus/extensions-2.0/ libnautilus-seahorse.so Volatile the library file of seahorse plugin for Nautilus /usr/lib/seahorse/seahorse-applet Volatile seahorse applet /usr/share/applications/seahorse-pgp-encrypted.desktop Volatile desktop file for mime type 'application/pgp-encrypted' /usr/share/applications/seahorse-pgp-keys.desktop Volatile desktop file for mime type 'application/pgp-keys' /usr/share/applications/seahorse-pgp-prepferences.desktop Volatile desktop file for seahorse-preferences /usr/share/applications/seahorse-pgp-signature.desktop Volatile desktop file for mime type 'application/pgp-signature' /usr/share/doc/SUNWseahorse-plugins/* Volatile doc files for seahorse plugins /usr/share/man/man1/seahorse-* Volatile man pages /usr/share/mime/packages/seahorse.xml Volatile a file defines new mime types /usr/share/seahorse-plugins/glade/* Project Private glade files /etc/gconf/schemas/seahorse-gedit.schemas Volatile seahorse plugin schema file for gedit /etc/gconf/schemas/seahorse-plugins.schemas Volatile schema file of seahorse-agent and seahorse-applet Imported Interfaces Interface Classification Comments --------------- --------------- ----------------------- GnuPG Uncommitted PSARC/2009/397 GPGME Uncommitted PSARC/2009/397 sunldap Volatile PSARC/1997/276 libsoup Volatile LSARC/2003/298 libgpg-error Volatile LSARC/2008/207 4.12 Packaging & Delivery: Two new packages are delivered. SUNWseahorse-plugins SUNWseahorse-plugins-root 4.13 Security Impact: Seahorse is just a GUI front-end GnuPG, so all encryption related tasks are managed by GnuPG. Seahorse syncs public keys with key servers using the protocols LDAP and HKP. The communication with the server is not encrypted. It is the user's responsibility to ensure the public key is valid or trusted. Seahorse and Seahorse Plugins, like all GUI programs, depends on Xauth security. These tools under review do not save sensitive information to files directly. Instead, GnuPG does. 4.9 Dependencies: Seahorse depends on GnuPG and GPGME to operate on PGP keys. Seahorse depends on sun ldap and libsoup to access key servers. 5. References [1] Seahorse DBus Interfaces: http://live.gnome.org/Seahorse/DBus [2] Project page: http://www.gnome.org/projects/seahorse 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: Desktop 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: OSD 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From John.Fischer@sun.com Tue Nov 3 08:26:22 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nA3GQLP2024930 for ; Tue, 3 Nov 2009 08:26:22 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id nA3GQDtv050756 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 3 Nov 2009 09:26:21 -0700 (MST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSJ00L5LKBW7600@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Tue, 03 Nov 2009 09:26:20 -0700 (MST) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSJ00H08KBGJ940@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Tue, 03 Nov 2009 09:26:04 -0700 (MST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nA3GQ4iI018665 for ; Tue, 03 Nov 2009 16:26:04 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KSJ00M00IUATO00@mail-amer.sun.com> for LSARC-ext@Sun.Com (ORCPT LSARC-ext@Sun.Com); Tue, 03 Nov 2009 09:26:04 -0700 (MST) Received: from [192.168.10.8] ([unknown] [76.20.56.47]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KSJ00MGDKB6JFA0@mail-amer.sun.com>; Tue, 03 Nov 2009 09:25:54 -0700 (MST) Date: Tue, 03 Nov 2009 08:22:58 -0800 From: John Fischer Subject: Re: Seahorse Update and Seahorse Plugins [LSARC/2009/598 FastTrack timeout 11/10/2009] In-reply-to: <200911030619.nA36Jfru002936@sac.sfbay.sun.com> Sender: John.Fischer@sun.com To: Qing-Ming Jeff Cai Cc: LSARC-ext@sun.com Reply-to: John.Fischer@sun.com Message-id: <4AF058E2.2090508@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911030619.nA36Jfru002936@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.23 (X11/20091013) Status: RO Content-Length: 13821 Jeff, According to the sunldap case that you site the LDAP interface was declared Evolving. This translates into either Uncommitted or Committed depending. Since this was reviewed by PSARC it is most likely Committed but check with someone from the Sun LDAP team. After that you have my +1. Thanks, John Qing-Ming Jeff Cai wrote: > Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI > This information is Copyright 2009 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > Seahorse Update and Seahorse Plugins > 1.2. Name of Document Author/Supplier: > Author: Jeff Cai > 1.3 Date of This Document: > 02 November, 2009 > 4. Technical Description > This information is Copyright 2008 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > Seahorse Update and Seahorse Plugins for OpenSolaris > 1.2. Name of Document Author/Supplier: > Author: Jeff Cai > 1.3 Date of This Document: > 21 October, 2009 > 4. Technical Description > 1. Introduction > 1.1. Project/Component Working Name: > > Seahorse Update and Seahorse Plugins > > 1.2. Name of Document Author/Supplier: > > Author: Jeff Cai > Sponsor: Jeff Cai > > 1.3. Date of This Document: > > 10/29/2009 > > 1.4. Name of Major Document Customer(s)/Consumer(s): > > 1.4.1. The PAC or CPT you expect to review your project: > > Solaris PAC > > 1.4.2. The ARC(s) you expect to review your project: > > LSARC > > 1.4.3. The Director/VP who is "Sponsoring" this project: > > Robert O'Dea > > 1.4.4. The name of your business unit: > > Software - OPG > > 1.5. Email Aliases: > 1.5.1. Responsible Manager: harry.lu@sun.com > 1.5.2. Responsible Engineer: jeff.cai@sun.com > 1.5.3. Marketing Manager: glynn.foster@sun.com > 1.5.4. Interest List: brian.cameron@sun.com > darren.moffat@sun.com > wyllys.ingersoll@sun.com > > 2. Project Summary > 2.1. Project Description: > > Seahorse is a GNOME application for managing SSH, PGP keys and GNOME > keyrings. > > This update enables PGP support of Seahorse after GnuPG's integration. > Thus with Seahorse a user can create and manage PGP keys. > > Seahorse Plugins integrates with nautilus and gedit for > encryption/decryption operations. > > After GnuPG's integration, the PGP security support is also enabled in > Evolution. > > Please refer to sections below for more information about how GnuPG > is used in Nautilus, gedit, and Evolution. > > 4. Technical Description: > > As a frontend of GnuPG, all operations on PGP keys are implemented by GnuPG > or GPGME. > > After enabling PGP supports in Seahorse, following new features are added. > > 4.1 Create and Manage PGP keys > > To create a PGP key using seahorse, the user needs to give a description > of what the key is to be used for. The user needs to specify the > encryption type (DSA Elgamal, RSA or DSA), > the key strength (768-4096) and the passphrase for the key. > > The user can list or delete PGP keys. The user can also change the > passphrase for