This needs: For Trusty:
An MIR approved for php-json. An upload for php5-common to depend on php-json in Trusty. Move php-json to main in Trusty. For Saucy: Agreement from the SRU team to move php-json to main in Saucy. An upload for php5-common to depend on php-json in Saucy. Move php-json to main in Saucy. ** Description changed: + [Availability] + + Available in universe; successfully built on all architectures. + + [Rationale] + + Useful functionality for a large proportion of php users; JSON support is + pretty essential for many web services nowadays. + + New dependency of php5 (see background information below) + + [Security] + + JSON parsing is security sensitive; particular in web applications for which + PHP is often used. This package is a wrapper around json-c which is in main + already. We do need to make sure that the wrapper is not vulnerable, but the + JSON parsing itself is already covered by json-c in main. + + No other relevant security history. CVE-2009-1271 appears to refer to the JSON + module bundled with PHP and not this alternative implementation. + + No suid or sgid binaries. No executables in /sbin or /usr/sbin. No daemons. No + use of privileged ports. + + This is an add-on to PHP and an expected use (parsing untrusted input) is + security sensitive. + + [QA] + + Works with no further configuration or documentation. + + No debconf questions. + + No long-term outstanding bugs upstream. The only bug in Debian appears to + relate to a edge case difference in error handling behaviour, which I'm not + sure is a bug at all. No relevant bugs in Ubuntu. + + Outstanding Lintian bugs all refer to PHP packaging issues; this package is + maintained by the PHP maintainer in Debian. + + No exotic hardware. + + Test suite is run during package build using dh_auto_test which fails on test + suite failure. + + No watch file. + + [Dependencies] + + All in main, including libjson-c-dev. + + [Standards compliance] + + Packaging uses debhelper 9, standard phpize and dh-php5. + + [Maintenance] + + This is a straightforward wrapper around json-c. Except to trivially keep + synced with Debian. + + The Ubuntu Server team will subscribe to the package. + + [Background Information] + + The JSON module bundled by PHP upstream is not DFSG compliant due to a problem + with a licence term. See + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692613 for details. So Debian + does not ship with the embedded JSON module, but instead ships php-json + (binary: phphp5-json) which is an independent implementation, and php depends + on it. + + For parity with Debian and common use of PHP, we should have php-json in main. + Otherwise we cannot depend on php5-json, and so JSON functionality in PHP will + be broken by default. + + [Original Description] + After the upgrade to saucy the function json_encode is missing from the current version of php5. It should be always there on PHP versions >= 5.2.0 (not a pecl module anymore) [1] to reproduce: --- user@vm:~$ echo '<?php json_encode(true);' | php PHP Fatal error: Call to undefined function json_encode() in - on line 1 PHP Stack trace: PHP 1. {main}() -:0 user@vm:~$ php -v - PHP 5.5.3-1ubuntu2 (cli) (built: Oct 9 2013 14:49:12) + PHP 5.5.3-1ubuntu2 (cli) (built: Oct 9 2013 14:49:12) Copyright (c) 1997-2013 The PHP Group Zend Engine v2.5.0, Copyright (c) 1998-2013 Zend Technologies - with Zend OPcache v7.0.3-dev, Copyright (c) 1999-2013, by Zend Technologies - with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Rethans + with Zend OPcache v7.0.3-dev, Copyright (c) 1999-2013, by Zend Technologies + with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Rethans --- [1] http://php.net/manual/en/function.json-encode.php ProblemType: Bug DistroRelease: Ubuntu 13.10 Package: php5 (not installed) ProcVersionSignature: Ubuntu 3.11.0-12.19-generic 3.11.3 Uname: Linux 3.11.0-12-generic x86_64 ApportVersion: 2.12.5-0ubuntu2 Architecture: amd64 Date: Mon Oct 21 16:30:04 2013 InstallationDate: Installed on 2013-06-03 (140 days ago) InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release amd64 (20130424) MarkForUpload: True SourcePackage: php5 UpgradeStatus: Upgraded to saucy on 2013-10-21 (0 days ago) ** Summary changed: - php5-common is missing dependency on php5-json + [MIR] php5-common is missing dependency on php5-json ** Also affects: php-json (Ubuntu) Importance: Undecided Status: New ** Description changed: + MIR for php-json: + [Availability] Available in universe; successfully built on all architectures. [Rationale] Useful functionality for a large proportion of php users; JSON support is pretty essential for many web services nowadays. New dependency of php5 (see background information below) [Security] JSON parsing is security sensitive; particular in web applications for which PHP is often used. This package is a wrapper around json-c which is in main already. We do need to make sure that the wrapper is not vulnerable, but the JSON parsing itself is already covered by json-c in main. No other relevant security history. CVE-2009-1271 appears to refer to the JSON module bundled with PHP and not this alternative implementation. No suid or sgid binaries. No executables in /sbin or /usr/sbin. No daemons. No use of privileged ports. This is an add-on to PHP and an expected use (parsing untrusted input) is security sensitive. [QA] Works with no further configuration or documentation. No debconf questions. No long-term outstanding bugs upstream. The only bug in Debian appears to relate to a edge case difference in error handling behaviour, which I'm not sure is a bug at all. No relevant bugs in Ubuntu. Outstanding Lintian bugs all refer to PHP packaging issues; this package is maintained by the PHP maintainer in Debian. No exotic hardware. Test suite is run during package build using dh_auto_test which fails on test suite failure. No watch file. [Dependencies] All in main, including libjson-c-dev. [Standards compliance] Packaging uses debhelper 9, standard phpize and dh-php5. [Maintenance] This is a straightforward wrapper around json-c. Except to trivially keep synced with Debian. The Ubuntu Server team will subscribe to the package. [Background Information] The JSON module bundled by PHP upstream is not DFSG compliant due to a problem with a licence term. See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692613 for details. So Debian does not ship with the embedded JSON module, but instead ships php-json (binary: phphp5-json) which is an independent implementation, and php depends on it. For parity with Debian and common use of PHP, we should have php-json in main. Otherwise we cannot depend on php5-json, and so JSON functionality in PHP will be broken by default. [Original Description] After the upgrade to saucy the function json_encode is missing from the current version of php5. It should be always there on PHP versions >= 5.2.0 (not a pecl module anymore) [1] to reproduce: --- user@vm:~$ echo '<?php json_encode(true);' | php PHP Fatal error: Call to undefined function json_encode() in - on line 1 PHP Stack trace: PHP 1. {main}() -:0 user@vm:~$ php -v PHP 5.5.3-1ubuntu2 (cli) (built: Oct 9 2013 14:49:12) Copyright (c) 1997-2013 The PHP Group Zend Engine v2.5.0, Copyright (c) 1998-2013 Zend Technologies with Zend OPcache v7.0.3-dev, Copyright (c) 1999-2013, by Zend Technologies with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Rethans --- [1] http://php.net/manual/en/function.json-encode.php ProblemType: Bug DistroRelease: Ubuntu 13.10 Package: php5 (not installed) ProcVersionSignature: Ubuntu 3.11.0-12.19-generic 3.11.3 Uname: Linux 3.11.0-12-generic x86_64 ApportVersion: 2.12.5-0ubuntu2 Architecture: amd64 Date: Mon Oct 21 16:30:04 2013 InstallationDate: Installed on 2013-06-03 (140 days ago) InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release amd64 (20130424) MarkForUpload: True SourcePackage: php5 UpgradeStatus: Upgraded to saucy on 2013-10-21 (0 days ago) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1242726 Title: [MIR] php5-common is missing dependency on php5-json To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php-json/+bug/1242726/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
