[Bug 2055434] Re: [MIR] pemmican
Thanks - completed Override component to main pemmican 1.0.3-0ubuntu1 in noble: universe/python -> main pemmican-common 1.0.3-0ubuntu1 in noble amd64: universe/python/optional/100% -> main pemmican-common 1.0.3-0ubuntu1 in noble arm64: universe/python/optional/100% -> main pemmican-common 1.0.3-0ubuntu1 in noble armhf: universe/python/optional/100% -> main pemmican-common 1.0.3-0ubuntu1 in noble i386: universe/python/optional/100% -> main pemmican-common 1.0.3-0ubuntu1 in noble ppc64el: universe/python/optional/100% -> main pemmican-common 1.0.3-0ubuntu1 in noble riscv64: universe/python/optional/100% -> main pemmican-common 1.0.3-0ubuntu1 in noble s390x: universe/python/optional/100% -> main pemmican-desktop 1.0.3-0ubuntu1 in noble amd64: universe/python/optional/100% -> main pemmican-desktop 1.0.3-0ubuntu1 in noble arm64: universe/python/optional/100% -> main pemmican-desktop 1.0.3-0ubuntu1 in noble armhf: universe/python/optional/100% -> main pemmican-desktop 1.0.3-0ubuntu1 in noble i386: universe/python/optional/100% -> main pemmican-desktop 1.0.3-0ubuntu1 in noble ppc64el: universe/python/optional/100% -> main pemmican-desktop 1.0.3-0ubuntu1 in noble riscv64: universe/python/optional/100% -> main pemmican-desktop 1.0.3-0ubuntu1 in noble s390x: universe/python/optional/100% -> main pemmican-doc 1.0.3-0ubuntu1 in noble amd64: universe/doc/optional/100% -> main pemmican-doc 1.0.3-0ubuntu1 in noble arm64: universe/doc/optional/100% -> main pemmican-doc 1.0.3-0ubuntu1 in noble armhf: universe/doc/optional/100% -> main pemmican-doc 1.0.3-0ubuntu1 in noble i386: universe/doc/optional/100% -> main pemmican-doc 1.0.3-0ubuntu1 in noble ppc64el: universe/doc/optional/100% -> main pemmican-doc 1.0.3-0ubuntu1 in noble riscv64: universe/doc/optional/100% -> main pemmican-doc 1.0.3-0ubuntu1 in noble s390x: universe/doc/optional/100% -> main pemmican-server 1.0.3-0ubuntu1 in noble amd64: universe/python/optional/100% -> main pemmican-server 1.0.3-0ubuntu1 in noble arm64: universe/python/optional/100% -> main pemmican-server 1.0.3-0ubuntu1 in noble armhf: universe/python/optional/100% -> main pemmican-server 1.0.3-0ubuntu1 in noble i386: universe/python/optional/100% -> main pemmican-server 1.0.3-0ubuntu1 in noble ppc64el: universe/python/optional/100% -> main pemmican-server 1.0.3-0ubuntu1 in noble riscv64: universe/python/optional/100% -> main pemmican-server 1.0.3-0ubuntu1 in noble s390x: universe/python/optional/100% -> main Override [y|N]? y 29 publications overridden. ** Changed in: pemmican (Ubuntu) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
Team subscription added -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
pemmican-common is needed by the two now seeded pemmican-desktop and pemmican-server pemmican-doc is auto-included and has only safe dependencies (all in main) and therefore can be promoted as well. All looks well, but the team subscription wasn't added before. Should be OK to go once that is done ... -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
We landed the seed change in https://code.launchpad.net/~waveform/ubuntu-seeds/+git/ubuntu- seeds/+merge/463674 ** Changed in: pemmican (Ubuntu) Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
** Merge proposal linked: https://code.launchpad.net/~waveform/ubuntu-seeds/+git/ubuntu-seeds/+merge/463674 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
I reviewed pemmican 1.0.3-0ubuntu1 as checked into noble. This shouldn't be considered a full audit but rather a quick gauge of maintainability. pemmican is a small utility which warns users of power supply issues on the Raspberry Pi 5 platform. - CVE History - No CVEs. This project is a month old though. - Build-Depends - Apart from the typical Python package dependencies: - python3-gi - python3-pyudev - python3-dbus - For documentation: - python3-sphinx - python3-sphinx-rtd-theme - pre/post inst/rm scripts - There are automatically added scripts from dh_python3 and dh_installsystemduser. - Init scripts compile the python scripts with py3compile and enable the systemd services. - Rm scripts for cleanup and removal of the systemd services. - systemd units - /usr/lib/systemd/user/pemmican-monitor.service -> simple systemd unit that runs as the user. - /usr/lib/systemd/user/pemmican-reset.service -> one-shot systemd unit that runs as the user. - dbus services - It dispatches freedesktop DBus notifications. - setuid binaries - None - binaries in PATH - /usr/bin/pemmican-mon -> python script to be run by the systemd unit. It runs MonitorApplication from gui.py - /usr/bin/pemmican-reset -> python script to be run by the systemd unit. It runs ResetApplication from gui.py - /usr/bin/pemmican-cli -> python script to add a MOTD message. It runs cli.py - sudo fragments - None - polkit files - None - udev rules - It monitors power supply-related events on usb/hwmon - unit tests / autopkgtests - The source code includes unit tests. They are run when building the deb package. - Autopkgtests