[Summary]
ACK from the MIR team.
This does need a security review, so I'll assign ubuntu-security list specific
binary packages to be promoted to main
[Duplication]
There is no other package in main providing the same functionality.
[Dependencies]
- no other Dependencies to MIR due to this apart from ostree which is listed
above
[Embedded sources and static linking]
- no embedded source present
- no static linking
[Security]
- history of CVEs does not look concerning
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats
- does not open a port
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop (apart in tests)
- does not deal with system authentication (eg, pam), etc)
Problems:
- it does run a daemon as root and interacts with cgroups. This isn’t part of
the binary package we are promoting, however, as we have the rule "if the
source in is main, we can promote any other binary package without a new MIR",
this will need to be checked right now with the security team.
[Common blockers]
OP:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- does have a test suite that runs as autopkgtest. Some tests are marked as
flaky
- The package has a team bug subscriber
- translation presents?
- not a python/go package, no extra constraints to consider int hat regard
- no new python2 dependency
[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- symbols tracking is in place
- d/watch is present and looks ok
- Upstream update history is good
- Debian/Ubuntu update history is good
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far
- no massive Lintian warnings
- d/rules is rather clean
- Does not have Built-Using
[Upstream red flags]
OK:
- no Errors/warnings during the build
- no incautious use of malloc/sprintf (as far as I can check it)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit, seed or libgoa-*
- no embedded source copies
- not part of the UI for extra checks
** Changed in: flatpak (Ubuntu)
Assignee: Didier Roche (didrocks) => Ubuntu Security Team (ubuntu-security)
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1812456
Title:
[MIR] libflatpak0
Status in flatpak package in Ubuntu:
New
Bug description:
Many applications have Flatpak integration using libflatpak. The
Ubuntu desktop team would like libflatpak0 in main so we can easily
build such applications. It takes a lot of work to make these
dependencies optional and sometimes that is not possible. We don't
need the Flatpak functionality to work by default and do not expect
any other Flatpak packages to be installed by default.
Default packages that have flatpak integration:
- gnome-control-center (application panel).
- malcontent (parental controls)
Availability
============
In Universe, builds for all architectures and in sync with Debian.
Rationale
=========
Multiple default packages have libflatpak as a dependency, including
malcontent (LP: #1892456).
Security
========
This will need a Security review.
https://security-tracker.debian.org/tracker/source-package/flatpak
There have been two CVEs, both have been fixed in all supported Ubuntu
releases.
More recently, there is LP: #1815528
Quality Assurance
=================
Bug subscriber: should be Ubuntu Desktop Bugs
https://bugs.launchpad.net/ubuntu/+source/flatpak
https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=flatpak
https://github.com/flatpak/flatpak/issues
tests are run as build tests (with dh_auto_test) and installed autopkgtests
on Debian and Ubuntu.
https://ci.debian.net/packages/f/flatpak
http://autopkgtest.ubuntu.com/packages/f/flatpak
UI Standards
============
N/A
Dependencies
============
All in main except for libostree-1-1 (LP: #1892454)
Standards Compliance
====================
Package uses standards version 4.5.0.
Maintenance
===========
- Actively developed upstream
https://github.com/flatpak/flatpak
- Maintained in Debian by the pkg-utopia team but more specifically,
it is maintained by Simon McVittie (smcv) who maintains Flatpak,
ostree, xdg-dbus-proxy, xdg-desktop-portal and xdg-desktop-portal-gtk.
short dh7 style rules, dh compat 10
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1812456/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
