Review for Source Package: rust-gst-plugin-gtk4
[Summary]
This is a preliminary MIR review, still missing the "[Embedded sources and
static linking]" section, while we await the package to be updated, shipping
vendored dependencies.
rust-gst-plugin-gtk4 is a shared library providing GTK4 widgets to consume video
data from (trusted) GStreamer sources and rendering them to the output. It is
a new dependency for the gnome-snapshot tool. Upstream and packaging maintenance
seems to be active and under control. Testing is available.
MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.
This does not need a security review
List of specific binary packages to be promoted to main: gstreamer1.0-gtk4
Specific binary packages built, but NOT to be promoted to main:
librust-gst-plugin-gtk4-dev
Notes:
#0 - add todos, issues or special cases to discuss
Required TODOs:
#1 - update package to include vendored dependencies, ideally using a
".orig-rust-vendor.tar.xz" file, as described in
https://github.com/canonical/ubuntu-mir/commits/main/vendoring/Rust.md
And potentially utlizing "rust-vargo-vendor-filterer".
=> get MIR approval on the pending [Embedded sources and static linking]
section
#2 - Many of the autopkgtests in debian/tests/control are tagged "flaky".
Is this needed? Can you please explain or fix it?
#3 - Update to latest version (0.13.4)
#4 - implement symbols tracking: # nm -gD libgstgtk4.so | grep "T "
000000000003f070 T gst_plugin_gtk4_get_desc
000000000003f010 T gst_plugin_gtk4_register
#5 - Fix errors during build
* error: there is nothing to install in `gst-plugin-gtk4 v0.13.3
(/<<PKGBUILDDIR>>)`, because it has no binaries
* subprocess.CalledProcessError: Command '['env', 'RUST_BACKTRACE=1',
'CARGO_TARGET_DIR=/<<PKGBUILDDIR>>/target', '/usr/bin/cargo',
'-Zavoid-dev-deps', 'install', '--verbose', '--verbose', '-j4', '--target',
'x86_64-unknown-linux-gnu', '--config', 'profile.release.lto = "thin"',
'--path', '/<<PKGBUILDDIR>>', '--root', 'debian/gstreamer1.0-gtk4/usr']'
returned non-zero exit status 101.
* dh_auto_install: error: env DESTDIR=debian/gstreamer1.0-gtk4
/usr/share/cargo/bin/cargo install --config "profile.release.lto = \"thin\""
returned exit code 1
Recommended TODOs:
#6 - The package should get a team bug subscriber before being promoted
#7 - Consider fixing some lintian suggestions, especially
"hardening-no-fortify":
* I: gstreamer1.0-gtk4: hardening-no-fortify-functions
[usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstgtk4.so]
* I: gstreamer1.0-gtk4: capitalization-error-in-description-synopsis
gstreamer GStreamer
* I: rust-gst-plugin-gtk4 source: quilt-patch-missing-description
[debian/patches/...] => add DEP3 headers
* X: librust-gst-plugin-gtk4-dev: package-contains-no-arch-dependent-files
* X: rust-gst-plugin-gtk4 source: upstream-metadata-file-is-missing
#8 - Consider fixing (deprecation) warnings during build:
* warning: gst-plugin-gtk4@0.13.3: "wayland" feature is deprecated, use
"waylandegl" instead
* warning: unused import: ...
* warning: use of depreacated method ...
* warning: unexpected `cfg` condition value:
[Rationale, Duplication and Ownership]
- There is no other package in main providing the same functionality.
- A team is committed to own long term maintenance of this package.
=> ~desktop-packages
- The rationale given in the report seems valid and useful for Ubuntu
=> new dependency of gnome-snapshot
[Dependencies]
OK:
- no other Dependencies to MIR due to this
- SRCPKG checked with `check-mir`
- all dependencies can be found in `seeded-in-ubuntu` (already in main)
- none of the (potentially auto-generated) dependencies (Depends
and Recommends) that are present after build are not in main
- No dependencies in main that are only superficially tested requiring
more tests now.
Problems:
- many librust-*-dev does not exist
- -dev/-debug/-doc packages that need exclusion
=> we might consider excluding librust-gst-plugin-gtk4-dev
[Embedded sources and static linking]
TODO: TDB, once the package is updated for vendored dependencies.
OK:
TODO: - no embedded source present
TODO: - no static linking
TODO: - does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
TODO-B: - Rust package that has all dependencies vendored. It does neither
TODO-B: have *Built-Using (after build). Nor does the build log indicate
TODO-B: built-in sources that are missed to be reported as Built-Using.