them. > > Seahorse invokes the interface functions provided by GPGME or 'gpg' command > line to finish all these operations. > > 4.2 Exporting and Importing PGP Keys > > Seahorse can import PGP keys from the clipboard or a key file the same way > as SSH keys. > > Seahorse allows users to specify a PGP key file. Then Seahorse invokes APIs > provided by GPGME to import the key. > > Users can also export PGP private or public keys to files. > > 4.3 Signing the key > > Seahorse allows a user to sign a public PGP key with a private PGP key. > It also provides UI to allow the user to revoke it. > > 4.4 Retrieve PGP public keys from servers or publish them to servers > > Keeps the user's and other's keys up to date by syncing keys periodically > with remote key servers. Syncing will make sure that the user has the > latest signatures made on all of the keys so that the web of trust > will be the most useful. > > Seahorse provides support for HKP and LDAP key servers. > > HKP Servers > HKP keyservers are ordinary web based keyservers such as the popular > hkp://pgp.mit.edu:11371, also accessible at http://pgp.mit.edu. > Seahorse uses libsoup to access HKP servers. > > LDAP Keyservers > LDAP keyservers are less common, but use the standard LDAP protocol > to serve keys. ldap://keyserver.pgp.com is a good LDAP server. > Seahorse uses sunldap to access LDAP servers. > > 4.5 Seahorse plugin for gedit > > This plugin adds three menu items in the gedit's 'Edit' menu: > Sign, Decrypt/Verify and Encrypt. > > These menu options allow the user to sign/verify or encrypt/decrypt the > selected text. > > As a client of seahorse-daemon, it calls DBus interfaces provided in > seahorse-daemon to finish all operations. > > 4.6 Seahorse plugin for Nautilus > > This plugin enables the user to sign/verify or encrypt/decrypt > files in Nautilus. > > After a file is signed or encrypted in Nautilus, a file with the same > name but with a pgp or sig extension will be created. > > The user can also verify/decrypt the file in Nautilus. > > Nautilus calls a command line helper program 'seahorse-tool' which uses > GPGME to finish the encryption operations. > > 4.7 Encryption settings > > The user can use seahorse-preferences to configure some settings which > include: > > * Default Key > > This is the key that will be used by applications and plugins to sign > files. It will also be the key that files will be encrypted to if > encrypt to self is selected. > > The default key id is saved in gconf > ~/.gconf/desktop/pgp/default_key > > * When encrypting, always include myself as a recipient > > If the user does not select this checkbox, then the user is not included > as a recipient, he will not be able to decrypt any files he encrypts. > > Sometimes the file will be encrypted using the other person's public key, > then the file may be shared with that person in many ways such as email, > a website, USB drive or IM messenger. If the sender just wants to send > an encrypted file and he still has the non-encrypted copy, he doesn't > need to encrypt to self. > > This setting is saved in gconf and its default value is 'true'. > > 4.8 Passphrase cache > > seahorse-agent helps the user cache the passphrase so that the user > can perform many operations that require entering the passphrase without > re-entering it every time. It takes place of gpg-agent. > > There are several configurations for the passphrase cache: > > * Never remember passphrases, > * Remember passphreases for ... minutes, > * Always remember passphrases whenever logged in > * Ask me before using a cached passphrase > > 4.9 Encryption Applet > > Encryption Applet performs the various encryption operations using > standard OpenPGP methods. It operates on both the Ctrl-C/V and the > select/middle click clipboards. Simply copy the desired text using > the method of the user's choice, select the encryption operation from > the left click menu, follow the prompts and paste the new contents > of the clipboard into your application or view them in a display > window. > > 4.10 Enable PGP security for Evolution > > With the integration of GnuPG, PGP security is enabled in Evolution. > The user can sign/verify or encrypt/descrypt email messages. > > Evolution calls 'gpg' command line to finish all the operations. > > 4.11 Interfaces: > > Following interfaces will be added: > > Exported Interfaces > Interface Classification Comments > --------------- -------------- ------------------ > SUNWseahorse-plugins Uncommitted Package name > SUNWseahorse-plugins-root Uncommitted Package name > > ~/.gconf/desktop/pgp Volatile Config file for seahorse-preferences. > > > /usr/bin/seahorse-agent Volatile seahorse GPG agent for caching > PGP passphrase. > > /usr/bin/seahorse-preferences Volatile preferences for configuring encryption > and passphrases cache. > > /usr/bin/seahorse-tool Volatile a helper program that will encrypt/decrypt > or sign/verify a file > > /usr/lib/bonobo/servers/ > GNOME_SeahorseApplet.server Volatile the bonobo file for seahorse applet > > /usr/lib/gedit-2/plugins/ligseahorse-pgp.so > Volatile seahorse plugin library for gedit > > /usr/lib/gedit-2/plugins/seahorse-pgp.gedit-plugin > Volatile seahorse plugin description file for gedit > /usr/lib/nautilus/extensions-2.0/ > libnautilus-seahorse.so Volatile the library file of seahorse plugin for Nautilus > /usr/lib/seahorse/seahorse-applet > Volatile seahorse applet > > /usr/share/applications/seahorse-pgp-encrypted.desktop > Volatile > desktop file for mime type 'application/pgp-encrypted' > /usr/share/applications/seahorse-pgp-keys.desktop > Volatile > desktop file for mime type 'application/pgp-keys' > > /usr/share/applications/seahorse-pgp-prepferences.desktop > Volatile > desktop file for seahorse-preferences > > /usr/share/applications/seahorse-pgp-signature.desktop > Volatile > desktop file for mime type 'application/pgp-signature' > > /usr/share/doc/SUNWseahorse-plugins/* > Volatile doc files for seahorse plugins > > /usr/share/man/man1/seahorse-* > Volatile man pages > > /usr/share/mime/packages/seahorse.xml > Volatile a file defines new mime types > > /usr/share/seahorse-plugins/glade/* > Project Private glade files > > /etc/gconf/schemas/seahorse-gedit.schemas > Volatile seahorse plugin schema file for gedit > > /etc/gconf/schemas/seahorse-plugins.schemas > Volatile schema file of seahorse-agent and seahorse-applet > > Imported Interfaces > Interface Classification Comments > --------------- --------------- ----------------------- > GnuPG Uncommitted PSARC/2009/397 > GPGME Uncommitted PSARC/2009/397 > sunldap Volatile PSARC/1997/276 > libsoup Volatile LSARC/2003/298 > libgpg-error Volatile LSARC/2008/207 > > 4.12 Packaging & Delivery: > > Two new packages are delivered. > SUNWseahorse-plugins > SUNWseahorse-plugins-root > > 4.13 Security Impact: > > Seahorse is just a GUI front-end GnuPG, so all encryption related tasks > are managed by GnuPG. > > Seahorse syncs public keys with key servers using the protocols LDAP and > HKP. The communication with the server is not encrypted. > It is the user's responsibility to ensure the public key is valid or > trusted. > > Seahorse and Seahorse Plugins, like all GUI programs, depends on Xauth > security. > > These tools under review do not save sensitive information to files > directly. Instead, GnuPG does. > > 4.9 Dependencies: > > Seahorse depends on GnuPG and GPGME to operate on PGP keys. > Seahorse depends on sun ldap and libsoup to access key servers. > > 5. References > [1] Seahorse DBus Interfaces: > http://live.gnome.org/Seahorse/DBus > [2] Project page: > http://www.gnome.org/projects/seahorse > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > Desktop > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > OSD > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > From John.Fischer@sun.com Tue Nov 3 08:33:17 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nA3GXFYw025036 for ; Tue, 3 Nov 2009 08:33:16 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nA3GX2LE028362 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 3 Nov 2009 16:33:15 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSJ0092FKND8X00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 03 Nov 2009 08:33:13 -0800 (PST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSJ003H1KNDTB40@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 03 Nov 2009 08:33:13 -0800 (PST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nA3GXDDV028062 for ; Tue, 03 Nov 2009 16:33:13 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KSJ00M00IUATO00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Tue, 03 Nov 2009 09:33:12 -0700 (MST) Received: from [192.168.10.8] ([unknown] [76.20.56.47]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KSJ00MESKN9JFE0@mail-amer.sun.com>; Tue, 03 Nov 2009 09:33:10 -0700 (MST) Date: Tue, 03 Nov 2009 08:30:14 -0800 From: John Fischer Subject: Re: Seahorse Update and Seahorse Plugins [LSARC/2009/598 FastTrack timeout 11/10/2009] In-reply-to: <4AF058E2.2090508@sun.com> Sender: John.Fischer@sun.com To: Qing-Ming Jeff Cai Cc: LSARC-ext@sun.com Reply-to: John.Fischer@sun.com Message-id: <4AF05A96.4070904@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911030619.nA36Jfru002936@sac.sfbay.sun.com> <4AF058E2.2090508@sun.com> User-Agent: Thunderbird 2.0.0.23 (X11/20091013) Status: RO Content-Length: 14376 Jeff, Actually, after second thought you have my +1. The Sun LDAP classification is a nit. Thanks, John John Fischer wrote: > Jeff, > > According to the sunldap case that you site the LDAP > interface was declared Evolving. This translates into > either Uncommitted or Committed depending. Since this > was reviewed by PSARC it is most likely Committed but > check with someone from the Sun LDAP team. > > After that you have my +1. > > Thanks, > > John > > > Qing-Ming Jeff Cai wrote: >> Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI >> This information is Copyright 2009 Sun Microsystems >> 1. Introduction >> 1.1. Project/Component Working Name: >> Seahorse Update and Seahorse Plugins >> 1.2. Name of Document Author/Supplier: >> Author: Jeff Cai >> 1.3 Date of This Document: >> 02 November, 2009 >> 4. Technical Description >> This information is Copyright 2008 Sun Microsystems >> 1. Introduction >> 1.1. Project/Component Working Name: >> Seahorse Update and Seahorse Plugins for OpenSolaris >> 1.2. Name of Document Author/Supplier: >> Author: Jeff Cai >> 1.3 Date of This Document: >> 21 October, 2009 >> 4. Technical Description >> 1. Introduction >> 1.1. Project/Component Working Name: >> >> Seahorse Update and Seahorse Plugins >> >> 1.2. Name of Document Author/Supplier: >> Author: Jeff Cai >> Sponsor: Jeff Cai >> >> 1.3. Date of This Document: >> >> 10/29/2009 >> >> 1.4. Name of Major Document Customer(s)/Consumer(s): >> >> 1.4.1. The PAC or CPT you expect to review your project: >> >> Solaris PAC >> >> 1.4.2. The ARC(s) you expect to review your project: >> >> LSARC >> >> 1.4.3. The Director/VP who is "Sponsoring" this project: >> >> Robert O'Dea >> >> 1.4.4. The name of your business unit: >> >> Software - OPG >> >> 1.5. Email Aliases: >> 1.5.1. Responsible Manager: harry.lu@sun.com >> 1.5.2. Responsible Engineer: jeff.cai@sun.com >> 1.5.3. Marketing Manager: glynn.foster@sun.com >> 1.5.4. Interest List: brian.cameron@sun.com >> darren.moffat@sun.com >> wyllys.ingersoll@sun.com >> >> 2. Project Summary >> 2.1. Project Description: >> >> Seahorse is a GNOME application for managing SSH, PGP keys and >> GNOME keyrings. >> This update enables PGP support of Seahorse after GnuPG's integration. >> Thus with Seahorse a user can create and manage PGP keys. >> >> Seahorse Plugins integrates with nautilus and gedit for >> encryption/decryption operations. >> >> After GnuPG's integration, the PGP security support is also enabled >> in Evolution. >> >> Please refer to sections below for more information about how GnuPG >> is used in Nautilus, gedit, and Evolution. >> >> 4. Technical Description: >> >> As a frontend of GnuPG, all operations on PGP keys are implemented >> by GnuPG or GPGME. >> After enabling PGP supports in Seahorse, following new features >> are added. >> >> 4.1 Create and Manage PGP keys >> >> To create a PGP key using seahorse, the user needs to give a >> description of what the key is to be used for. The user needs to >> specify the encryption type (DSA Elgamal, RSA or DSA), the key >> strength (768-4096) and the passphrase for the key. >> The user can list or delete PGP keys. The user can also change the >> passphrase for them. >> >> Seahorse invokes the interface functions provided by GPGME or >> 'gpg' command >> line to finish all these operations. >> >> 4.2 Exporting and Importing PGP Keys >> >> Seahorse can import PGP keys from the clipboard or a key file the >> same way as SSH keys. >> Seahorse allows users to specify a PGP key file. Then Seahorse >> invokes APIs >> provided by GPGME to import the key. >> >> Users can also export PGP private or public keys to files. >> 4.3 Signing the key >> >> Seahorse allows a user to sign a public PGP key with a private PGP >> key. It also provides UI to allow the user to revoke it. >> >> 4.4 Retrieve PGP public keys from servers or publish them to servers >> >> Keeps the user's and other's keys up to date by syncing keys >> periodically >> with remote key servers. Syncing will make sure that the user has >> the latest signatures made on all of the keys so that the web of >> trust >> will be the most useful. >> >> Seahorse provides support for HKP and LDAP key servers. >> >> HKP Servers >> HKP keyservers are ordinary web based keyservers such as the >> popular >> hkp://pgp.mit.edu:11371, also accessible at http://pgp.mit.edu. >> Seahorse uses libsoup to access HKP servers. >> >> LDAP Keyservers >> LDAP keyservers are