pkg-perl-maintainers team mailing list archive

[Christian Ehrhardt  <1972853@xxxxxxxxxxxxxxxxxx>]

Review for Package: libxs-parse-sublike-perl

[Summary]
MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.

This does not need a security review

List of specific binary packages to be promoted to main: libxs-parse-sublike-perl
Specific binary packages built, but NOT to be promoted to main: n/a

Required TODOs:
- the autopkgtest is broken since forever on all but armhf, please fix this
Recommended TODOs:
- The package should get a team bug subscriber before being promoted

[Duplication]
There is no other package in main providing the same functionality.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

Problems: None

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have odd Built-Using entries
- not a go package, no extra constraints to consider in that regard
- No vendoring used, all Built-Using are in main

Problems: None

[Security]
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not open a port/socket
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)

Problems:
- does parse data formats (usually code in the current use, but not arbitrary
  and low attack surface)

[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
  - test suite fails will fail the build upon error.
- does have a test suite that runs as autopkgtest
- no special HW needed
- no new python2 dependency

Problems:
- the current autopkgtest fails and does so since impish which is why it
  isn't flagged. But this might represent an underlying problem with not only
  the test but the program, we should fix this before considering it ready.

[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- symbols tracking not applicable for this kind of code.
- d/watch is present and looks ok
- Debian/Ubuntu update history is slow (matching upstream)
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far
  maintained the package
- no massive Lintian warnings
- d/rules is rather clean
- It is not on the lto-disabled list

Problems:
- Upstream update history is slow, not sure how much we can rely on it.
  Those kind of packages often are without being a problem, but we have to
  be clear this seems like a non (much) active upstream.

[Upstream red flags]
OK:
- no Errors/warnings during the build
- no incautious use of malloc/sprintf (perl only)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit, seed or libgoa-*
- not part of the UI for extra checks
- no translation present, but none needed for this case

Problems: None


** Changed in: libxs-parse-sublike-perl (Ubuntu)
       Status: Confirmed => Incomplete

** Changed in: libindirect-perl (Ubuntu)
     Assignee: Christian Ehrhardt  (paelzer) => (unassigned)

** Changed in: libobject-pad-perl (Ubuntu)
     Assignee: Christian Ehrhardt  (paelzer) => (unassigned)

** Changed in: libunicode-escape-perl (Ubuntu)
     Assignee: Christian Ehrhardt  (paelzer) => (unassigned)

** Changed in: libunicode-string-perl (Ubuntu)
     Assignee: Christian Ehrhardt  (paelzer) => (unassigned)

** Changed in: libxs-parse-sublike-perl (Ubuntu)
     Assignee: Christian Ehrhardt  (paelzer) => (unassigned)

-- 
You received this bug notification because you are a member of Debian
Perl Group, which is subscribed to libunicode-string-perl in Ubuntu.
https://bugs.launchpad.net/bugs/1972853

Title:
  [MIR] lib*-perl

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libindirect-perl/+bug/1972853/+subscriptions