Package: liferea
Version: 1.15.8-2+b1
Control: found -1 1.12.2-1
Control: fixed -1 1.16~rc3-1
Tags: fixed-upstream
Severity: important
Usertags: crash
User: debian-devel@lists.debian.org
Userags: privacy

When the Tools -> Plugins menu item is selected, it loads the plugin
list from a JSON file hosted on GitHub[1]. This is both a privacy
issue[2] and now it is also broken because the file got removed
in upstream commit a92d3b0e2b5a4a4068308cbb3240b88073d09c49[3],
that causes a crash in plugin-installer.py due to the 404 error.

   1. https://raw.githubusercontent.com/lwindolf/liferea/master/plugins/plugin-list.json
   2. https://wiki.debian.org/PrivacyIssues
   3. https://github.com/lwindolf/liferea/commit/a92d3b0e2b5a4a4068308cbb3240b88073d09c49

This issue is fixed in upstream liferea 1.16-RC3 that merged the commit
above, but has been present since 1.12.2-1, which means that both
Debian stable and oldstable liferea need to be fixed too.

Since the freeze is close, I suggest installing the file from the
source package in plugins/plugin-list.json into /usr/share/liferea/
and then patching the plugin-installer.py to use a file:// URL instead.

I have tested this fix by editing the files locally, all of the
functionality of the Plugins dialog works, including downloading
and installing not yet installed plugins.

In addition, the plugin installation just downloads the plugins with
git clone, which seems a bit insecure, but this is dropped in 1.16-RC3,
and it is at least protected by TLS. It might be worth packaging some
of the popular liferea plugin packages from the list for Debian.

This is the crash seen on the console when opening the menu item:

   Traceback (most recent call last):
     File "/usr/lib/x86_64-linux-gnu/liferea/plugins/plugin-installer.py", line 63, in _run
       self._browser = PluginBrowser()
                       ~~~~~~~~~~~~~^^
     File "/usr/lib/x86_64-linux-gnu/liferea/plugins/plugin-installer.py", line 92, in __init__
       self._plugin_list = self.fetch_list()
                           ~~~~~~~~~~~~~~~^^
     File "/usr/lib/x86_64-linux-gnu/liferea/plugins/plugin-installer.py", line 168, in fetch_list
       resp = urllib.request.urlopen(req).read()
              ~~~~~~~~~~~~~~~~~~~~~~^^^^^
     File "/usr/lib/python3.13/urllib/request.py", line 189, in urlopen
       return opener.open(url, data, timeout)
              ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
     File "/usr/lib/python3.13/urllib/request.py", line 495, in open
       response = meth(req, response)
     File "/usr/lib/python3.13/urllib/request.py", line 604, in http_response
       response = self.parent.error(
           'http', request, response, code, msg, hdrs)
     File "/usr/lib/python3.13/urllib/request.py", line 533, in error
       return self._call_chain(*args)
              ~~~~~~~~~~~~~~~~^^^^^^^
     File "/usr/lib/python3.13/urllib/request.py", line 466, in _call_chain
       result = func(*args)
     File "/usr/lib/python3.13/urllib/request.py", line 613, in http_error_default
       raise HTTPError(req.full_url, code, msg, hdrs, fp)
   urllib.error.HTTPError: HTTP Error 404: Not Found

Hi Paul,


1.16-RC3 is in experimental. Does using that solve the problem well
enough? (It's not 100% clear on my first read of this report).
Can you share what you changed in this bug report? Even if only for stable?

Paul

PS: liferea is in the debian namespace and I'm on LowThresholdNMU and
LowThresholdAdoption. It's fine when others jump in.

Hello

I have now restored the plugin-list.json file upstream to prevent
crashes for users with older versions.

Sorry, I haven't thought of this when removing the file. And yes:
pulling stuff from git is
always a bad idea no matter.

Best Regards,
Lars Windolf

Hello

I have now restored the plugin-list.json file upstream to prevent
crashes for users with older versions.

Sorry, I haven't thought of this when removing the file. And yes:
pulling stuff from git is
always a bad idea no matter.

Best Regards,
Lars Windolf

I haven't tested it, but the commit removes the plugin-installer.py
file completely, which is where the bug was.

The replacement plugin setup is for folks to manually download, verify,
audit and install any plugins that they are intending to use, in theory
this fixes all of the issues that I mentioned in my initial report.

Except that most plugins won't have any kind of signature to verify,
and most users probably won't be doing any kind of code audit, and
probably none of the plugins have any social audits in CREV either.

https://github.com/crev-dev/

In [1] in PluginBrowser in fetch_list, change list_url to [2].
Copy plugins/plugin-list.json from the source package to [2].

   1. /usr/lib/x86_64-linux-gnu/liferea/plugins/plugin-installer.py
   2. file:///usr/share/liferea/plugins/plugin-list.json

Since the file got re-added upstream, this isn't necessary to
fix the breakage, but changing it would fix the privacy issue.

There are too many versions in use to change this upstream though.

https://repology.org/project/liferea/versions

Hello,

I'd like to submit a patch that restores Plugin functionality in the version of Liferea shipped in Debian 13

The patch updates `plugins/plugin-installer.py` to find `plugin-list.json` at file:///usr/share/liferea/plugin-list.json, and updates d/rules to include the `plugin-list.json` in the built package (liferea-data).

I apologize in advance if this is not the way to submit patches or if I'm not permitted to submit patches as an outsider to Debian.

Hi Andrew,


Thanks, it will take some time for me to look at it; my mind is still
with the trixie release.


This is absolutely a fully supported way of providing patches.

Paul