- rust package using dh_cargo (dh ... --buildsystem cargo)
TODO-A: - Includes vendored code, the package has documented how to refresh this
TODO-A: code at <TBD>
TODO-B: - Does not include vendored code
TODO-A: Problems:
TODO-A: - TBD
TODO-B: Problems: None
[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats (files [images, video, audio,
xml, json, asn.1], network packets, structures, ...) from
an untrusted source.
- does not expose any external endpoint (port/socket/... or similar)
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates,
signing, ...)
- this makes appropriate (for its exposure) use of established risk
mitigation features (dropping permissions, using temporary environments,
restricted users/groups, seccomp, systemd isolation features,
apparmor, ...)
Problems: None
[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- does have a non-trivial test suite that runs as autopkgtest
- This does not need special HW for build or test
- if a non-trivial test on this level does not make sense (the lib alone
is only doing rather simple things), is the overall solution (app+libs)
extensively covered i.e. via end to end autopkgtest
=> https://wiki.ubuntu.com/DesktopTeam/TestPlans/GnomeSnapshot
- no new python2 dependency
Problems:
- Many of the autopkgtests in debian/tests/control are tagged "flaky".
Is this needed? Can we fix it?
[Packaging red flags]
OK:
- Ubuntu does carry a delta, but it is reasonable and maintenance under
control
=> Vendoring delta
- debian/watch is present and looks ok (if needed, e.g. non-native)
- Upstream update history is good
- Debian/Ubuntu update history is good
- promoting this does not seem to cause issues for MOTUs that so far
maintained the package
- no massive Lintian warnings
- debian/rules is rather clean
- It is not on the lto-disabled list
Problems:
- the current release is packaged => 0.13.4 available
- lintian suggestions:
* I: gstreamer1.0-gtk4: capitalization-error-in-description-synopsis
gstreamer GStreamer
* I: gstreamer1.0-gtk4: hardening-no-fortify-functions
[usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstgtk4.so]
* I: rust-gst-plugin-gtk4 source: quilt-patch-missing-description
[debian/patches/...] => add DEP3 headers
* X: librust-gst-plugin-gtk4-dev: package-contains-no-arch-dependent-files
* X: rust-gst-plugin-gtk4 source: upstream-metadata-file-is-missing
- symbols tracking is not in place => We probably want this,
it ships only a small set of symbols anyway:
# nm -gD /usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstgtk4.so | grep "T "
000000000003f070 T gst_plugin_gtk4_get_desc
000000000003f010 T gst_plugin_gtk4_register
[Upstream red flags]
OK:
- no incautious use of malloc/sprintf (the language has no direct MM)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside
tests)
- no use of user nobody
- no use of setuid / setgid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit or libseed
- not part of the UI for extra checks
- no translation present, but none needed for this case (user visible)?
Problems:
- Errors/warnings during the build
* error: there is nothing to install in `gst-plugin-gtk4 v0.13.3
(/<<PKGBUILDDIR>>)`, because it has no binaries
* subprocess.CalledProcessError: Command '['env', 'RUST_BACKTRACE=1',
'CARGO_TARGET_DIR=/<<PKGBUILDDIR>>/target', '/usr/bin/cargo',
'-Zavoid-dev-deps', 'install', '--verbose', '--verbose', '-j4', '--target',
'x86_64-unknown-linux-gnu', '--config', 'profile.release.lto = "thin"',
'--path', '/<<PKGBUILDDIR>>', '--root', 'debian/gstreamer1.0-gtk4/usr']'
returned non-zero exit status 101.
* dh_auto_install: error: env DESTDIR=debian/gstreamer1.0-gtk4
/usr/share/cargo/bin/cargo install --config "profile.release.lto = \"thin\""
returned exit code 1
- Plenty of (deprecation) warnings:
* warning: gst-plugin-gtk4@0.13.3: "wayland" feature is deprecated, use
"waylandegl" instead
* warning: unused import: ...
* warning: use of depreacated method ...
* warning: unexpected `cfg` condition value:
** Changed in: rust-gst-plugin-gtk4 (Ubuntu)
Assignee: Lukas Märdian (slyon) => Jeremy Bícha (jbicha)
** Changed in: rust-gst-plugin-gtk4 (Ubuntu)
Status: New => Incomplete
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2097804
Title:
[MIR] rust-gst-plugin-gtk4
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rust-gst-plugin-gtk4/+bug/2097804/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
