Thanks Christian, I think you're right, this probably doesn't need a
security review and being centralized in one place will probably be
easier to maintain.
Thanks
** Changed in: libbpf (Ubuntu)
Status: New => Fix Committed
** Changed in: libbpf (Ubuntu)
Assignee: Seth Arnold (seth-arnold) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to iproute2 in Ubuntu.
https://bugs.launchpad.net/bugs/1910576
Title:
[MIR] libbpf (dependency of iproute2)
Status in iproute2 package in Ubuntu:
Invalid
Status in libbpf package in Ubuntu:
Fix Committed
Bug description:
[Availability]
libbpf | 0.1.0-1 | groovy/universe | source
libbpf | 0.3-2 | hirsute/universe | source
[Rationale]
Libbpf is (or is about to become) a dependency for building iproute2 which
already is in main. Using BPF is becoming more wide-spread. The library allows
to load and use eBPF programs from user-space (functionality provided by the
kernel). It is already maintained in main for Debian
(https://tracker.debian.org/pkg/libbpf)
[Security]
Since the code is taken out of the Linux kernel, this should be treated
similar to the kernel for security. Research uncovered no records about
security issues.
[Quality assurance]
At this point there are no open bug reports against libbpf (except this one)
in Ubuntu. Also no open bugs found in Debian. Project is taken from the kernel
source and claims static analysis via LGTM and Coverty. Also has CI via Travis
(https://travis-ci.com/github/libbpf/libbpf).
Right now there are no dep-8 tests. Though potentially it should be possible
to create those, would this really add additional benefit beyond having
upstream CI?
A test build on hirsute was showing no warnings beyond lintian complaining
about things which would be changed if we had delta (unstable as series for
example). Otherwise was clean.
[Dependencies]
libc6: main
libelf1: main
zlib1g: main
[Standards compliance]
$ lintian --pedantic libbpf_0.3-2.dsc
P: libbpf source: no-homepage-field
P: libbpf source: silent-on-rules-requiring-root
[Maintenance]
As this is only taking out code from the kernel into a separate library
package, the maintenance effort should be minimal. Packaging is done in Debian
and is synced into Ubuntu (no delta).
[Background information]
A discourse about why this is packaged outside the kernel can be found at
https://lwn.net/Articles/836911/.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/iproute2/+bug/1910576/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