less common, but use the standard LDAP >> protocol >> to serve keys. ldap://keyserver.pgp.com is a good LDAP server. >> Seahorse uses sunldap to access LDAP servers. >> >> 4.5 Seahorse plugin for gedit >> >> This plugin adds three menu items in the gedit's 'Edit' menu: >> Sign, Decrypt/Verify and Encrypt. >> >> These menu options allow the user to sign/verify or >> encrypt/decrypt the selected text. >> >> As a client of seahorse-daemon, it calls DBus interfaces provided in >> seahorse-daemon to finish all operations. >> >> 4.6 Seahorse plugin for Nautilus >> >> This plugin enables the user to sign/verify or encrypt/decrypt >> files in Nautilus. >> >> After a file is signed or encrypted in Nautilus, a file with the same >> name but with a pgp or sig extension will be created. >> The user can also verify/decrypt the file in Nautilus. >> >> Nautilus calls a command line helper program 'seahorse-tool' which >> uses >> GPGME to finish the encryption operations. >> >> 4.7 Encryption settings >> >> The user can use seahorse-preferences to configure some settings >> which >> include: >> >> * Default Key >> >> This is the key that will be used by applications and plugins to >> sign >> files. It will also be the key that files will be encrypted to if >> encrypt to self is selected. >> >> The default key id is saved in gconf >> ~/.gconf/desktop/pgp/default_key >> >> * When encrypting, always include myself as a recipient >> >> If the user does not select this checkbox, then the user is not >> included >> as a recipient, he will not be able to decrypt any files he >> encrypts. >> >> Sometimes the file will be encrypted using the other person's >> public key, >> then the file may be shared with that person in many ways such >> as email, a website, USB drive or IM messenger. If the sender >> just wants to send >> an encrypted file and he still has the non-encrypted copy, he >> doesn't >> need to encrypt to self. >> >> This setting is saved in gconf and its default value is 'true'. >> >> 4.8 Passphrase cache >> >> seahorse-agent helps the user cache the passphrase so that the >> user can perform many operations that require entering the >> passphrase without re-entering it every time. It takes place >> of gpg-agent. >> >> There are several configurations for the passphrase cache: >> >> * Never remember passphrases, * Remember >> passphreases for ... minutes, >> * Always remember passphrases whenever logged in >> * Ask me before using a cached passphrase >> >> 4.9 Encryption Applet >> >> Encryption Applet performs the various encryption operations using >> standard OpenPGP methods. It operates on both the Ctrl-C/V and >> the select/middle click clipboards. Simply copy the desired >> text using >> the method of the user's choice, select the encryption >> operation from >> the left click menu, follow the prompts and paste the new contents >> of the clipboard into your application or view them in a display >> window. >> >> 4.10 Enable PGP security for Evolution >> With the integration of GnuPG, PGP security is enabled in >> Evolution. >> The user can sign/verify or encrypt/descrypt email messages. >> >> Evolution calls 'gpg' command line to finish all the operations. >> >> 4.11 Interfaces: >> >> Following interfaces will be added: >> >> Exported Interfaces >> Interface Classification Comments >> --------------- -------------- >> ------------------ >> SUNWseahorse-plugins Uncommitted Package >> name SUNWseahorse-plugins-root Uncommitted >> Package name >> ~/.gconf/desktop/pgp Volatile Config file >> for seahorse-preferences. >> >> >> /usr/bin/seahorse-agent Volatile seahorse GPG >> agent for caching >> PGP passphrase. >> >> /usr/bin/seahorse-preferences Volatile preferences >> for configuring encryption >> and passphrases cache. >> /usr/bin/seahorse-tool Volatile a helper program that >> will encrypt/decrypt >> or sign/verify >> a file >> >> /usr/lib/bonobo/servers/ >> GNOME_SeahorseApplet.server Volatile the bonobo >> file for seahorse applet >> >> /usr/lib/gedit-2/plugins/ligseahorse-pgp.so >> Volatile seahorse >> plugin library for gedit >> >> /usr/lib/gedit-2/plugins/seahorse-pgp.gedit-plugin >> Volatile seahorse >> plugin description file for gedit >> /usr/lib/nautilus/extensions-2.0/ >> libnautilus-seahorse.so Volatile the library >> file of seahorse plugin for Nautilus >> /usr/lib/seahorse/seahorse-applet >> Volatile seahorse applet >> >> /usr/share/applications/seahorse-pgp-encrypted.desktop >> Volatile >> desktop file >> for mime type 'application/pgp-encrypted' >> /usr/share/applications/seahorse-pgp-keys.desktop >> Volatile >> desktop file >> for mime type 'application/pgp-keys' >> >> /usr/share/applications/seahorse-pgp-prepferences.desktop >> Volatile >> desktop file >> for seahorse-preferences >> >> /usr/share/applications/seahorse-pgp-signature.desktop >> Volatile >> desktop file >> for mime type 'application/pgp-signature' >> >> /usr/share/doc/SUNWseahorse-plugins/* >> Volatile doc files for >> seahorse plugins >> >> /usr/share/man/man1/seahorse-* >> Volatile man pages >> >> /usr/share/mime/packages/seahorse.xml >> Volatile a file defines >> new mime types >> >> /usr/share/seahorse-plugins/glade/* >> Project Private glade files >> >> /etc/gconf/schemas/seahorse-gedit.schemas >> Volatile seahorse >> plugin schema file for gedit >> >> /etc/gconf/schemas/seahorse-plugins.schemas >> Volatile schema file of >> seahorse-agent and seahorse-applet >> Imported Interfaces >> Interface Classification Comments >> --------------- --------------- ----------------------- >> GnuPG Uncommitted PSARC/2009/397 >> GPGME Uncommitted PSARC/2009/397 >> sunldap Volatile PSARC/1997/276 >> libsoup Volatile LSARC/2003/298 >> libgpg-error Volatile LSARC/2008/207 >> 4.12 Packaging & Delivery: >> Two new packages are delivered. >> SUNWseahorse-plugins SUNWseahorse-plugins-root >> >> 4.13 Security Impact: >> Seahorse is just a GUI front-end GnuPG, so all encryption >> related tasks are managed by GnuPG. >> >> Seahorse syncs public keys with key servers using the protocols >> LDAP and HKP. The communication with the server is not encrypted. >> It is the user's responsibility to ensure the public key is valid >> or trusted. >> >> Seahorse and Seahorse Plugins, like all GUI programs, depends on >> Xauth security. >> These tools under review do not save sensitive information to >> files directly. Instead, GnuPG does. >> >> 4.9 Dependencies: >> Seahorse depends on GnuPG and GPGME to operate on PGP keys. >> Seahorse depends on sun ldap and libsoup to access key servers. >> 5. References >> [1] Seahorse DBus Interfaces: >> http://live.gnome.org/Seahorse/DBus >> [2] Project page: >> http://www.gnome.org/projects/seahorse >> 6. Resources and Schedule >> 6.4. Steering Committee requested information >> 6.4.1. Consolidation C-team Name: >> Desktop >> 6.5. ARC review type: FastTrack >> 6.6. ARC Exposure: open >> >> >> 6. Resources and Schedule >> 6.4. Steering Committee requested information >> 6.4.1. Consolidation C-team Name: >> OSD >> 6.5. ARC review type: FastTrack >> 6.6. ARC Exposure: open >> From Jeff.Cai@sun.com Wed Nov 4 23:49:55 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nA57ns4S025721 for ; Wed, 4 Nov 2009 23:49:55 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nA57ni1S015570 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 5 Nov 2009 07:49:54 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSM00603LR4CO00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Wed, 04 Nov 2009 23:49:52 -0800 (PST) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSM0086DLR3J4C0@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Wed, 04 Nov 2009 23:49:52 -0800 (PST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nA57npg3023554 for ; Thu, 05 Nov 2009 07:49:51 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KSM00M00LNQCG00@mail-apac.