(cleaning up ~ubuntu-release bugs)
I've seen other MIR bugs assigned to ~ubuntu-security instead of
~canonical-security - reassigning in case this helps move this MIR
forward. Please review.
Otherwise, at this point there's nothing for the release team to review.
If the MIR is approved with time to go before Bionic, we can look to re-
enabling bubblewrap in gnome-desktop (and anything else?). Please re-
subscribe in that event.
** Changed in: bubblewrap (Ubuntu)
Assignee: Canonical Security Team (canonical-security) => Ubuntu Security
Team (ubuntu-security)
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to bubblewrap in Ubuntu.
https://bugs.launchpad.net/bugs/1709164
Title:
[MIR] bubblewrap
Status in bubblewrap package in Ubuntu:
Confirmed
Bug description:
Availability
============
Built for all supported architectures.
In sync with Debian.
Rationale
=========
The gnome-desktop3 library 3.25.90+ requires bubblewrap. bubblewrap is most
commonly used as part of Flatpak's security isolation feature. Here it's being
used to sandbox the thumbnailers.
See https://git.gnome.org/browse/gnome-desktop/log (changes from
3.25.4 to 3.25.90)
The bubblewrap feature was disabled in Ubuntu 17.10's gnome-desktop3
package because this MIR was not processed.
Security
========
No known open security vulnerabilities in any Ubuntu releases.
https://security-tracker.debian.org/tracker/source-package/bubblewrap
I helped prepare a security update (LP: #1657357) (CVE-2017-5226) for
bubblewrap/flatpak several months ago.
Security-sensitive package.
Quality assurance
=================
Bug subscriber: should be Ubuntu Desktop Bugs
https://bugs.launchpad.net/ubuntu/+source/bubblewrap
https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=bubblewrap
https://github.com/projectatomic/bubblewrap/issues
dh_auto_test runs the build tests but they appear to be set as SKIP
upstream. (See comment #4)
Multiple autopkgtests passing on all Ubuntu architectures. Because the
tests require machine isolation, the autopkgtests don't run on
Debian's infrastructure currently.
Dependencies
============
check-mir reports all other binary dependencies are in main
Standards compliance
====================
4.0.0
Maintenance
===========
- Actively developed upstream
https://github.com/projectatomic/bubblewrap
- Maintained in Debian by the pkg-utopia team but more specifically,
it is maintained by Simon McVittie (smcv) who also maintains Flatpak
and ostree in Debian and Ubuntu.
short dh7 style rules, dh compat 10
Background information
======================
William Hua (attente) had been working last year on a snapcraft plugin that
used bubblewrap.
So maybe more stuff will use bubblewrap in the future.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1709164/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
