golang-github-go-ini-ini
[Summary]
Some fixes are needed:
- subscribe foundations to the package
- -cmp- is evaluated and migrates to main.
- riscv64 and armhf builds are failing
This also does need a security review once the above is dealt with.
[Duplication]
This is the only protobuf implementation by google, the other one is using non
binary format (gogoprotobuf) and is not supported.
[Dependencies]
KO:
- depends on -cmp-, please check it
[Embedded sources and static linking]
OK:
- no embedded source present
- Go statically link by essence, generates go files to be checked into the
project.
[Security]
OK:
- history of CVEs does not look concerning
- does not open a port
- does not use webkit1,2
- does not use lib*v8 directly
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does run a daemon as root
Problems:
- parse data formats (binary protobuf format). A security team check will be
required for this reason.
[Common blockers]
OK:
- no translation present, but none needed for this case
- not a python package, no extra constraints to consider in that regard
- Go package that uses dh-golang
TODO: Problems:
- FTBFS currently on armhf and riscv64 and needs to be fixed.
- The package has no team bug subscriber (Should be Foundations, please
subscribe)
[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- symbols tracking not applicable for this kind of code.
- d/watch is present and looks ok
- Upstream does regular release
- The package is up to date with recent releases
- Debian/Ubuntu update history is ok
- promoting this does not seem to cause issues for MOTUs that so far
maintained the package
- no massive Lintian warnings
- d/rules is rather clean
- Testsuite is running as part of the build
- Go Package that follows the Debian Go packaging guidelines.
[Upstream red flags]
OK:
- no Errors/warnings during the build
- no incautious use of malloc/sprintf (Go)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit, seed or libgoa-*
- no embedded source copies
- not part of the UI for extra checks
- good testsuite
** Changed in: golang-google-protobuf (Ubuntu)
Status: New => Incomplete
** Changed in: golang-google-protobuf (Ubuntu)
Assignee: Didier Roche (didrocks) => (unassigned)
** Changed in: golang-golang-x-time (Ubuntu)
Assignee: (unassigned) => Didier Roche (didrocks)
** Changed in: golang-golang-x-sys (Ubuntu)
Assignee: (unassigned) => Didier Roche (didrocks)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1894731
Title:
[MIR] golang-*, Go build dependencies of google-guest-agent
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/golang-github-gcp-guest-logging-go/+bug/1894731/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