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Thu, 05 Nov 2009 15:49:51 +0800 (SGT) Received: from [129.158.217.59] ([unknown] [129.158.217.59]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KSM000FLLR2SGD0@mail-apac.sun.com>; Thu, 05 Nov 2009 15:49:51 +0800 (SGT) Date: Thu, 05 Nov 2009 15:50:21 +0800 From: Jeff Cai Subject: Re: Seahorse Update and Seahorse Plugins [LSARC/2009/598 FastTrack timeout 11/10/2009] In-reply-to: <4AF058E2.2090508@sun.com> Sender: Jeff.Cai@sun.com To: John.Fischer@sun.com Cc: Qing-Ming Jeff Cai , LSARC-ext@sun.com Message-id: <1257407421.1544.1.camel@marathon> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911030619.nA36Jfru002936@sac.sfbay.sun.com> <4AF058E2.2090508@sun.com> Status: RO Content-Length: 14647 On Tue, 2009-11-03 at 08:22 -0800, John Fischer wrote: > Jeff, > > According to the sunldap case that you site the LDAP > interface was declared Evolving. This translates into > either Uncommitted or Committed depending. Since this > was reviewed by PSARC it is most likely Committed but > check with someone from the Sun LDAP team. > > After that you have my +1. John, I'll update the interface to 'Committed'. Thanks Jeff > > Thanks, > > John > > > Qing-Ming Jeff Cai wrote: > > Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI > > This information is Copyright 2009 Sun Microsystems > > 1. Introduction > > 1.1. Project/Component Working Name: > > Seahorse Update and Seahorse Plugins > > 1.2. Name of Document Author/Supplier: > > Author: Jeff Cai > > 1.3 Date of This Document: > > 02 November, 2009 > > 4. Technical Description > > This information is Copyright 2008 Sun Microsystems > > 1. Introduction > > 1.1. Project/Component Working Name: > > Seahorse Update and Seahorse Plugins for OpenSolaris > > 1.2. Name of Document Author/Supplier: > > Author: Jeff Cai > > 1.3 Date of This Document: > > 21 October, 2009 > > 4. Technical Description > > 1. Introduction > > 1.1. Project/Component Working Name: > > > > Seahorse Update and Seahorse Plugins > > > > 1.2. Name of Document Author/Supplier: > > > > Author: Jeff Cai > > Sponsor: Jeff Cai > > > > 1.3. Date of This Document: > > > > 10/29/2009 > > > > 1.4. Name of Major Document Customer(s)/Consumer(s): > > > > 1.4.1. The PAC or CPT you expect to review your project: > > > > Solaris PAC > > > > 1.4.2. The ARC(s) you expect to review your project: > > > > LSARC > > > > 1.4.3. The Director/VP who is "Sponsoring" this project: > > > > Robert O'Dea > > > > 1.4.4. The name of your business unit: > > > > Software - OPG > > > > 1.5. Email Aliases: > > 1.5.1. Responsible Manager: harry.lu@sun.com > > 1.5.2. Responsible Engineer: jeff.cai@sun.com > > 1.5.3. Marketing Manager: glynn.foster@sun.com > > 1.5.4. Interest List: brian.cameron@sun.com > > darren.moffat@sun.com > > wyllys.ingersoll@sun.com > > > > 2. Project Summary > > 2.1. Project Description: > > > > Seahorse is a GNOME application for managing SSH, PGP keys and GNOME > > keyrings. > > > > This update enables PGP support of Seahorse after GnuPG's integration. > > Thus with Seahorse a user can create and manage PGP keys. > > > > Seahorse Plugins integrates with nautilus and gedit for > > encryption/decryption operations. > > > > After GnuPG's integration, the PGP security support is also enabled in > > Evolution. > > > > Please refer to sections below for more information about how GnuPG > > is used in Nautilus, gedit, and Evolution. > > > > 4. Technical Description: > > > > As a frontend of GnuPG, all operations on PGP keys are implemented by GnuPG > > or GPGME. > > > > After enabling PGP supports in Seahorse, following new features are added. > > > > 4.1 Create and Manage PGP keys > > > > To create a PGP key using seahorse, the user needs to give a description > > of what the key is to be used for. The user needs to specify the > > encryption type (DSA Elgamal, RSA or DSA), > > the key strength (768-4096) and the passphrase for the key. > > > > The user can list or delete PGP keys. The user can also change the > > passphrase for them. > > > > Seahorse invokes the interface functions provided by GPGME or 'gpg' command > > line to finish all these operations. > > > > 4.2 Exporting and Importing PGP Keys > > > > Seahorse can import PGP keys from the clipboard or a key file the same way > > as SSH keys. > > > > Seahorse allows users to specify a PGP key file. Then Seahorse invokes APIs > > provided by GPGME to import the key. > > > > Users can also export PGP private or public keys to files. > > > > 4.3 Signing the key > > > > Seahorse allows a user to sign a public PGP key with a private PGP key. > > It also provides UI to allow the user to revoke it. > > > > 4.4 Retrieve PGP public keys from servers or publish them to servers > > > > Keeps the user's and other's keys up to date by syncing keys periodically > > with remote key servers. Syncing will make sure that the user has the > > latest signatures made on all of the keys so that the web of trust > > will be the most useful. > > > > Seahorse provides support for HKP and LDAP key servers. > > > > HKP Servers > > HKP keyservers are ordinary web based keyservers such as the popular > > hkp://pgp.mit.edu:11371, also accessible at http://pgp.mit.edu. > > Seahorse uses libsoup to access HKP servers. > > > > LDAP Keyservers > > LDAP keyservers are less common, but use the standard LDAP protocol > > to serve keys. ldap://keyserver.pgp.com is a good LDAP server. > > Seahorse uses sunldap to access LDAP servers. > > > > 4.5 Seahorse plugin for gedit > > > > This plugin adds three menu items in the gedit's 'Edit' menu: > > Sign, Decrypt/Verify and Encrypt. > > > > These menu options allow the user to sign/verify or encrypt/decrypt the > > selected text. > > > > As a client of seahorse-daemon, it calls DBus interfaces provided in > > seahorse-daemon to finish all operations. > > > > 4.6 Seahorse plugin for Nautilus > > > > This plugin enables the user to sign/verify or encrypt/decrypt > > files in