pkg-perl-maintainers team mailing list archive

[Christian Ehrhardt  <1854849@xxxxxxxxxxxxxxxxxx>]

[Summary]
- All looks pretty straight forward, MIR Team ack
- Needs security review (assigned)

[Duplication]
I first thought https://metacpan.org/pod/List::Util would be something else that sounds similar but it IS the same. I found no other such perl lib in main. And while one could say "just do it without the lib" it is fine that such helpers exist.

[Embedded sources and static linking]
- no embedded sources
- no (static) liking (perl)

[Security]
- no history of CVEs
- no daemon as root
- doesn't use webkit1,2
- doesn't use lib*v8 directly
- doesn't opens a port
- doesn't processe arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- doesn't deal with system authentication (eg, pam), etc)

But it
- parses data formats

And that in a way that if there is a bug in the code of the lib all applications using it would be affected.
Since the need pulling this in is for mail-auth we should ask security to take a look, it isn't too huge so it might be fast.

[Common blockers]
- no FTBFS issues
- tests are present
- no translation, but also not user visible
- no python package for further constraints on that

[Packaging red flags]
- no Ubuntu delta atm
- perl has no symbols tracking
- d/watch is ok
- regularly updated in Debian
- the current release is packaged
- not causing a MOTU problem
- a few, but no massive Lintian warnings
- d/rules is as small as it can be
- no golang constraints to consider
- Desktop team is already subscribed

[Upstream red flags]
- no Errors/warnings during the build
- no  incautious use of malloc/sprintf
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of User nobody
- no use of setuid
- no known Important bugs (crashers, etc) in Debian or Ubuntu
- no Dependency on webkit, qtwebkit, seed or libgoa-*
- not part of UI design


** Changed in: libscalar-list-utils-perl (Ubuntu)
     Assignee: Christian Ehrhardt  (paelzer) => (unassigned)

** Changed in: libscalar-list-utils-perl (Ubuntu)
     Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security)

-- 
You received this bug notification because you are a member of Debian
Perl Group, which is subscribed to libscalar-list-utils-perl in Ubuntu.
https://bugs.launchpad.net/bugs/1854849

Title:
  [MIR] libscalar-list-utils-perl

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libscalar-list-utils-perl/+bug/1854849/+subscriptions