Review for Source Package: prompt-toolkit
Launchpad bug: https://bugs.launchpad.net/bugs/2161382
Target series: devel
Analysed source version: 3.0.53-1 (proposed pocket)
Binary packages: python3-prompt-toolkit
[Summary]
OK:
- Review for Source Package: prompt-toolkit
- Reporter MIR content found and used as context.
- Package has team subscriber(s): ubuntu-openstack
- MIR Team Ack. No required findings or hard blockers were identified across
all sections.
Two recommended items remain (a missing dh_python3 helper in debian/rules and
minor setuptools deprecation warnings in the build log) that the human reviewer
may wish to note but do not block promotion.
- No security review appears needed; all security checks pass and the package
is not security-sensitive.
(The package has zero CVEs in the Ubuntu CVE tracker, no setuid/setgid
binaries, no services, no exposed endpoints, and no crypto or authentication
handling. While the upstream source includes optional telnet and SSH server
contrib modules, the packaged library itself does not expose endpoints or parse
untrusted network data in its primary use case as a CLI prompt toolkit.)
- List of specific binary packages to be promoted to main:
python3-prompt-toolkit
Required TODOs:
- none
Recommended TODOs:
- none
[Rationale, Duplication and Ownership]
OK:
- There is no other package in main providing the same functionality.
A lot of things prompt, none provide a Python library for interactive
command-line input like prompt-toolkit. Similar python approaches are
python3-urwid and python3-textual but neither is in main. cmd2 comes to mind as
well, but then this is what pulls this in now - so the loop closes.
- A team is committed to own long term maintenance of this package.
(The team mapping shows ubuntu-openstack as a subscribed team for
prompt-toolkit, which per policy is strong evidence of ownership. The MIR
report also explicitly states that ~ubuntu-openstack is the owning team and
that they have acknowledged the commitment.)
- The rationale given in the report seems valid and useful for Ubuntu
(The reporter clearly states that prompt-toolkit is a new runtime dependency
of cmd2, which is already supported in main, and provides a link to the
upstream change justifying the migration from GNU Readline. The dependency
analysis confirms that all runtime dependencies are already in main, supporting
the stated need.)
Problems: none
[Dependencies]
OK:
- no runtime dependencies outside main needing MIR
- no other build-time Dependencies with active code in the final binaries to
MIR due to this
(The package produces an architecture-all Python binary with no static
binaries, no vendored directories, and no Go/Rust lock files present. Build
dependencies are standard Python tooling (debhelper, pybuild, setuptools) and
test-only packages that do not embed code into the shipped .deb.)
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring more
tests now.
(The dependency python3-wcwidth has passing autopkgtests on all
architectures, while python3 is the core interpreter which is implicitly
validated by the broader ecosystem.)
Problems: none
[Embedded sources and static linking]
OK:
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard
- Does not include vendored code
(No usual vendored directories (vendor/, third_party/, ...) were found in the
source or shipped in the binaries. The package is a pure Python module with no
embedded copies of external libraries.)
Problems: none
[Security]
OK:
- history of CVEs does not look concerning
(The Ubuntu CVE tracker indicates zero total, active, and fixed CVEs for this
package. While upstream enrichment failed, the lack of issues in the distro
tracker suggests a clean history.)
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats (files [images, video, audio, xml, json, asn.1],
network packets, structures, ...) from an untrusted source.
- does not expose any external endpoint (port/socket/... or similar)
(No service files or desktop files are present in the packaging, and the
binary package is a pure Python library. While the upstream source includes
contrib modules for telnet and SSH servers, these are library components that
applications may optionally use; the package itself does not activate or
install any network-listening service.)
- does not process arbitrary web content
(The package is a Python library for building interactive command-line
prompts and full-screen terminal applications; its runtime dependencies are
only python3 and python3-wcwidth, with no web-framework or HTTP-client
dependencies. The source tree contains terminal rendering, key-binding,
completion, and layout modules, and while an HTML formatted-text module exists,
it is for terminal display markup rather than fetching or parsing arbitrary web
content.)
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
(No crypto or signature-related patterns were found in the source, and the
runtime dependencies (python3 and python3-wcwidth) are general-purpose packages
that also do not deal with security attestation. The package is a pure Python
library for building interactive command-line interfaces, so the absence of
security attestation handling is appropriate.)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)
(No crypto-related runtime dependencies were found, and automated source
pattern scanning produced no crypto hits. The contrib/ssh module and asyncssh
build-dependency suggest SSH support is delegated to the external asyncssh
library rather than implemented in-tree.)