Nautilus. > > > > After a file is signed or encrypted in Nautilus, a file with the same > > name but with a pgp or sig extension will be created. > > > > The user can also verify/decrypt the file in Nautilus. > > > > Nautilus calls a command line helper program 'seahorse-tool' which uses > > GPGME to finish the encryption operations. > > > > 4.7 Encryption settings > > > > The user can use seahorse-preferences to configure some settings which > > include: > > > > * Default Key > > > > This is the key that will be used by applications and plugins to sign > > files. It will also be the key that files will be encrypted to if > > encrypt to self is selected. > > > > The default key id is saved in gconf > > ~/.gconf/desktop/pgp/default_key > > > > * When encrypting, always include myself as a recipient > > > > If the user does not select this checkbox, then the user is not included > > as a recipient, he will not be able to decrypt any files he encrypts. > > > > Sometimes the file will be encrypted using the other person's public key, > > then the file may be shared with that person in many ways such as email, > > a website, USB drive or IM messenger. If the sender just wants to send > > an encrypted file and he still has the non-encrypted copy, he doesn't > > need to encrypt to self. > > > > This setting is saved in gconf and its default value is 'true'. > > > > 4.8 Passphrase cache > > > > seahorse-agent helps the user cache the passphrase so that the user > > can perform many operations that require entering the passphrase without > > re-entering it every time. It takes place of gpg-agent. > > > > There are several configurations for the passphrase cache: > > > > * Never remember passphrases, > > * Remember passphreases for ... minutes, > > * Always remember passphrases whenever logged in > > * Ask me before using a cached passphrase > > > > 4.9 Encryption Applet > > > > Encryption Applet performs the various encryption operations using > > standard OpenPGP methods. It operates on both the Ctrl-C/V and the > > select/middle click clipboards. Simply copy the desired text using > > the method of the user's choice, select the encryption operation from > > the left click menu, follow the prompts and paste the new contents > > of the clipboard into your application or view them in a display > > window. > > > > 4.10 Enable PGP security for Evolution > > > > With the integration of GnuPG, PGP security is enabled in Evolution. > > The user can sign/verify or encrypt/descrypt email messages. > > > > Evolution calls 'gpg' command line to finish all the operations. > > > > 4.11 Interfaces: > > > > Following interfaces will be added: > > > > Exported Interfaces > > Interface Classification Comments > > --------------- -------------- ------------------ > > SUNWseahorse-plugins Uncommitted Package name > > SUNWseahorse-plugins-root Uncommitted Package name > > > > ~/.gconf/desktop/pgp Volatile Config file for seahorse-preferences. > > > > > > /usr/bin/seahorse-agent Volatile seahorse GPG agent for caching > > PGP passphrase. > > > > /usr/bin/seahorse-preferences Volatile preferences for configuring encryption > > and passphrases cache. > > > > /usr/bin/seahorse-tool Volatile a helper program that will encrypt/decrypt > > or sign/verify a file > > > > /usr/lib/bonobo/servers/ > > GNOME_SeahorseApplet.server Volatile the bonobo file for seahorse applet > > > > /usr/lib/gedit-2/plugins/ligseahorse-pgp.so > > Volatile seahorse plugin library for gedit > > > > /usr/lib/gedit-2/plugins/seahorse-pgp.gedit-plugin > > Volatile seahorse plugin description file for gedit > > /usr/lib/nautilus/extensions-2.0/ > > libnautilus-seahorse.so Volatile the library file of seahorse plugin for Nautilus > > /usr/lib/seahorse/seahorse-applet > > Volatile seahorse applet > > > > /usr/share/applications/seahorse-pgp-encrypted.desktop > > Volatile > > desktop file for mime type 'application/pgp-encrypted' > > /usr/share/applications/seahorse-pgp-keys.desktop > > Volatile > > desktop file for mime type 'application/pgp-keys' > > > > /usr/share/applications/seahorse-pgp-prepferences.desktop > > Volatile > > desktop file for seahorse-preferences > > > > /usr/share/applications/seahorse-pgp-signature.desktop > > Volatile > > desktop file for mime type 'application/pgp-signature' > > > > /usr/share/doc/SUNWseahorse-plugins/* > > Volatile doc files for seahorse plugins > > > > /usr/share/man/man1/seahorse-* > > Volatile man pages > > > > /usr/share/mime/packages/seahorse.xml > > Volatile a file defines new mime types > > > > /usr/share/seahorse-plugins/glade/* > > Project Private glade files > > > > /etc/gconf/schemas/seahorse-gedit.schemas > > Volatile seahorse plugin schema file for gedit > > > > /etc/gconf/schemas/seahorse-plugins.schemas > > Volatile schema file of seahorse-agent and seahorse-applet > > > > Imported Interfaces > > Interface Classification Comments > > --------------- --------------- ----------------------- > > GnuPG Uncommitted PSARC/2009/397 > > GPGME Uncommitted PSARC/2009/397 > > sunldap Volatile PSARC/1997/276 > > libsoup Volatile LSARC/2003/298 > > libgpg-error Volatile LSARC/2008/207 > > > > 4.12 Packaging & Delivery: > > > > Two new packages are delivered. > > SUNWseahorse-plugins > > SUNWseahorse-plugins-root > > > > 4.13 Security Impact: > > > > Seahorse is just a GUI front-end GnuPG, so all encryption related tasks > > are managed by GnuPG. > > > > Seahorse syncs public keys with key servers using the protocols LDAP and > > HKP. The communication with the server is not encrypted. > > It is the user's responsibility to ensure the public key is valid or > > trusted. > > > > Seahorse and Seahorse Plugins, like all GUI programs, depends on Xauth > > security. > > > > These tools under review do not save sensitive information to files > > directly. Instead, GnuPG does. > > > > 4.9 Dependencies: > > > > Seahorse depends on GnuPG and GPGME to operate on PGP keys. > > Seahorse depends on sun ldap and libsoup to access key servers. > > > > 5. References > > [1] Seahorse DBus Interfaces: > > http://live.gnome.org/Seahorse/DBus > > [2] Project page: > > http://www.gnome.org/projects/seahorse > > 6. Resources and Schedule > > 6.4. Steering Committee requested information > > 6.4.1. Consolidation C-team Name: > > Desktop > > 6.5. ARC review type: FastTrack > > 6.6. ARC Exposure: open > > > > > > 6. Resources and Schedule > > 6.4. Steering Committee requested information > > 6.4.1. Consolidation C-team Name: > > OSD > > 6.5. ARC review type: FastTrack > > 6.6. ARC Exposure: open > > From Jeff.Cai@Sun.COM Wed Nov 11 02:38:50 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABAcoMn020035 for ; Wed, 11 Nov 2009 02:38:50 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nABAcoVr029531 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 11 Nov 2009 02:38:50 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSX00105XKO2C00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Wed, 11 Nov 2009 02:38:48 -0800 (PST) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSX008KGXKMS8E0@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Wed, 11 Nov 2009 02:38:47 -0800 (PST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nABAckll014943 for ; Wed, 11 Nov 2009 10:38:46 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KSX00K00X7C2Y00@mail-apac.