#916101 mailman3: uses a hard-coded and mismatched api_key in mailman-hyperkitty.cfg

Package:
src:mailman3
Source:
mailman3
Submitter:
Sampo Sorsa
Date:
2021-06-11 12:48:03 UTC
Severity:
normal
#916101#5
Date:
2018-12-10 08:12:21 UTC
From:
To:
Dear Maintainer,

mailman-hyperkitty.cfg [1] contains:

    api_key: SecretArchiverAPIKey

mailman3-web postinst however, checks for this api_key and generates a random one if it has not been changed [2]. This means the default setup for hyperkitty contains mismatched api key, and will not work.

mailman3 should generate api_key when writing /etc/mailman3/mailman-hyperkitty.cfg. Then the logic for randomizing the password could be removed from mailman3-web.

[1]: https://salsa.debian.org/mailman-team/mailman-hyperkitty/blob/master/mailman-hyperkitty.cfg
[2]: https://salsa.debian.org/mailman-team/mailman-suite/blob/master/debian/mailman3-web.postinst#L114-125
#916101#10
Date:
2018-12-22 22:37:03 UTC
From:
To:
Le lundi 10 décembre 2018 à 08:12:21+0000, Sampo Sorsa a écrit :

Hi,

Thanks for the report.

I don't consider this as a bug. Obviously it's also the job of a system
administrator to set the appropriate parameters to the appropriate value.

That said, I consider your report as a feature request that should indeed be
implemented.

Yet, I lack some time currently. Could you provide a patch for the package?
I'd be happy to review and take it into account!

Cheers!
#916101#15
Date:
2021-06-11 12:25:27 UTC
From:
To:
--- mailman-hyperkitty.cfg      2018-10-03 12:26:30.000000000 +0000
+++ /tmp/mailman-hyperkitty.cfg 2021-06-11 12:24:11.560489018 +0000
@@ -17,4 +17,6 @@

 # Shared API key, must be the identical to the value in HyperKitty's
 # settings.
+# Overwrite this with the autogenerated key
+# from /etc/mailman3/mailman.py:MAILMAN_ARCHIVER_KEY!
 api_key: SecretArchiverAPIKey