The package was updated after the previous review:
https://git.launchpad.net/ubuntu/+source/ubuntu-insights/commit/?id=a6d38909e1baa73c784a18b225327da131b3506c
The following is the updates review template.
==========
Re-Review for Source Package: ubuntu-insights
[Summary]
The ubuntu-insights package will be used for transparent, consent-based,
non-PII system info and metrics collection, eventually fully replacing the
functionality of `ubuntu-report` while providing new capabilities. It will
gradually replace `ubuntu-report` in desktop images and be integrated with WSL
images. Additionally, new use-cases enabled by this are periodic collection,
centralized handling for multiple applications, and handling WSL environments.
MIR team ACK with a few comments in the Notes.
This does need a security review, so I'll assign ubuntu-security.
=> The upstream has no CVE history. But the Security team might want
to review the dependency vendoring, though it seems to be within
the MIR framework for Golang packages.
List of specific binary packages to be promoted to main: bin:ubuntu-insights,
bin:libinsights0, bin:libinsights-dev
Specific binary packages built, but NOT to be promoted to main: None
Notes:
#1 The ubuntu-insights project is very young! The package has spent a very
short time
in universe. This may or may not be a concern.
#2 Most of the upstream development is done by 2 developers. Again, this may
or may not be a concern.
#3 As noted in the summary, ubuntu-insights is expected to eventually, fully
replace
ubuntu-report. However, ubuntu-insights cannot refresh the content of
existing users and transferring content is infeasible in Ubuntu 25.10.
Hence, ubuntu-report
would have to be retained in main, for now.
[Rationale, Duplication and Ownership]
OK:
- There is no other package in main providing the same functionality.
=> The ubuntu-insights package is intended to be a replacement for
ubuntu-report.
- A team is committed to own long term maintenance of this package.
=> Desktop Packages is subscribed.
- The rationale given in the report seems valid and useful for Ubuntu.
Problems: None
[Dependencies]
OK:
- no other Dependencies to MIR due to this
- src:ubuntu-insights checked with `check-mir`
- all dependencies can be found in `seeded-in-ubuntu` (already in main)
- none of the (potentially auto-generated) dependencies (Depends
and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring more
tests now.
Problems: None
[Embedded sources and static linking]
OK:
- does not have unexpected Built-Using entries
=> For bin:ubuntu-insights, Built-Using only has the Golang package used to
build
- vendoring is used, but the reasoning is explained
- golang: static builds are used, the team confirmed their commitment
to the additional responsibilities implied by static builds.
- Includes vendored code, the package has documented how to refresh this
code at debian/README.source
- not a rust package, no extra constraints to consider in that regard
Problems: None
[Security]
OK:
- no history of CVEs
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats (files [images, video, audio,
xml, json, asn.1], network packets, structures, ...) from
an untrusted source.
- does not expose any external endpoint (port/socket/... or similar)
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)
- this makes appropriate (for its exposure) use of established risk
mitigation features (dropping permissions, using temporary environments,
restricted users/groups, seccomp, systemd isolation features,
apparmor, ...)
=> Strict containment policies adopted for the systemd services as seen in:
autostart/systemd/ubuntu-insights-collect.service
autostart/systemd/ubuntu-insights-upload.service
[Common Blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- does have a non-trivial test suite that runs as autopkgtest
- This does not need special HW for build or test
- no new python2 dependency
- Go package, but using dh-golang
Problems: None
[Packaging red flags]
OK:
- Ubuntu does not carry a delta
=> This package does not exist in Debian
- symbols tracking not applicable for this kind of code.
- debian/watch is not present but also not needed (e.g. native)
- Upstream update history is good
=> Upstream is less than 60 days old at the time of this review
- Debian/Ubuntu update history is good
=> The package is less than 60 days old at the time of this review
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far maintained
the package
- no massive Lintian warnings
- debian/rules is rather clean
- It is not on the lto-disabled list
Problems: None
[Upstream red flags]
OK:
- no Errors/warnings during the build
- no incautious use of malloc/sprintf (the language has no direct MM)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of user 'nobody' outside of tests
- no use of setuid / setgid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit or libseed
- not part of the UI for extra checks
- no translation present, but none needed for this case
Problems: None
==========
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2118794
Title:
[MIR] ubuntu-insights
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-insights/+bug/2118794/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