- this makes appropriate (for its exposure) use of established risk mitigation
features (dropping permissions, using temporary environments, restricted
users/groups, seccomp, systemd isolation features, apparmor, ...)
(The package ships only Python modules under usr/lib/python3/dist-packages
with no systemd units, AppArmor profiles, setuid/setgid binaries, cron jobs, or
desktop files. Since it is a library consumed by other applications rather than
a long-running service or privileged binary, no additional integrated risk
mitigation features are strictly required.)
Problems: none
[Common blockers]
OK:
- does not FTBFS currently; Launchpad build records pass for arches: amd64;
local sbuild build also succeeded
- A build-time test suite exists and runs via dh_auto_test with pytest; the
build succeeded and there is no evidence that test failures are ignored.
(The build log shows dh_auto_test invoking pytest on the tests directory
(line 1230–1231), and python3-pytest is listed in Build-Depends with the
nocheck build profile. The build completed successfully with no indication of
swallowed test failures.)
- does have a non-trivial test suite that runs as autopkgtest
(The autopkgtest database shows tests passing on seven architectures with no
failures, providing authoritative evidence that tests exist and run
successfully. The declared test "pt" exercises the upstream pytest suite
covering core library functionality (completion, CLI, buffers, key bindings,
etc.), which is non-trivial rather than a bare import or smoke check.)
- This does not need special HW for build or test
(prompt-toolkit is a pure Python library (architecture: all) with standard
build dependencies and a pytest-based test suite that runs without any exotic
or dedicated hardware. The reporter's MIR content does not mention any special
hardware requirements, and the package metadata confirms a straightforward
Python package build.)
- no new python2 dependency
- not a go package, no extra constraints to consider in that regard
- Python package detected but dh_python/dh_python3 not found in debian/rules,
this uses the newer dh-sequence-python3 in d/control
Problems: none
[Packaging red flags]
OK:
- Ubuntu does not carry a delta
(The delta analysis reports a sync with no Ubuntu revision and an empty
diffstat, confirming version 3.0.53-1 is a direct sync from Debian. There are
no Ubuntu-specific packaging changes to review.)
- symbols tracking not applicable for this kind of code
(the package ships no shared library (.so), so ABI symbol tracking does not
apply)
- debian/watch is present and looks ok
- Upstream update history is (good/slow/sporadic)
(The upstream project has released 42 versions over approximately 10 years,
with an average interval of 86 days and a 'good' cadence descriptor. Recent
versions (3.0.44 through 3.0.53) indicate ongoing maintenance.)
- Debian/Ubuntu update history is (good/slow/sporadic)
(The package has an average upload interval of 86 days over 42 releases,
fitting the definition of a good cadence. The current version matches the
latest upstream release.)
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far maintained
the package
(The package has no individual or team uploaders listed in
ubuntu-upload-permission, and the upload history shows no regular Ubuntu
uploader, indicating it is synced from Debian without MOTU-specific
maintenance.)
- no excessive lintian warnings
- debian/rules is rather clean
(The rules file is short (~15 non-comment lines) and uses a classic '%: dh $@
--buildsystem=pybuild' pattern. The two override targets only remove leftover
egg-info directories after cleaning and patch the installed __version__ string
via sed, neither of which disables hardening or tests.)
- It is not on the lto-disabled list
Problems: none
[Upstream red flags]
OK:
- no incautious use of malloc/sprintf (the language has no direct MM)
(All shipped source files are Python modules (.py) under src/prompt_toolkit/,
and the build produces a single architecture-all Python package, confirming
this is a memory-safe language with no direct memory management.)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests)
- no use of user 'nobody' outside of tests
- no use of setuid / setgid
- no important open bugs (crashers, etc) in Debian or Ubuntu
(Launchpad shows only the MIR bug itself with no critical or security issues;
Debian BTS reports zero open bugs; and the upstream GitHub tracker shows zero
open issues.)
- no dependency on webkit, qtwebkit or libseed
- not part of the UI for extra checks
- no translation present, but none needed for this case (not user visible)
- no critical Errors/warnings during the build, few warnings but not a blocker:
(2 build warning(s): SetuptoolsDeprecationWarning: License classifiers are
deprecated)
Problems: none
** Changed in: prompt-toolkit (Ubuntu)
Status: New => In Progress
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161382
Title:
[MIR] prompt-toolkit
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/prompt-toolkit/+bug/2161382/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
