[Bug 1820186] Re: [MIR] django-mailman3 as dependency of mailman3
After evaluating dependencies, required further changes and mostly maintainability for security and packaging it was decided there are too many concerns - not about any single package in particular, but the overall Mailman3 stack - about the ability to maintain and monitor it as well as we need it for support in main. We have closed the primary LP bug already, the MIRs that are already approved will stay that way, but we will make no seed change to pull things in for now. Yet if other needs come up for those they have a prepared MIR already. Other bugs - like this one - which are not yet completed in terms of review will be closed as Won't Fix. Even thou it ended being aborted, I think that is a valid outcome of the MIR evaluations. Never the less I want to thank everybody involved for all the work spent in what was nearly a year working through these MIRs. ** Changed in: django-mailman3 (Ubuntu) Status: New => Won't Fix -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1820186 Title: [MIR] django-mailman3 as dependency of mailman3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/django-mailman3/+bug/1820186/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1820186] Re: [MIR] django-mailman3 as dependency of mailman3
** Changed in: django-mailman3 (Ubuntu) Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1820186 Title: [MIR] django-mailman3 as dependency of mailman3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/django-mailman3/+bug/1820186/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1820186] Re: [MIR] django-mailman3 as dependency of mailman3
FTR - minor fixup, no python2 bits produced by this package -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1820186 Title: [MIR] django-mailman3 as dependency of mailman3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/django-mailman3/+bug/1820186/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1820186] Re: [MIR] django-mailman3 as dependency of mailman3
[Duplication] No duplication of that functionality in the Archive in general or main in particular. [Embedded sources and static linking] This package does not contain embedded library sources. This package doe not statically link to libraries. No Go package [Security] I can confirm that there seems to be no CVE/Security history for this package. It Does not: - run a daemon as root - uses old webkit - uses lib*v8 directly - open a port - uses centralized online accounts - integrates arbitrary javascript into the desktop - deals with system authentication - processes arbitrary web content - parse data formats Django after all is a web framework, but this component seems to be on the other end and not exposed. Yet that other end here is mailman which processes mails. To err on the side of caution a security review is recommended. [Common blockers] - builds fine at the moment - server Team committed to subscribe once this gets promoted (enough for now) - code is not user visible, no translation needed - dh_python is used - package produces python2 bits, but they are not pulled into main by mailman3 - utilizes build time self tests [Packaging red flags] - no current ubuntu Delta to evaluate - no library with classic symbol tracking - watch file is present - Lintian warnings are present bug ok - debian/rules is rather clean - no usage of Built-Using - no golang package that would make things harder [Upstream red flags] - no suspicious errors during build - it is pure python, so no incautious use of malloc/sprintf - no use of sudo, gksu - no use of pkexec - no use of LD_LIBRARY_PATH - no important open bugs - no Dependency on webkit, qtwebkit, libgoa-* - no embedded copies in upstream either [Summary] Ack from the MIR-Teams POV, but as outlined above a security review is recommended. Assignign the seucrity Team. ** Changed in: django-mailman3 (Ubuntu) Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1820186 Title: [MIR] django-mailman3 as dependency of mailman3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/django-mailman3/+bug/1820186/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
