Maintenance of Auth_SASL PEAR package

[email protected] (Jehan Pagès) Sat, 13 Aug 2011 16:11:59 +0900
Newsgroups php.pear.qa
Message-ID <CAFgjPJ_U4S9qLjsK=j6gVTFKWMdE7YEUwef1sMm895vXBY2hFQ@mail.gmail.com>
Hello,

I am a user of the Auth_SASL package
(http://pear.php.net/package/Auth_SASL/) for a few years now. And I
see it does not have a maintainer lately. I am interested in
particular by a given feature, which is adding the pretty "recent" (in
Internet technology point of view) and very good SCRAM family of SASL
mechanisms. See RFC 5802.

So I won't lie to you: I won't pretend to try and improve this library
a far as possible in supporting every possible SASL mechanism on
earth. I will make in priority the implementations I am wishing for my
own projects. If someone who promises to be much more dedicated than I
am wishes to step-up, I will give the role with pleasure. Simply for
now, I think that's sad that there is just no maintainer at all. So I
propose to be this one.
Now what else I can tell you I will do:
- I will follow up with bug reports and try to report patch or fix
real bugs when relevant;
- I will read coding standards and follow them to the letter;
- I am rather focused on security, which — I think you'll agree — is
quite important for a package as Auth_SASL;
- as long as I will be maintainer, I won't abandon the package. I may
not implement crazy new features and mechanisms every day; but I will
answer to reports in a civil manner, try to fix what I can fix, and so
on. I don't plan on being a ghost maintainer, coming in, making some
things for 1 month, then disappearing forever. I am more a low but
constant maintenance type.

Now my background: apart as a user for some years, I never had a
relation with PEAR. So that part would be new for me. But I am not a
newcomer in development or the specification world.

As a developer, I have worked for some years as engineer for a French
business software company (Systar) and I am currently the Senior
Application Developer for the startup myGengo (working mainly on PHP).
On the side, I work with PHP for some years, in particular on
Wordpress plugins:
- Jabber Feed: http://wordpress.org/extend/plugins/jabber-feed/
- XMPP-Authentication: http://wordpress.org/extend/plugins/xmpp-auth/
On both these plugins, I use Auth_SASL, and I want to update Auth_SASL
because XMPP recently updated its authentication recommendation to
using SASL-SCRAM (see RFC-6120).

Also, not PHP, but I have already written a full SASL implementation
in ObjectiveCaml (for the Ocaml XMPP library I am writing), with in
particular the SCRAM mechanism:
http://git.tuxfamily.org/?p=gitroot/ocamlxmpp/ocamlxmpp.git;a=blob;f=trunk/src/crypt/SASL.mli;h=2c98d39e89a97915601f2283161fe55d2aa64940;hb=HEAD
Note that this is not a C wrapper, this is a fully native OCaml
implementation that I wrote, just as Auth_SASL is a native PHP
implementation.

In the Standards world, I have also quite an activity in XSF (the XMPP
Standards Foundation) and some activity in IETF as well, in a few
specific fields (for instance, in RFC-5802, SASL SCRAM, you can see I
am the author of the 3 verified errata already approved:
http://www.rfc-editor.org/errata_search.php?rfc=5802 ).

As a conclusion, I think I am quite a good candidate to take over
maintenance over the currently abandoned Auth-SASL: I know well SASL
on the specification side; I have already written a native
implementation in another language; I use the package on personal Free
software projects (that I intend to have run on xmpp.org soon, the
official XSF website, when they get stable); and finally I work
currently as Senior Core Developer (with PHP as main language used) as
my daily job.
So I hope you will accept my candidature!
Thanks.

Jehan