Bug#1126523: ITP: openarc -- ARC (authenticated Received chain) milter

I sent that previous email too soon! I wanted to still add the following:

The upstream of the current project (TrustedDomainProject) has indicated 
that they are interested in decommissioning OpenARC; they have 
officially reached out to flowerysong (the maintainer of the updated 
OpenARC software that is being packaged in this thread) if they can just 
point their repo at his [0].

Already back in 2024 I reached out to flowerysong about this fork and 
whether he was going to maintain it[1]. At that point in time, he was 
not sure what his commitment was going to be, but since then he has 
created releases, fixed a lot of bugs, fixed issues that were brought up 
on his, and the TDP's issue tracker. Here are some of the more important 
(I think) fixes, which would already warrant switching to it. He

  * addressed the differences between the early ARC drafts, implemented 
by the original
     OpenARC, and the final RFC 8617 specification;
  * fixed multiple buffer overruns and other memory-safety issues;
  * fixed a use-after-free in the milter;
  * substantially reworked Authentication-Results parsing and 
ARC-Authentication
     Results generation;
  * added OpenSSL 3 compatibility;
  * improved test coverage and cleaned up the build system;
  * addressed real-world interoperability problems, including ARC 
signatures rejected by
     Microsoft/O365;
  * and he continues to make build and portability fixes.

I have also checked the licensing. The fork retains the existing 
BSD-style licence and original copyright notices, while adding copyright 
attribution for "OpenARC contributors"; I don't see a licence change 
that would prevent Debian from continuing to distribute it.

I hope this helps!

Kind regards,

     Edmund


[0]: 
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126523;msg=50[1]: 
https://github.com/flowerysong/OpenARC/discussions/22