MIR review of golang-github-golang-groupcache:
[Summary]
There are 2 issues that need to be addressed:
- this has a runtime (and build) dep on golang-goprotobuf-dev, which is in
universe,
and is not included in the list of packages for evaluation in this MIR bug
- foundations team needs to subscribe to package
There are 2 additional issues that should be reviewed but are not blockers:
- embedded code 'singleflight' duplicated from golang-x-sync package
- no upstream release (ever) and packaged code is from 2017
I don't see any item requiring a security review.
[Duplication]
There is no other package in main providing the same functionality.
[Dependencies]
OK:
- no -dev/-debug/-doc packages that need exclusion (only binary provided is a
-dev package)
Problems:
- this has a runtime (and build) dep on golang-goprotobuf-dev, which is in
universe,
and is not included in the list of packages for evaluation in this MIR bug
[Embedded sources and static linking]
OK:
- go always static links
Problems:
- embedded source present:
- 'singleflight' is embedded code from golang-golang-x-sync package
it's not completely clear which package copied which, but it seems
x-sync was first:
https://pkg.go.dev/golang.org/x/sync/singleflight?tab=versions
https://pkg.go.dev/github.com/golang/groupcache/singleflight?tab=versions
[Security]
OK:
- history of CVEs does not look concerning
- does not parse data formats
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not open a port
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- no translation present, but none needed for this case (nothing user visible,
library only)
- no new python2 dependency
- not Python package
- Go package that uses dh-golang
Problems:
- does not have a test suite that runs as autopkgtest
- The package does not has a team bug subscriber (foundations, please subscribe)
[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- symbols tracking not applicable for this kind of code.
- d/watch is present and looks ok
- promoting this does not seem to cause issues for MOTUs that so far
maintained the package
- no massive Lintian warnings
- d/rules is rather clean
- Does not have Built-Using
- Go Package that follows the Debian Go packaging guidelines
Problems:
- Upstream update history is slow; there are no upstream releases at all
- the current release is not packaged, as there are no upstream releases
- Debian/Ubuntu update history is slow; current version is from 2017
[Upstream red flags]
OK:
- no Errors/warnings during the build
- no incautious use of malloc/sprintf (as far as I can check it)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit, seed or libgoa-*
- not part of the UI for extra checks
Problems:
- embedded source copies of 'singleflight' from golang-x-sync, see embedded
section above
** Changed in: golang-github-golang-groupcache (Ubuntu)
Status: New => Incomplete
** Changed in: golang-github-golang-groupcache (Ubuntu)
Assignee: Dan Streetman (ddstreet) => Balint Reczey (rbalint)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1894731
Title:
[MIR] golang-*, Go build dependencies of google-guest-agent
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/golang-github-gcp-guest-logging-go/+bug/1894731/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