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Wed, 11 Nov 2009 18:38:46 +0800 (SGT) Received: from [129.158.217.59] ([unknown] [129.158.217.59]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KSX00INZXKJGEA0@mail-apac.sun.com>; Wed, 11 Nov 2009 18:38:44 +0800 (SGT) Date: Wed, 11 Nov 2009 18:39:14 +0800 From: Jeff Cai Subject: Re: Seahorse Update and Seahorse Plugins [LSARC/2009/598 FastTrack timeout 11/10/2009] In-reply-to: <1257407421.1544.1.camel@marathon> Sender: Jeff.Cai@Sun.COM To: John.Fischer@Sun.COM Cc: Qing-Ming Jeff Cai , LSARC-ext@Sun.COM Message-id: <1257935954.15.13.camel@marathon> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911030619.nA36Jfru002936@sac.sfbay.sun.com> <4AF058E2.2090508@sun.com> <1257407421.1544.1.camel@marathon> Status: RO Content-Length: 15487 Since the time is out I closed this case as approved. Jeff On Thu, 2009-11-05 at 15:50 +0800, Jeff Cai wrote: > On Tue, 2009-11-03 at 08:22 -0800, John Fischer wrote: > > Jeff, > > > > According to the sunldap case that you site the LDAP > > interface was declared Evolving. This translates into > > either Uncommitted or Committed depending. Since this > > was reviewed by PSARC it is most likely Committed but > > check with someone from the Sun LDAP team. > > > > After that you have my +1. > > John, > > I'll update the interface to 'Committed'. > > Thanks > > Jeff > > > > Thanks, > > > > John > > > > > > Qing-Ming Jeff Cai wrote: > > > Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI > > > This information is Copyright 2009 Sun Microsystems > > > 1. Introduction > > > 1.1. Project/Component Working Name: > > > Seahorse Update and Seahorse Plugins > > > 1.2. Name of Document Author/Supplier: > > > Author: Jeff Cai > > > 1.3 Date of This Document: > > > 02 November, 2009 > > > 4. Technical Description > > > This information is Copyright 2008 Sun Microsystems > > > 1. Introduction > > > 1.1. Project/Component Working Name: > > > Seahorse Update and Seahorse Plugins for OpenSolaris > > > 1.2. Name of Document Author/Supplier: > > > Author: Jeff Cai > > > 1.3 Date of This Document: > > > 21 October, 2009 > > > 4. Technical Description > > > 1. Introduction > > > 1.1. Project/Component Working Name: > > > > > > Seahorse Update and Seahorse Plugins > > > > > > 1.2. Name of Document Author/Supplier: > > > > > > Author: Jeff Cai > > > Sponsor: Jeff Cai > > > > > > 1.3. Date of This Document: > > > > > > 10/29/2009 > > > > > > 1.4. Name of Major Document Customer(s)/Consumer(s): > > > > > > 1.4.1. The PAC or CPT you expect to review your project: > > > > > > Solaris PAC > > > > > > 1.4.2. The ARC(s) you expect to review your project: > > > > > > LSARC > > > > > > 1.4.3. The Director/VP who is "Sponsoring" this project: > > > > > > Robert O'Dea > > > > > > 1.4.4. The name of your business unit: > > > > > > Software - OPG > > > > > > 1.5. Email Aliases: > > > 1.5.1. Responsible Manager: harry.lu@sun.com > > > 1.5.2. Responsible Engineer: jeff.cai@sun.com > > > 1.5.3. Marketing Manager: glynn.foster@sun.com > > > 1.5.4. Interest List: brian.cameron@sun.com > > > darren.moffat@sun.com > > > wyllys.ingersoll@sun.com > > > > > > 2. Project Summary > > > 2.1. Project Description: > > > > > > Seahorse is a GNOME application for managing SSH, PGP keys and GNOME > > > keyrings. > > > > > > This update enables PGP support of Seahorse after GnuPG's integration. > > > Thus with Seahorse a user can create and manage PGP keys. > > > > > > Seahorse Plugins integrates with nautilus and gedit for > > > encryption/decryption operations. > > > > > > After GnuPG's integration, the PGP security support is also enabled in > > > Evolution. > > > > > > Please refer to sections below for more information about how GnuPG > > > is used in Nautilus, gedit, and Evolution. > > > > > > 4. Technical Description: > > > > > > As a frontend of GnuPG, all operations on PGP keys are implemented by GnuPG > > > or GPGME. > > > > > > After enabling PGP supports in Seahorse, following new features are added. > > > > > > 4.1 Create and Manage PGP keys > > > > > > To create a PGP key using seahorse, the user needs to give a description > > > of what the key is to be used for. The user needs to specify the > > > encryption type (DSA Elgamal, RSA or DSA), > > > the key strength (768-4096) and the passphrase for the key. > > > > > > The user can list or delete PGP keys. The user can also change the > > > passphrase for them. > > > > > > Seahorse invokes the interface functions provided by GPGME or 'gpg' command > > > line to finish all these operations. > > > > > > 4.2 Exporting and Importing PGP Keys > > > > > > Seahorse can import PGP keys from the clipboard or a key file the same way > > > as SSH keys. > > > > > > Seahorse allows users to specify a PGP key file. Then Seahorse invokes APIs > > > provided by GPGME to import the key. > > > > > > Users can also export PGP private or public keys to files. > > > > > > 4.3 Signing the key > > > > > > Seahorse allows a user to sign a public PGP key with a private PGP key. > > > It also provides UI to allow the user to revoke it. > > > > > > 4.4 Retrieve PGP public keys from servers or publish them to servers > > > > > > Keeps the user's and other's keys up to date by syncing keys periodically > > > with remote key servers. Syncing will make sure that the user has the > > > latest signatures made on all of the keys so that the web of trust > > > will be the most useful. > > > > > > Seahorse provides support for HKP and LDAP key servers. > > > > > > HKP Servers > > > HKP keyservers are ordinary web based keyservers such as the popular > > > hkp://pgp.mit.edu:11371, also accessible at http://pgp.mit.edu. > > > Seahorse uses libsoup to access HKP servers. > > > > > > LDAP Keyservers > > > LDAP keyservers are less common, but use the standard LDAP protocol > > > to serve keys. ldap://keyserver.pgp.com is a good LDAP server. > > > Seahorse uses sunldap to access LDAP servers. > > > > > > 4.5 Seahorse plugin for gedit > > > > > > This plugin adds three menu items in the gedit's 'Edit' menu: > > > Sign, Decrypt/Verify and Encrypt. > > > > > > These menu options allow the user to sign/verify or encrypt/decrypt the > > > selected text. > > > > > > As a client of seahorse-daemon, it calls DBus interfaces provided in > > > seahorse-daemon to finish all operations. > > > > > > 4.6 Seahorse plugin for Nautilus > > > > > > This plugin enables the user to sign/verify or encrypt/decrypt > > > files in Nautilus. > > > > > > After a file is signed or encrypted in Nautilus, a file with the same > > > name but with a pgp or sig extension will be created. > > > > > > The user can also verify/decrypt the file in Nautilus. > > > > > > Nautilus calls a command line helper program 'seahorse-tool' which uses > > > GPGME to finish the encryption operations. > > > > > > 4.7 Encryption settings > > > > > > The user can use seahorse-preferences to configure some settings which > > > include: > > > > > > * Default Key > > > > > > This is the key that will be used by applications and plugins to sign > > > files. It will also be the key that files will be encrypted to if > > > encrypt to self is selected. > > > > > > The default key id is saved in gconf > > > ~/.gconf/desktop/pgp/default_key > > > > > > * When encrypting, always include myself as a recipient > > > > > > If the user does not select this checkbox, then the user is not included > > > as a recipient, he will not be able to decrypt any files he encrypts. > > > > > > Sometimes the file will be encrypted using the other person's public key, > > > then the file may be shared with that person in many ways such as email, > > > a website, USB drive or IM messenger. If the sender just wants to send > > > an encrypted file and he still has the non-encrypted copy, he doesn't > > > need to encrypt to self. > > > > > > This setting is saved in gconf and its default value is 'true'. > > > > > > 4.8 Passphrase cache > > > > > > seahorse-agent helps the user cache the passphrase so that the user > > > can perform many operations that require entering the passphrase without > > > re-entering it every time. It takes place of gpg-agent. > > > > > > There are several configurations for the passphrase cache: > > > > > > * Never remember passphrases, > > > * Remember passphreases for ... minutes, > > > * Always remember passphrases whenever logged in > > > * Ask me before using a cached passphrase > > > > > > 4.9 Encryption Applet > > > > > > Encryption Applet performs the various encryption operations using > > > standard OpenPGP methods. It operates on both the Ctrl-C/V and the > > > select/middle click clipboards. Simply copy the desired text using > > > the method of the user's choice, select the encryption operation from > > > the left click menu, follow the prompts and paste the new contents > > > of the clipboard into your application or view them in a display > > > window. > > > > > > 4.10 Enable PGP security for Evolution > > > > > > With the integration of GnuPG, PGP security is enabled in Evolution. > > > The user can sign/verify or encrypt/descrypt email messages. > > > > > > Evolution calls 'gpg' command line to finish all the operations. > > > > > > 4.11 Interfaces: > > > > > > Following interfaces will be added: > > > > > > Exported Interfaces > > > Interface Classification Comments > > > --------------- -------------- ------------------ > > > SUNWseahorse-plugins Uncommitted Package name > > > SUNWseahorse-plugins-root Uncommitted Package name > > > > > > ~/.gconf/desktop/pgp Volatile Config file for seahorse-preferences. > > > > > > > > > /usr/bin/seahorse-agent Volatile seahorse GPG agent for caching > > > PGP passphrase. > > > > > > /usr/bin/seahorse-preferences Volatile preferences for configuring encryption > > > and passphrases cache. > > > > > > /usr/bin/seahorse-tool Volatile a helper program that will encrypt/decrypt > > > or sign/verify a file > > > > > > /usr/lib/bonobo/servers/ > > > GNOME_SeahorseApplet.server Volatile the bonobo file for seahorse applet > > > > > > /usr/lib/gedit-2/plugins/ligseahorse-pgp.so > > > Volatile seahorse plugin library for gedit > > > > > > /usr/lib/gedit-2/plugins/seahorse-pgp.gedit-plugin > > > Volatile seahorse plugin description file for gedit > > > /usr/lib/nautilus/extensions-2.0/ > > > libnautilus-seahorse.so Volatile the library file of seahorse plugin for Nautilus > > > /usr/lib/seahorse/seahorse-applet > > > Volatile seahorse applet > > > > > > /usr/share/applications/seahorse-pgp-encrypted.desktop > > > Volatile > > > desktop file for mime type 'application/pgp-encrypted' > > > /usr/share/applications/seahorse-pgp-keys.desktop > > > Volatile > > > desktop file for mime type 'application/pgp-keys' > > > > > > /usr/share/applications/seahorse-pgp-prepferences.desktop > > > Volatile > > > desktop file for seahorse-preferences > > > > > > /usr/share/applications/seahorse-pgp-signature.desktop > > > Volatile > > > desktop file for mime type 'application/pgp-signature' > > > > > > /usr/share/doc/SUNWseahorse-plugins/* > > > Volatile doc files for seahorse plugins > > > > > > /usr/share/man/man1/seahorse-* > > > Volatile man pages > > > > > > /usr/share/mime/packages/seahorse.xml > > > Volatile a file defines new mime types > > > > > > /usr/share/seahorse-plugins/glade/* > > > Project Private glade files > > > > > > /etc/gconf/schemas/seahorse-gedit.schemas > > > Volatile seahorse plugin schema file for gedit > > > > > > /etc/gconf/schemas/seahorse-plugins.schemas > > > Volatile schema file of seahorse-agent and seahorse-applet > > > > > > Imported Interfaces > > > Interface Classification Comments > > > --------------- --------------- ----------------------- > > > GnuPG Uncommitted PSARC/2009/397 > > > GPGME Uncommitted PSARC/2009/397 > > > sunldap Volatile PSARC/1997/276 > > > libsoup Volatile LSARC/2003/298 > > > libgpg-error Volatile LSARC/2008/207 > > > > > > 4.12 Packaging & Delivery: > > > > > > Two new packages are delivered. > > > SUNWseahorse-plugins > > > SUNWseahorse-plugins-root > > > > > > 4.13 Security Impact: > > > > > > Seahorse is just a GUI front-end GnuPG, so all encryption related tasks > > > are managed by GnuPG. > > > > > > Seahorse syncs public keys with key servers using the protocols LDAP and > > > HKP. The communication with the server is not encrypted. > > > It is the user's responsibility to ensure the public key is valid or > > > trusted. > > > > > > Seahorse and Seahorse Plugins, like all GUI programs, depends on Xauth > > > security. > > > > > > These tools under review do not save sensitive information to files > > > directly. Instead, GnuPG does. > > > > > > 4.9 Dependencies: > > > > > > Seahorse depends on GnuPG and GPGME to operate on PGP keys. > > > Seahorse depends on sun ldap and libsoup to access key servers. > > > > > > 5. References > > > [1] Seahorse DBus Interfaces: > > > http://live.gnome.org/Seahorse/DBus > > > [2] Project page: > > > http://www.gnome.org/projects/seahorse > > > 6. Resources and Schedule > > > 6.4. Steering Committee requested information > > > 6.4.1. Consolidation C-team Name: > > > Desktop > > > 6.5. ARC review type: FastTrack > > > 6.6. ARC Exposure: open > > > > > > > > > 6. Resources and Schedule > > > 6.4. Steering Committee requested information > > > 6.4.1. Consolidation C-team Name: > > > OSD > > > 6.5. ARC review type: FastTrack > > > 6.6. ARC Exposure: open > > > > >