Review for Source Package: src:python-configargparse [Summary] The src:python-configargparse package is a runtime dependency of src:python-awscurl which is also undergoing the MIR process. Both these packages are new runtime dependencies for OpenStack Ceilometer.
The python-confingargparse package is a drop-in replacement for argparse from the Python standard library and offers additional capability to parse config files and/or environment variables. MIR team ACK under the constraint to resolve the below listed required TODOs and as much as possible having a look at the recommended TODOs. This does not need a security review. It is a pure Python library used to parse configuration files and does not include any security-sensitive functions. See #1 under Notes. List of specific binary packages to be promoted to main: bin:python3-configargparse Specific binary packages built, but NOT to be promoted to main: None. Notes: #0 - python3-configargparse is a runtime dependency of python3-awscurl which is also currently going through the MIR process. https://bugs.launchpad.net/ubuntu/+source/python-awscurl/+bug/2142240 #1 - Out of the supported formats - yaml, ini, toml, env vars and config args - yaml is a security-sensitive format with code execution risks. To mitigate, the package uses yaml.SafeLoader: parsed_obj = yaml.load(stream, Loader=SafeLoader) Additionally, ast.literal_eval() is used instead of eval(), for config args. Required TODOs: #2 - Required TODO #1 in the python-awscurl MIR is also relevant here. https://bugs.launchpad.net/ubuntu/+source/python-awscurl/+bug/2142240/comments/1 Recommended TODOs: #3 - Please consider packaging the latest upstream release 1.7.3. The current packaged release (1.7) over 2.5 years old. #4 - Please consider upgrading the debian/watch format. See Packaging Red Flags. #5 - Please consider fixing the warning noted in Upstream Red Flags. [Rationale, Duplication and Ownership] - There is no other package in main providing the same functionality. - A team is committed to own long term maintenance of this package. => ubuntu-cloud-archive - The rationale given in the report seems valid and useful for Ubuntu [Dependencies] OK: - no other runtime Dependencies to MIR due to this - no other build-time Dependencies with active code in the final binaries to MIR due to this - no -dev/-debug/-doc packages that need exclusion - No dependencies in main that are only superficially tested requiring more tests now. Problems: None [Embedded sources and static linking] OK: - no embedded source present - no static linking - does not have unexpected Built-Using entries - not a go package, no extra constraints to consider in that regard - not a rust package, no extra constraints to consider in that regard [Security] OK: - history of CVEs does not look concerning => no history - does not run a daemon as root - does not use webkit1,2 - does not use lib*v8 directly - does not parse data formats (files [images, video, audio, xml, json, asn.1], network packets, structures, ...) from an untrusted source. => Likely to parse users' config files. - does not expose any external endpoint (port/socket/... or similar) - does not process arbitrary web content - does not use centralized online accounts - does not integrate arbitrary javascript into the desktop - does not deal with system authentication (eg, pam), etc) - does not deal with security attestation (secure boot, tpm, signatures) - does not deal with cryptography (en-/decryption, certificates, signing, ...) - this makes appropriate (for its exposure) use of established risk mitigation features (dropping permissions, using temporary environments, restricted users/groups, seccomp, systemd isolation features, apparmor, ...) => Not relevant, configargparse is parser for yaml, ini, arguments and environment variables. Problems: None [Common blockers] OK: - does not FTBFS currently - does have a test suite that runs at build time - test suite fails will fail the build upon error. - if a non-trivial test on this level does not make sense (the lib alone is only doing rather simple things), is the overall solution (app+libs) extensively covered i.e. via end to end autopkgtest ? => python-awscurl's autopkgtests do cover the use of configargparse - no new python2 dependency - Python package, but using dh_python Problems: - does not have a non-trivial test suite that runs as autopkgtest => Rationale provided by the reporter: configparse is a simple extension of Python stdlib's argparse. It has a robust build-time test suite and does not have any install-time behavior to be tested. [Packaging red flags] OK: - Ubuntu does not carry a delta - symbols tracking not applicable for this kind of code. - debian/watch is present and looks ok - Upstream update history is sporadic - Debian/Ubuntu update history is sporadic - promoting this does not seem to cause issues for MOTUs that so far maintained the package - no massive Lintian warnings - debian/rules is rather clean - It is not on the lto-disabled list Problems: - the current release is not packaged => though the latest release happened after this MIR was submitted, the current packaged released is 2.5 years old. - lintian complains about the old watch file format on resolute => W: python-configargparse source: obsolete-debian-watch-file-standard 3 [debian/watch] [Upstream red flags] OK: - no Errors/warnings during the build - no incautious use of malloc/sprintf (the language has no direct MM) - no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH - no use of user 'nobody' outside of tests - no use of setuid / setgid - no important open bugs (crashers, etc) in Debian or Ubuntu - no dependency on webkit, qtwebkit or libseed - not part of the UI for extra checks - part of the UI, desktop file is ok - no translation present, but none needed for this case (user visible)? - translation present Problems: - 1 warning noted from the build log tests/test_configargparse.py:949 /<<PKGBUILDDIR>>/.pybuild/cpython3_3.12_configargparse/build/tests/test_configargparse.py:949: SyntaxWarning: invalid escape sequence '\s' r'which override defaults. '.replace(' ', '\s*') % OPTIONAL_ARGS_STRING ** Changed in: python-configargparse (Ubuntu) Status: New => In Progress ** Changed in: python-configargparse (Ubuntu) Assignee: Pushkar Kulkarni (pushkarnk) => (unassigned) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2142251 Title: [MIR] python-configargparse To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python-configargparse/+bug/2142251/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
