Bug#1024547: ITP: sparrow -- Bitcoin wallet with a focus on privacy and usability

[cr...@sparrowwallet.com]

Package: wnpp
Severity: wishlist
Owner: cr...@sparrowwallet.com
X-Debbugs-Cc: debian...@lists.debian.org

* Package name : sparrow
Version : 1.7.1
Upstream Author : Craig Raw <ma...@sparrowwallet.com>
* URL : http://sparrowwallet.com/
* License : Apache 2
Programming Lang: Java
Description : Bitcoin wallet with a focus on security, privacy and usability

Sparrow Wallet is a Bitcoin only desktop wallet with a focus on security, privacy and usability. Suitable for beginner to advanced users, Sparrow reveals detailed information about a wallet’s configuration, transactions and UTXOs in order to minimise trust and be fully transparent.

Features:
* Full support for single sig and multisig wallets on all addressable script types
* A range of connection options: Public servers, Bitcoin Core and private Electrum servers
* Standards based including full support for PSBT and TXN files
* Support for all common hardware wallets in USB and airgapped / QR modes
* Wallet configuration via output descriptors
* Full coin and fee control with mempool visualisation
* Send to multiple outputs with change address selection
* Native support for fee bumping with RBF and CPFP
* Labelling of all transactions, addresses, inputs and outputs
* Lightweight and multi platform (Linux, OSX, Windows)
* Message signing and verification
* Collaborative coinjoin with Samourai Whirlpool and over Soroban
* Import and export to a number of different of wallet formats (incl. Electrum)
* Show wallets in different tabs, windows or minimised to system tray
* Payjoin (P2EP) support
* Anonymous broadcast via public blockchain explorers over Tor
* Built in Tor client
* Private blockchain explorer functionality
* Strong wallet file encryption
* Testnet, regtest and signet support

Inclusion into the Debian repository is a precursor to inclusion into Tails, which has been broadly requested in the Bitcoin community.
Sparrow is already released as a .deb package (see https://sparrowwallet.com/downloads/) as part of the standard release process.
I intend to maintain this package going forward.

[Sam Hartman]

>>>>> "craig" == craig <cr...@sparrowwallet.com> writes:

craig> Inclusion into the Debian repository is a precursor to
craig> inclusion into Tails, which has been broadly requested in the
craig> Bitcoin community. Sparrow is already released as a .deb
craig> package (see https://sparrowwallet.com/downloads/) as part of
craig> the standard release process. I intend to maintain this
craig> package going forward.

In the past we've had a bit of trouble with bitcoin wallets in Debian
when security issues emerged. If this package makes it into Debian
stable, will you be able to provide security support for the version in
stable without upgrading to new upstream versions for the release
lifetime of stable?

[Craig Raw]

21 Nov 2022, 19:44 by hart...@debian.org:

In the past we've had a bit of trouble with bitcoin wallets in Debian

when security issues emerged. If this package makes it into Debian

stable, will you be able to provide security support for the version in

stable without upgrading to new upstream versions for the release

lifetime of stable?

Yes - apart from the listed email address in the package, there is also a community managed Telegram group at https://t.me/SparrowWallet and of course the Github issues page, both linked from the application Help menu. All are actively monitored. 

It's worth noting as well that Sparrow hasn't had a security issue in the now 2+ years since it was first released. It had been the subject of external code review and build reproducibility is regularly checked by external parties. 

Craig

[Craig Raw]

I would appreciate some guidance on how to proceed. The documentation says "package the software, upload it and close this bug once the package has been installed". The software is already available in the .deb format for amd64 and arm64 architectures:

https://github.com/sparrowwallet/sparrow/releases/download/1.7.1/sparrow_1.7.1-1_amd64.deb

https://github.com/sparrowwallet/sparrow/releases/download/1.7.1/sparrow_1.7.1-1_arm64.deb

I assume the next step is to upload these two files, but I'm uncertain of where or how to do this.

Thanks,

Craig

[Sam Hartman]

>>>>> "Craig" == Craig Raw <cr...@sparrowwallet.com> writes:


Craig> I assume the next step is to upload these two files, but I'm
Craig> uncertain of where or how to do this.

No, probably the next step is to make sure all the dependencies are
packaged in Debian
and then to generate a Debian format source package that generates debs
similar to those.

See https://www.debian.org/doc/manuals/maint-guide/


That's probably targeted at packaging software written in C.
You probably will want to look at the Debian Java team's pages
https://wiki.debian.org/Teams/JavaPackaging

for how they do things
and of course the developers reference for procedures on things like
sponsorship (which you will need since you are not a Debian developer)
https://www.debian.org/doc/manuals/developers-reference/