pkg-perl-maintainers team mailing list archive

[Didier Roche <1980662@xxxxxxxxxxxxxxxxxx>]

Review for libhtml-tokeparser-simple-perl.
MIR team ACK under the constraint to resolve the below listed
required TODOs.
This does not need a security review
List of specific binary packages to be promoted to main: libhtml-tokeparser-simple-perl

Notes:
Required TODOs:
- This package, while having tests during build does not have autopkgtests. Consequently, we are not protected against breakages due to migration of reverse dependencies, including new perl. Even if for perl there is traditionnally a mass-rebuild, maybe we should ensure we have autopkgtests for any package entering main. I think the autopkgtests can run the same testsuite than the one at build-time to protect us.

Note that the reporter said that there are autopkgtests in
https://autopkgtest.ubuntu.com/packages/libfreezethaw-perl/. But this
one seems to be generated by perl and reverse dependency, doing minimal
checks: this one does not run a real testsuite. Only an installation and
syntax checker, mostly. This is why I suggest that we enhance the
autopkgtests for them with running the same testsuite than the one at
build time.

[Duplication]
There is no other package in main providing the same functionality.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries

OK:
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- the package parse data formats (files [images, video, audio,
  xml, json, asn.1], network packets, structures, ...) from an untrusted source. However, this one is a wrapper to ease the usage of libhtml-parser-perl with more convenient methods. It subclasses them. Consequently, it does not parse directly its content, but wrap over the existing parser, already in main. The package does not need a security review as it only handles data transformation, already parsed.
  Only parse some deserialized structures that we serialized before.
- does not open a port/socket
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)

[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- if special HW does prevent build/autopkgtest is there a test plan, code,
  log provided?
- if a non-trivial test on this level does not make sense (the lib alone
  is only doing rather simple things), is the overall solution (app+libs)
  extensively covered i.e. via end to end autopkgtest ?
- no new python2 dependency

Problems:
- does NOT have autopkgtests. Consequently new perl updates can migrate while breaking this package. I suggest we have autopkgtests implemented as required by the MIR process.

[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- symbols tracking not applicable for this kind of code.
- d/watch is present and looks ok (if needed, e.g. non-native)
- Upstream update history is sporadic, but there is no need for a stabilized project.
- Debian/Ubuntu update folllows upstream.
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far
- no massive Lintian warnings
- d/rules is rather clean
- It is not on the lto-disabled list

[Upstream red flags]
OK:
- no Errors/warnings during the build
- no incautious use of malloc/sprintf (as far as we can check it)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside
  tests)
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit, seed or libgoa-*
- not part of the UI for extra checks
- no translation present, but none needed for this case?


** Changed in: libhtml-tokeparser-simple-perl (Ubuntu)
       Status: New => Incomplete

** Changed in: libhtml-tokeparser-simple-perl (Ubuntu)
     Assignee: Didier Roche (didrocks) => (unassigned)

-- 
You received this bug notification because you are a member of Debian
Perl Group, which is subscribed to libhttp-server-simple-perl in Ubuntu.
https://bugs.launchpad.net/bugs/1980662

Title:
  [MIR] lib*-perl for lintian 2.115

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libfreezethaw-perl/+bug/1980662/+subscriptions