[Bug 2048760] Re: [MIR] python-cssselect

Tue Jan 23 16:59:17 UTC 2024

Review for Source Package: python-cssselect

[Summary]
MIR team ACK
This does need a security review, so I'll assign ubuntu-security
List of specific binary packages to be promoted to main: python3-cssselect
Specific binary packages built, but NOT to be promoted to main: <None>

- The package should get a team bug subscriber before being promoted

[Rationale, Duplication and Ownership]
There is no other package in main providing the same functionality.
The rationale given in the report seems valid and useful for Ubuntu.
This package is required in Ubuntu as a runtime dependency of lxml.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
  - SRCPKG checked with `check-mir`
  - all dependencies can be found in `seeded-in-ubuntu` (already in main)
  - none of the (potentially auto-generated) dependencies (Depends
    and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

Problems: None

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard
- Does not include vendored code

Problems: None

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not expose any external endpoint (port/socket/... or similar)
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates,
  signing, ...)

Problems:
- does parse data formats (files [images, video, audio,
  xml, json, asn.1], network packets, structures, ...) from
  an untrusted source.

[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
  - test suite fails will fail the build upon error.
- does have a non-trivial test suite that runs as autopkgtest
- This does not need special HW for build or test
- no new python2 dependency
- Python package, but using dh_python

Problems: None

[Packaging red flags]
OK:
 - Ubuntu does not carry a delta
TODO-A: - symbols tracking is in place.
- symbols tracking not applicable for this kind of code.
- debian/watch is present and looks ok (if needed, e.g. non-native)
- Upstream update history is good
- Debian/Ubuntu update history is slow
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far
  maintained the package
- no massive Lintian warnings
- debian/rules is rather clean
- It is not on the lto-disabled list

Problems: None

[Upstream red flags]
OK:
- no Errors/warnings during the build
- no incautious use of malloc/sprintf (the language has no direct MM)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside
  tests)
- no use of user nobody
- no use of setuid / setgid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit, seed or libgoa-*
- not part of the UI for extra checks
- no translation present, but none needed for this case (user visible)?

Problems: None

** Changed in: python-cssselect (Ubuntu)
     Assignee: Ioanna Alifieraki (joalif) => (unassigned)

** Changed in: python-cssselect (Ubuntu)
     Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security)

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is a bug assignee.
https://bugs.launchpad.net/bugs/2048760

Title:
  [MIR] python-cssselect

Status in lxml package in Ubuntu:
  New
Status in python-cssselect package in Ubuntu:
  Confirmed
Status in lxml package in Debian:
  Fix Released

Bug description:
  [Availability]
  - The package python-cssselect is already in Ubuntu universe.
  - The package python-cssselect build for the architectures it is designed to work on.
  - It currently builds and works for architectures: all
  - Link to package https://launchpad.net/ubuntu/+source/python-cssselect

  [Rationale]
  - The package python-csselect is currently a build dependency of lxml in Ubuntu
    main. However python-lxml doesn't work without it (#1017067) and it should be
    promoted to runtime dependency.
  - Demoting python-lxml, or modifying it to not require this package seems to
    be more work than maintaining an extra small package in sync with Debian.
  - It would be great and useful to community/processes to have the
    package python-cssselect in Ubuntu main, but there is no definitive deadline.

  [Security]
  - No CVEs/security issues in this software in the past
  - no `suid` or `sgid` binaries
  - no executables in `/sbin` and `/usr/sbin`
  - Package does not install services, timers or recurring jobs
  - Security has been kept in mind and common isolation/risk-mitigation
    patterns are in place utilizing the following features:
    The package is a Python library and doesn't perform any risky actions by
    itself.
  - Packages does not open privileged ports (ports < 1024).
  - Packages does not contain extensions to security-sensitive software
    (filters, scanners, plugins, UI skins, ...)

  [Quality assurance - function/usage]
  - The package works well right after install

  [Quality assurance - maintenance]
  - The package is maintained well in Debian/Ubuntu/Upstream and does
    not have too many, long-term & critical, open bugs
    - Ubuntu https://bugs.launchpad.net/ubuntu/+source/python-cssselect/+bug
    - Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=python-cssselect
    - https://github.com/scrapy/cssselect/issues
  - The package does not deal with exotic hardware we cannot support

  [Quality assurance - testing]
  - The package does not run a test at build time because it runs its test
    suite as autopkgtest.
    This is fine, because build is architecture independent and only done once,
    versus autopkgtest is run on all architectures.
  - The package runs an autopkgtest, and is currently passing on
    all architectures except i386: https://autopkgtest.ubuntu.com/packages/python-cssselect
  - The package does have failing autopkgtests tests right now, but since
    they always failed they are handled as "ignored failure".
    This is ok because this is only on i386, and not all its dependencies are
    available for i386

  [Quality assurance - packaging]
  - debian/watch is present and works
  - debian/control defines a correct Maintainer field
  - This package does not yield massive lintian Warnings, Errors
  - Please link to a recent build log of the package
    https://launchpadlibrarian.net/645210260/buildlog_ubuntu-lunar-amd64.python-cssselect_1.2.0-2_BUILDING.txt.gz
  - The output from `lintian --pedantic` is empty
  - Lintian overrides are not present
  - This package does not rely on obsolete or about to be demoted packages.
  - This package has no python2 or GTK2 dependencies
  - The package will not be installed by default
  - Packaging and build is easy, debian/rules is trivial
    https://git.launchpad.net/ubuntu/+source/python-cssselect/tree/debian/rules?h=debian/sid

  [UI standards]
  - Application is not end-user facing (does not need translation)
    (Not even an application, the package is a Python library)

  [Dependencies]
  - No further depends or recommends dependencies that are not yet in main

  [Standards compliance]
  - This package correctly follows FHS and Debian Policy

  [Maintenance/Owner]
  - I Suggest the owning team to be Foundations
  - The future owning team is not yet subscribed, but will subscribe to
    the package before promotion
  - This does not use static builds
  - This does not use vendored code
  - This package is not rust based
  - The package was test rebuilt in PPA or sbuild recently (provide link/logs)
    https://launchpadlibrarian.net/710552022/buildlog_ubuntu-noble-amd64.python-cssselect_1.2.0-2~ppa1_BUILDING.txt.gz

  [Background information]
  - The Package description explains the package well
  - Upstream Name is cssselect
  - Link to upstream project https://github.com/scrapy/cssselect
  - Maintainers are the same as lxml, package was split from lxml in 2012:
    https://lxml.de/3.0/changes-3.0alpha1.html

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lxml/+bug/2048760/+subscriptions