are also the tests. - cron jobs - None - Build logs - Deprecation warning from setuptools because of trying to use 'setup.py install'. - Lintian clean. - Processes spawned - None - Memory management - Nothing out of normal, Python application. - File IO - None - Logging - None - Environment variable usage - It searchs for XDG_CONFIG_HOME, XDG_CONFIG_DIRS and (WAYLAND_)DISPLAY. - Use of privileged functions - None - Use of cryptography / random number sources etc - None - Use of temp files - None - Use of networking - None - Use of WebKit - None - Use of PolicyKit - None - Any significant cppcheck results - None - Any significant Coverity results - None - Any significant shellcheck results - None - Any significant bandit results - None - Any significant govulncheck results - None - Any significant Semgrep results - None The code is widely documented and properly formatted. It contains error and exception handling. Upstream runs the testing suite with GitHub Actions on every commit. Since it's a month old project, we cannot speak about maintainability but the owner is a Canonical engineer. The complete codebase is made by 6 Python files: * power.py -> Opens hardcoded '/proc/device-tree/chosen/power' and reads values. * notify.py -> DBus freedesktop notification handler class, with hardcoded paths and values. * lang.py -> Minimal locale and internationalization loading. * gui.py -> Interaction with the freedesktop notification service to notify the user. * const.py -> Constant variables to be used, uses XDG_CONFIG_ environment variables. * cli.py -> CLI tool to run the same functionality as the systemd units but getting the output as stdout. Overall, the code looks well written and it does not present any security issues. Binaries generated: * pemmican-desktop: Systemd units run as the user, since it uses dh_installsystemduser. It cannot be used to gain privileges. The reset unit queries /proc/device- tree/chosen/power sending a freedesktop notification in case of brownout/not enough current. The monitoring unit monitors udev changes, sending a freedesktop notification in case of undervolt/overcurrent detected. * pemmican-server: It works as a update-motd hook for running the CLI application. Same as the desktop reset one, which queries the information but it adds the message to MOTD in case something is detected. The messages and invocation are hardcoded so no possibility to manipulate the output. Security team ACK for promoting pemmican to main. ** Changed in: pemmican (Ubuntu) Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned) ** Changed in: pemmican (Ubuntu) Status: Confirmed => In Progress -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
** Tags added: sec-3971 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
Thanks for the review Ioanna! I'd just updated the form based on Didier's feedback on LP: #2054480 (I'd been cribbing from an old MIR rather than using the new template), but I don't think the additions I made change much that you've pointed out. The more info URL breakage is ... weird, given that's also the URL being used in the equivalent RaspiOS package (https://github.com/raspberrypi- ui/wf-panel- pi/blob/master/src/panel/widgets/power/power.c#L241C28-L241C66), and was definitely working up until very recently. I'll contact them and see if I can get it resolved (or if it's moved somewhere). One minor correction: > Problems: > - does run a daemon as root It does run a service, but not as root -- the services in pemmican- desktop (one one-shot, and one simple-type) are user-level systemd services so they run under the interactive user's login. I'm not sure if that changes the requirement for security review. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
Review for Source Package: pemmican [Summary] This is a small utility that warns users of issues with power supply on Raspberry Pi 5 platforms. It runs 3 utilities (pemmican-cli, pemmican-mon and pemmican-reset) as root and therefore I believe a sec review is due. MIR team ACK under the constraint to resolve the below listed required TODOs and as much as possible having a look at the recommended TODOs. This does need a security review, so I'll assign ubuntu-security List of specific binary packages to be promoted to main: pemmican-common, pemmican-desktop, pemmican-doc, pemmican-server Specific binary packages built, but NOT to be promoted to main: Notes: Recommended TODOs: 1. The url you're link for more information (https://github.com/waveform80/pemmican/blob/main/pemmican/const.py#L20) returns 404, you may want to change it. - The package should get a team bug subscriber before being promoted [Rationale, Duplication and Ownership] There is no other package in main providing the same functionality. A team is committed to own long term maintenance of this package (foundations). The rationale given in the report seems valid and useful for Ubuntu [Dependencies] OK: - no other Dependencies to MIR due to this - no -dev/-debug/-doc packages that need exclusion - No dependencies in main that are only superficially tested requiring more tests now. Problems: None [Embedded sources and static linking] OK: - no embedded source present - no static linking - does not have unexpected Built-Using entries - not a go package, no extra constraints to consider in that regard - not a rust package, no extra constraints to consider in that regard - Does not include vendored code Problems: None [Security] OK: - history of CVEs does not look concerning - does not use webkit1,2 - does not use lib*v8 directly - does not parse data formats (files [images, video, audio, xml, json, asn.1], network packets, structures, ...) from an untrusted source. - does not expose any external endpoint (port/socket/... or similar) - does not process arbitrary web content - does not use centralized online accounts - does not integrate arbitrary javascript into the desktop - does not deal with system authentication (eg, pam), etc) - does not deal with security attestation (secure boot, tpm, signatures) - does not deal with cryptography (en-/decryption, certificates, signing, ...) Problems: - does run a daemon as root [Common blockers] OK: - does not FTBFS currently - does have a test suite that runs at build time - test suite fails will fail the build upon error. - does have a non-trivial test suite that runs as autopkgtest - no new python2 dependency - Python package, but using dh_python Problems: None [Packaging red flags] OK: - Ubuntu does carry a delta, but it is reasonable and maintenance under control - symbols tracking not applicable for this kind of code. - debian/watch is present and looks ok (if needed, e.g. non-native) - Upstream update history is good - Debian/Ubuntu update history is good - the current release is packaged - promoting this does not seem to cause issues for MOTUs that so far maintained the package - no massive Lintian warnings - debian/rules is rather clean - It is not on the lto-disabled list Problems: None [Upstream red flags] OK: - no Errors/warnings during the build - no incautious use of malloc/sprintf (the language has no direct MM) - no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests) - no use of user nobody - no use of setuid / setgid - no important open bugs (crashers, etc) in Debian or Ubuntu - no dependency on webkit, qtwebkit, seed or libgoa-* - not part of the UI for extra checks - translation present Problems: None ** Changed in: pemmican (Ubuntu) Status: New => Confirmed ** Changed in: pemmican (Ubuntu) Assignee: Ioanna Alifieraki (joalif) => (unassigned) ** Changed in: pemmican (Ubuntu) Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
** Description changed: [ Availability ] The package is already available in universe. [ Rationale ] The intent is to seed the package in the Ubuntu Server & Desktop for Raspberry Pi images. The purpose of the package is to warn about sub- standard or deficient power supplies on the Raspberry Pi 5 boards. [ Security ] The are no current CVEs for the project, but it is extremely new so this is no surprise. Canonical is the upstream for the project. + There are no binaries in /sbin or /usr/sbin. The pemmican-server package + installs an MOTD plugin (one-shot run on user login). The pemmican- + desktop package installs two user (not system) services; pemmican-reset + is a one-shot service equivalent to the MOTD plugin; pemmican-monitor is + a simple-type service that monitors for overcurrent/undervolt events + from udev, dispatching notifications via DBus. + + The package opens no listening ports, and has no externally accessible + end-points. + [ Quality Assurance ] - There are no currently outstanding bugs for the package in Launchpad - (again, it's new). The project contains a full coverage test suite, that - is run during package build, and includes a DEP-8 test which also runs - the test suite. The package includes a d/watch file. + The package works well right after install. There are no currently + outstanding bugs for the package in Launchpad (again, it's new). The + project contains a full coverage test suite, that is run during package + build, and includes a DEP-8 test which also runs the test suite. + + The package includes a functioning d/watch file. Lintian overrides are + not present, and lintian output is clean. The package relies on no + demoted or obsolete packages, and has no python2 or GTK2 dependencies. + The package will be installed by default on pre-installed Pi images, but + does not use debconf. + + The packaging is fairly basic: + https://git.launchpad.net/ubuntu/+source/pemmican/tree/debian/rules [ UI Standards ] The user interface is fairly minimal. On server images, it operates as - an motd plugin, outputting a few lines of text in the event of reset due + an MOTD plugin, outputting a few lines of text in the event of reset due to brownout, or power supplies that fail to negotiate a 5A feed. On desktop images, it provides notifications by way of the DBus-based notification service (which appear as notifications at the