** Changed in: lua5.5 (Ubuntu)
Assignee: (unassigned) => Mitchell Augustin (mitchellaugustin)
** Description changed:
This MIR will allow packages in main to migrate from depending on lua5.4
to lua5.5. I used the prior MIR for Lua 5.4 as a template for this MIR:
https://bugs.launchpad.net/ubuntu/+source/lua5.4/+bug/2026608
[Availability]
The package lua5.5 is already in Ubuntu universe.
The package lua5.5 build for the architectures it is designed to work on.
It currently builds and works for architectures: amd64, arm64, armhf,
ppc64el, riscv64, s390x
Link to package https://launchpad.net/ubuntu/+source/lua5.5
[Rationale]
- The package lua5.5 is required in Ubuntu main for migrating our standard
version of lua from 5.4 to 5.5
- The package lua5.5 will generally be useful for a large part of our user
base
- Additionally multiple packages will no longer need forced compatibility
with lua5.4
- The package lua5.5 is required in Ubuntu main no later than Feature Freeze
to make it our main supported version in 26.10
[Security]
The package has no Debian or Ubuntu-reported CVEs:
https://ubuntu.com/security/cves?package=lua5.5
https://security-tracker.debian.org/tracker/source-package/lua5.5
- no `suid` or `sgid` binaries (checked with `find "$pkgdir" -xdev -type f
-perm /6000 -printf '%M %u:%g %p\n'` on liblua5.5-0, liblua5.5-dev, lua5.5 debs)
- no executables in `/sbin` and `/usr/sbin`
- Package does not open privileged ports (grepped for
socket/bind/listen/connect-style networking calls, found none)
- Package does not contain extensions to security-sensitive software
[Quality assurance - function/usage]
- Package works as intended after install (tested `lua5.5 hello.lua`, where
hello.lua is a hello world file)
[Quality assurance - maintenance]
- The package is well maintained in Debian, Ubuntu, and Upstream. In Ubuntu
and Debian, it currently has no open bugs, and upstream, 4/7 bugs have been
fixed. All closed bugs were fixed relatively quickly (within 2 weeks) after
opening:
+ https://bugs.launchpad.net/ubuntu/+source/lua5.5/+bugs
+ https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=lua5.5
+ https://www.lua.org/bugs.html#5.5.0
[Quality assurance - testing]
- The package does not run a full test suite at build time as one is not
provided upstream
- The package has two autopackagetests, both of which are passing on all
architectures in Stonking: https://autopkgtest.ubuntu.com/packages/lua5.5
[Quality assurance - packaging]
- debian/watch is present and works
- debian/control defines a correct Maintainer field (Debian Lua Team
<[email protected]>)
No lintian warnings or errors, only some informational messages with
EvIL/pedantic:
- Full output from lintian -EvIL +pedantic:
❯ lintian -EvIL +pedantic ../*lua*.deb
I: liblua5.5-0: hardening-no-bindnow
[usr/lib/x86_64-linux-gnu/liblua5.5-c++.so.0.0.0]
I: liblua5.5-0: hardening-no-bindnow
[usr/lib/x86_64-linux-gnu/liblua5.5.so.0.0.0]
X: liblua5.5-0: exit-in-shared-library
[usr/lib/x86_64-linux-gnu/liblua5.5-c++.so.0.0.0]
X: liblua5.5-0: exit-in-shared-library
[usr/lib/x86_64-linux-gnu/liblua5.5.so.0.0.0]
❯ lintian -EvIL +pedantic ../lua*.deb
❯ ls ../*.deb
../liblua5.5-0_5.5.0-3_amd64.deb ../liblua5.5-dev_5.5.0-3_amd64.deb
../lua5.5_5.5.0-3_amd64.deb
❯ lintian -EvIL +pedantic ../lua5.5_5.5.0-3_amd64.changes
I: liblua5.5-0: hardening-no-bindnow
[usr/lib/x86_64-linux-gnu/liblua5.5-c++.so.0.0.0]
I: liblua5.5-0: hardening-no-bindnow
[usr/lib/x86_64-linux-gnu/liblua5.5.so.0.0.0]
I: lua5.5 source: older-debian-watch-file-standard 4 [debian/watch]
I: lua5.5 source: patch-not-forwarded-upstream
[debian/patches/0001-build-system.patch]
I: lua5.5 source: patch-not-forwarded-upstream
[debian/patches/0002-lua-modules-paths.patch]
P: lua5.5 source: redundant-rules-requires-root-no-field [debian/control:11]
X: lua5.5 source: debian-watch-does-not-check-openpgp-signature [debian/watch]
X: liblua5.5-0: exit-in-shared-library
[usr/lib/x86_64-linux-gnu/liblua5.5-c++.so.0.0.0]
X: liblua5.5-0: exit-in-shared-library
[usr/lib/x86_64-linux-gnu/liblua5.5.so.0.0.0]
X: lua5.5 source: upstream-metadata-file-is-missing
- No Lintian overrides
- No dependencies on obsolete packages
- Not installed by default
- Packaging and build is easy, although there are a large number of
commands in override_dh_auto_install, link to debian/rules
https://git.launchpad.net/ubuntu/+source/lua5.5/tree/debian/rules
(comparable to lua5.4 MIR -
https://bugs.launchpad.net/ubuntu/+source/lua5.4/+bug/2026608)
[UI standards]
- Application is not end-user facing (does not need translation) (other than
lua shell, but this has limited text)
[Dependencies]
- No further depends or recommends dependencies that are not yet in main
[Migration Plan from Lua 5.4->Lua 5.5 in main]
Reverse Dependencies in main:
- The prior version of Lua in main, 5.4, has the following reverse
dependencies in main that we intend to transition to lua5.5 once the MIR is
complete: apache2, ceph,dovecot,frr,haproxy,ibus-libpinyin,wireplumber,memcached
dovecot, haproxy, memcached currently FTBFS when switch to depend on
lua5.5 - this is being investigated and will need to be resolved before
5.4 can be demoted.
- dovecot: I believe this requires an update of lua-json to 1.3.5 - opened
- here: https://salsa.debian.org/lua-team/lua-json/-/merge_requests/1.
- (testing, to be confirmed)
+ dovecot: Requires an update of lua-json to 1.3.5 - opened here:
+ https://salsa.debian.org/lua-team/lua-json/-/merge_requests/1, as well
+ as some additional symlinks to have it properly generate the 5.5 install
+ directories. lua-json also requires an update to lua-lpeg with
+ essentially the same symlinks. Builds successfully in my PPA below after
+ taking these steps (but still needs functional testing)
haproxy: Builds successfully after specifying
`LUA_INC=/usr/include/lua5.5 LUA_LIB_NAME=lua5.5` as MAKEARGS
memcached: Builds successfully after adding the newly introduced third
parameter to lua_newstate in 2 instances:
- L = lua_newstate(mcp_profile_alloc, prof);
+ L = lua_newstate(mcp_profile_alloc, prof, luaL_makeseed(NULL));
Other packages built successfully in
https://launchpad.net/~mitchellaugustin/+archive/ubuntu/quick-publish-
dev-ppa-10-10-25/+packages
[Standards compliance]
- This package correctly follows FHS and Debian Policy
[Maintenance/Owner]
- Owning Team will be Ubuntu Server
- Team is not yet, but will subscribe to the package before promotion
- This does not use static builds
- This does not use vendored code
- This package is not rust based
- The package successfully built during the most recent test rebuild
[Background information]
The Package description explains the package well
Upstream Name is lua
https://www.lua.org/source/5.5/
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2155757
Title:
[MIR] lua5.5
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lua5.5/+bug/2155757/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
