[Bug 1820214] Re: [MIR] python-blessed as dependency of mailman3

[Christian Ehrhardt ]

After evaluating dependencies, required further changes and mostly
maintainability for security and packaging it was decided there are too
many concerns - not about any single package in particular, but the
overall Mailman3 stack - about the ability to maintain and monitor it as
well as we need it for support in main.

We have closed the primary LP bug already, the MIRs that are already approved - 
like this one - will stay that way, but we will make no seed change to pull 
things in for now. Yet if other needs come up for those they have a prepared 
MIR already.
Other bugs which are not yet completed in terms of review will be closed as 
Won't Fix.

Even thou it ended being aborted, I think that is a valid outcome of the
MIR evaluations. Never the less I want to thank everybody involved for
all the work spent in what was nearly a year working through these MIRs.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1820214

Title:
  [MIR] python-blessed as dependency of mailman3

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-blessed/+bug/1820214/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1820214] Re: [MIR] python-blessed as dependency of mailman3

[Christian Ehrhardt ]

[Duplication]
No duplication of that functionality in the Archive in general or main in 
particular.

[Embedded sources and static linking]
This package does not contain embedded library sources.
This package does not statically link to libraries.
No Go package

[Security]
I can confirm that there seems to be no CVE/Security history for this package.
It Does not:
- run a daemon as root
- uses old webkit
- uses lib*v8 directly
- open a port
- integrates arbitrary javascript into the desktop
- processes arbitrary web content
- parse data formats
- deals with system authentication
- uses centralized online accounts

[Common blockers]
- builds fine at the moment
- server Team committed to subscribe once this gets promoted (enough for now)
- code is not user visible, no translation needed
- dh_python is used
- package produces python2 bits, but they are not pulled into main by mailman3
- does utilize build time self tests

[Packaging red flags]
- no current ubuntu Delta to evaluate
- no library with classic symbol tracking
- watch file is present
- Lintian warnings are present but ok
- debian/rules is rather clean
- no usage of Built-Using
- no golang package that would make things harder

[Upstream red flags]
- no suspicious errors during build
- it is pure python, so no incautious use of malloc/sprintf
- no use of sudo, gksu
- no use of pkexec
- no use of LD_LIBRARY_PATH
- no important open bugs
- no Dependency on webkit, qtwebkit, libgoa-*
- no embedded copies in upstream either

[Summary]
Ack from the MIR-Teams POV, as outlined above a security review is not needed 
in this case.


** Changed in: python-blessed (Ubuntu)
   Status: New => In Progress

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1820214

Title:
  [MIR] python-blessed as dependency of mailman3

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-blessed/+bug/1820214/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs