Review for Source Package: jitterentropy-library
Launchpad bug: https://bugs.launchpad.net/bugs/2162943
Target series: devel
Analysed source version: 3.6.3-1 (release pocket)
Binary packages: libjitterentropy3, libjitterentropy3-dev
[Summary]
OK:
- Review for Source Package: jitterentropy-library
- Reporter MIR content found and used as context.
- The specific binary packages to be promoted to main are libjitterentropy3 and
libjitterentropy3-dev.
- MIR team ACK under the constraint to resolve...
This does need a security review, so I'll assign ubuntu-security
Required TODOs:
- #1 static linking present without clear justification
(Static linking detected without clear justification; review needed
(debian/rules hints: -static))
- #2 does not have a non-trivial test suite that runs as autopkgtest
you knew that already, please try to enable the tests that it has at build
and if possible at autopkgtest time
Recommended TODOs:
- #3 The package should get a team bug subscriber on this bug before being
promoted
- #4 Consider updating to a more recent upstream release
- #5 There are some indicator of not being too closely maintained, consider if
instead you want to drop using it in openssl
[Rationale, Duplication and Ownership]
OK:
- There is no other package in main providing the same functionality.
- The rationale given in the report seems valid and useful for Ubuntu
- A team is committed to own long term maintenance of this package.
Problems:
- If anything, but I'm not challenging that - the question if openssl and our
users really need that. It seems a corner case, but I might be wrong leaving
that to you.
[Dependencies]
OK:
- no runtime dependencies outside main needing MIR
- no other build-time Dependencies with active code in the final binaries to
MIR due to this
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring more
tests now.
(The package has no runtime dependencies in main, only libc6 which is
essential and implicitly tested everywhere. Therefore, there are no main
dependencies that are only superficially tested.)
Problems: none
[Embedded sources and static linking]
OK:
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard
- Does not include vendored code
Problems:
- static linking present without clear justification
(Static linking detected without clear justification; review needed
(debian/rules hints: -static))
[Security]
OK:
- history of CVEs does not look concerning
(Both the Ubuntu CVE tracker and NVD enrichment show zero CVEs (current or
historical) for jitterentropy-library, indicating a clean security history.)
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats (files [images, video, audio, xml, json, asn.1],
network packets, structures, ...) from an untrusted source.
(The only runtime dependency is libc6, with no parser libraries present.
Source files are exclusively entropy-collection and internal hashing (SHA-3)
modules with no image, video, audio, XML, JSON, or network packet parsing
logic. The package is a library that gathers entropy from hardware timing, not
from external or untrusted data sources.)
- does not expose any external endpoint (port/socket/... or similar)
(The source produces only library and development binary packages, and no
installed service files, socket units, or network-listening code were
identified. The single .service file present lives under the tests/ directory
and is not shipped in any binary package.)
- does not process arbitrary web content
(The source tree contains only entropy-related C sources (timer, noise,
health, gcd, sha3, base) and architecture-specific headers, with runtime
dependencies limited to libc6 — no HTTP parsers, network code, or web content
processing is present. The man page and project description confirm this is a
jitter-based random number entropy source, not a web-facing component.)
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
(Runtime dependencies are limited to libc6, and no desktop files or
JS-related packaging patterns were found. The source is a pure C entropy
library with no indication of any JavaScript or WebKit integration.)
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
(The source tree contains only entropy-collection and SHA-3 hashing modules
with no TPM, secure boot, PKCS#11, or signature-verification code, and the sole
runtime dependency is libc6. This is consistent with the package's scope as a
CPU-jitter-based RNG library that has no need for security attestation
mechanisms.)
- this makes appropriate (for its exposure) use of established risk mitigation
features (dropping permissions, using temporary environments, restricted
users/groups, seccomp, systemd isolation features, apparmor, ...)
(The package ships only a shared library and development headers with no
systemd units, AppArmor profiles, setuid/setgid binaries, cron jobs, or
services in the binary packages, confirming minimal exposure where runtime
sandboxing mitigations would not be expected. The build configuration enables
full hardening flags (hardening=+all, -fstack-protector-strong,
-D_FORTIFY_SOURCE=3, -fcf-protection, -Werror=format-security), which is
appropriate for this exposure level.)
Problems:
- The package implements its own SHA-3 hash (jitterentropy-sha3.c) for entropy
conditioning rather than delegating to a system crypto library, so the claim
that it does not deal with cryptography is not fully accurate.
(Source files include jitterentropy-sha3.c/h, indicating a self-contained
cryptographic hash implementation used for entropy whitening. Per policy,
implementing own crypto (even a hash for conditioning) is high concern and
warrants a dedicated security review, rather than the low concern of merely
delegating to system libraries.)