top-center of the GNOME desktop). - All text output by the application is localizable although no - translations currently exist in the package. + All text output by the application is localizable (via the standard + gettext system), although no translations currently exist in the + package. No desktop file is shipped because the application runs as a + user-level systemd service on login. [ Dependencies ] All runtime dependencies of the project are in main. [ Standards Compliance ] The package follows up to date Debian policy (4.6.2) and debhelper compatibility (13). The packaging format is 3.0 quilt, and in most other respects the packaging is very simple. [ Maintenance / Owner ] - The package will be maintained by the foundations team. + The package will be maintained by the foundations team. The team is not + yet subscribed to package bugs, but will be before promotion (as the + upstream author, and a foundations team member, I'm currently subscribed + to bugs, but I acknowledge the wider team will require a subscription). + + The package does not use static builds, nor vendored code. The package + is not rust based. [ Background Information ] The project mirrors capabilities present in RaspiOS to notify the user of undervolt or overcurrent situations, resets caused by brownout, and power supplies that fail to negotiate the 5A that the Pi 5 requires for "full" operation (including USB/NVMe boot, and full provision of power to the USB ports). Unfortunately the RaspiOS implementation is tied to the wayfire panel in use on their desktop, so we could not directly re- use it. However, the logic involved is simple (check device-tree nodes on boot, monitor certain udev events), so this project re-implements it using the MOTD and DBus notification mechanisms instead (which should also operate reliably on all flavours of Ubuntu). Relevant links: * https://github.com/waveform80/pemmican (source code) * https://pemmican.readthedocs.io/ (docs) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
lintian --pedantic output: Running lintian... I: Lintian run was successful. ** Changed in: pemmican (Ubuntu) Milestone: None => ubuntu-24.04 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
** Changed in: pemmican (Ubuntu) Assignee: (unassigned) => Ioanna Alifieraki (joalif) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 2055434] Re: [MIR] pemmican
** Description changed: [ Availability ] The package is already available in universe. [ Rationale ] The intent is to seed the package in the Ubuntu Server & Desktop for Raspberry Pi images. The purpose of the package is to warn about sub- standard or deficient power supplies on the Raspberry Pi 5 boards. [ Security ] The are no current CVEs for the project, but it is extremely new so this is no surprise. Canonical is the upstream for the project. [ Quality Assurance ] There are no currently outstanding bugs for the package in Launchpad (again, it's new). The project contains a full coverage test suite, that is run during package build, and includes a DEP-8 test which also runs the test suite. The package includes a d/watch file. [ UI Standards ] The user interface is fairly minimal. On server images, it operates as an motd plugin, outputting a few lines of text in the event of reset due to brownout, or power supplies that fail to negotiate a 5A feed. On desktop images, it provides notifications by way of the DBus-based notification service (which appear as notifications at the top-center of the GNOME desktop). All text output by the application is localizable although no translations currently exist in the package. [ Dependencies ] All runtime dependencies of the project are in main. [ Standards Compliance ] The package follows up to date Debian policy (4.6.2) and debhelper compatibility (13). The packaging format is 3.0 quilt, and in most other respects the packaging is very simple. [ Maintenance / Owner ] The package will be maintained by the foundations team. [ Background Information ] The project mirrors capabilities present in RaspiOS to notify the user of undervolt or overcurrent situations, resets caused by brownout, and power supplies that fail to negotiate the 5A that the Pi 5 requires for "full" operation (including USB/NVMe boot, and full provision of power to the USB ports). Unfortunately the RaspiOS implementation is tied to the wayfire panel in use on their desktop, so we could not directly re- use it. However, the logic involved is simple (check device-tree nodes on boot, monitor certain udev events), so this project re-implements it using the MOTD and DBus notification mechanisms instead (which should also operate reliably on all flavours of Ubuntu). + + Relevant links: + + * https://github.com/waveform80/pemmican (source code) + * https://pemmican.readthedocs.io/ (docs) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2055434 Title: [MIR] pemmican To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pemmican/+bug/2055434/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