- The purpose is to be input to other things needing entropy, commonly security
functions
[Common blockers]
OK:
- does not FTBFS currently; Launchpad build records pass for arches: amd64,
amd64v3, arm64, armhf, i386, ppc64el, riscv64, s390x
- This does not need special HW for build or test
(The build dependencies are minimal (debhelper-compat only) and the reporter
confirms successful builds across all standard Ubuntu architectures. No
evidence in the MIR request or packaging metadata indicates a need for exotic
or dedicated hardware.)
- no special hardware needed, so there is no compromise to accept
- no new python2 dependency
- not a python package, no extra constraints to consider in that regard
- not a go package, no extra constraints to consider in that regard
Problems:
- No autopkgtest is declared or running for jitterentropy-library. The Ubuntu
autopkgtest infrastructure shows no test results, and no debian/tests/control
was found in the packaging. While the upstream source includes test directories
(raw-entropy validation, GCD tests), these are not wired into autopkgtest.
(Both evidence sources agree: the autopkgtest database reports no tests for
this package, and no debian/tests/control file was captured from the packaging
source. The upstream tree contains test code under tests/ but it is not
packaged as an autopkgtest.)
- does not have a test suite that runs at build time
[Packaging red flags]
OK:
- Ubuntu does not carry a delta
(The delta analysis confirms the package is a sync from Debian (version
3.6.3-1 has no Ubuntu revision) and no diff is present, so there is no Ubuntu
delta to evaluate for reasonableness.)
- symbols tracking is in place
(a symbols file is shipped: ./debian/libjitterentropy3.symbols)
- debian/watch is present and looks ok
- Upstream update history is (good/slow/sporadic)
(The upstream tracker shows ten recent releases (3.3.0 through 3.7.0),
indicating active maintenance. The current Ubuntu version (3.6.3-1) aligns
closely with the upstream release stream.)
- promoting this does not seem to cause issues for MOTUs that so far maintained
the package
(The package has no upload history, no listed uploaders, and no individual or
team uploaders configured in universe, indicating it is a sync-from-Debian case
with no active Ubuntu maintainers who would lose access.)
- no excessive lintian warnings
- debian/rules is rather clean
(The rules file is a short base debhelper file using the `%: dh $@` pattern
with two straightforward overrides that merely pass PREFIX and LIBDIR to
install targets. Hardening is explicitly enabled, no tests are disabled, and
there is no hand-rolled or fragile build logic.)
- It is not on the lto-disabled list
- debian/control defines a correct Maintainer field
Problems:
- Package is somewhat behind upstream: 3.6.3 vs 3.7.0
- Debian/Ubuntu update history is too short to make predictions, the maintainer
left canonical which might not be a good sign
[Upstream red flags]
OK:
- no incautious use of malloc/sprintf (as far as we can check it)
(The package is a C library compiled with -Werror=format-security,
-D_FORTIFY_SOURCE=3, -fstack-protector-strong, and -Wall -pedantic -Wextra,
which would catch many unsafe memory and format-string patterns at build time.
The build succeeded with no visible warnings, and lintian reported 0 errors and
0 warnings.)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests)
- no use of user 'nobody' outside of tests
- no use of setuid / setgid
- no important open bugs (crashers, etc) in Debian or Ubuntu
(The only open Ubuntu bug is the MIR request itself, and both Debian and
upstream report zero open issues.)
- no dependency on webkit, qtwebkit or libseed
- not part of the UI for extra checks
(The package produces only library and development binary packages
(libjitterentropy3, libjitterentropy3-dev) in the libs and libdevel sections,
with runtime dependencies limited to libc6 and no GUI toolkits present. There
is no indication of a user-facing desktop application, so the extra UI checks
are not applicable.)
- no translation present, but none needed for this case (not user visible)
(The package produces only library and development binary packages with no
GUI toolkit dependencies or desktop files, indicating it is not user-visible.
No translation files are present, which is expected and acceptable for a
non-user-visible library.)
- no Errors/warnings during the build
(acceptable: readelf -W --section-headers
debian/libjitterentropy3-dev/usr/lib/x86_64-linux-gnu/libjitterentropy.a | sed
-n '/^ *\[[ 0-9]*]/s/ *\[[ 0-9]*\] *//p' | awk 'BEGIN {rv=1} /^NULL/ {next} $1
~ /^.(text|data|(preinit|init|fini)_array$)/ {if ($5 !~ /^0+$/) rv=0} END {
exit rv}')
Problems: none
** Changed in: jitterentropy-library (Ubuntu)
Assignee: Ravi Kant Sharma (ravi-sharma) => Ubuntu Security Team
(ubuntu-security)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162943
Title:
[MIR] jitterentropy-library
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/jitterentropy-library/+bug/2162943/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
