[Bug 2121564] Re: [MIR] neutron

Tue Oct 14 14:36:40 UTC 2025

** Changed in: neutron (Ubuntu)
     Assignee: (unassigned) => Pushkar Kulkarni (pushkarnk)

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/2121564

Title:
  [MIR] neutron

Status in neutron package in Ubuntu:
  New

Bug description:
  Please note this is a re-review for an OpenStack package already in
  main. An effort is being made to retroactively perform MIRs for
  packages that predate the modern process. This is a low priority task.

  [Availability]
  The package neutron is already in Ubuntu main. This review is intended to be a re-review for a package that predates the current MIR process.
  The package neutron builds for the architectures it is designed to work on.
  It currently builds and works for architectures: all - amd64 build: https://launchpad.net/ubuntu/+source/neutron/2:26.0.1+git2025070714.71962255de-0ubuntu2/+build/31098638
  Link to package https://launchpad.net/ubuntu/+source/neutron

  [Rationale]
  - The package neutron is required in Ubuntu main as part of the OpenStack software suite on Ubuntu.
  - The package neutron will generally be useful for a large part of
    our user base - all users of OpenStack on Ubuntu.
  - There is no other/better way to solve this that is already in main or
    should go universe->main instead of this.
  - Package was in main before. It appears that neutron pre-dates the modern MIR process and no MIR was ever filed for this package. It has been in Ubuntu main since at least 2014.
  - All binary packages built by neutron need to be in main to achieve supported Ubuntu OpenStack deployments with neutron covering all OVS/OVN backends and optional agents. The following binaries are built by neutron:
  - neutron-api
  - neutron-common
  - neutron-dhcp-agent
  - neutron-l3-agent
  - neutron-macvtap-agent
  - neutron-metadata-agent
  - neutron-metering-agent
  - neutron-openvswitch-agent
  - neutron-ovn-agent
  - neutron-ovn-maintenance-worker
  - neutron-ovn-metadata-agent
  - neutron-periodic-workers
  - neutron-plugin-ml2
  - neutron-rpc-server
  - neutron-server (transitional - being replaced by neutron-rpc-server)
  - neutron-sriov-agent
  - python3-neutron

  This is a re-review of a package already in main so there is no
  definitive deadline for approval.

  [Security]
  - Had 30 security issues in the past between 2013 and 2025
     - https://ubuntu.com/security/cves?package=neutron
  - These CVEs are typically promptly addressed by the upsteam or Debian team and comments are made by the Ubuntu Security Team as to a plan of action for addressing them. 

  - no `suid` or `sgid` binaries
  - no executables in `/sbin` and `/usr/sbin`

  - Package does install services, timers or recurring jobs
     - native systemd units: neutron-openvswitch-agent.service, neutron-ovs-cleanup.service
     - SysV init templates exposed by systemd as services: neutron-dhcp-agent.service, neutron-l3-agent.service, neutron-macvtap-agent.service, neutron-metadata-agent.service, neutron-metering-agent.service, neutron-openvswitch-agent.service, neutron-ovn-agent.service, neutron-ovn-maintenance-worker.service, neutron-ovn-metadata-agent.service, neutron-periodic-workers.service, neutron-rpc-server.service, neutron-sriov-agent.service, neutron-ovs-cleanup.service

  - Security has been kept in mind and common isolation/risk-mitigation
    patterns are in place utilizing the following features:
    - Runs as dedicated neutron user; privileged operations go through oslo.privsep helper replacing sudo/rootwrap usage
    -  Systemd units drop privileges to the service user; packaging follows Debian layout with unit files under /usr/lib/systemd/system.
    - DHCP is provided by dnsmasq processes spawned within per-network namespaces by neutron-dhcp-agent, keeping DHCP exposure scoped to those namespaces.
  - Package daemons do not open privileged ports (ports < 1024) but but when the DHCP agent is used, the spawned dnsmasq binds UDP 67 within the DHCP namespace by design.
  - Package does expose an external endpoint, it is TCP 9696 for public/internal/admin endpoints (neutron-api).
  - Packages does not contain extensions to security-sensitive software
    (filters, scanners, plugins, UI skins, ...)

  [Quality assurance - function/usage]
  - The package works well right after install

  [Quality assurance - maintenance]
  - The package is maintained well in Debian/Ubuntu/Upstream and does
    not have too many, long-term & critical, open bugs
    - Ubuntu https://bugs.launchpad.net/ubuntu/+source/neutron/+bug
    - Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=neutron
  - The package does not deal with exotic hardware we cannot support

  [Quality assurance - testing]
  - The package runs a test suite on build time, if it fails
    it makes the build fail, link to build log https://launchpad.net/ubuntu/+source/neutron/2:26.0.1+git2025070714.71962255de-0ubuntu2/+build/31098638
  - The package runs an autopkgtest, and is currently passing on amd64, link to test logs: https://autopkgtest.ubuntu.com/results/autopkgtest-questing/questing/amd64/n/neutron/20250822_152714_3de7b@/log.gz
  - The package does have not failing autopkgtests right now

  [Quality assurance - packaging]
  - debian/watch is present and works - looks for updates in tarballs.opendev.org, pulls correct version when running uscan.
  - debian/control defines a correct Maintainer field - Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>

  - This package does not yield massive lintian Warnings, Errors
  - Please link to a recent build log of the package: https://launchpadlibrarian.net/812643973/buildlog_ubuntu-questing-amd64.neutron_2%3A26.0.1+git2025070714.71962255de-0ubuntu2_BUILDING.txt.gz
  - Lintian overrides are not present
  - This package does not rely on obsolete or about to be demoted packages.
  - This package has no python2 or GTK2 dependencies
  - The package will not be installed by default
  - Packaging is relatively complex, but that is ok because this is a complex piece of software with many binaries that is meant to interact with complex OpenStack deployments. d/rules is fairly simple though the debian directory contains many .init.in, postinst, .install, etc. files.

  [UI standards]
  - Application is not end-user facing (does not need translation)
  - End-user applications without desktop file, not needed because this file is only meant to be accessed through the CLI or an OpenStack web dashboard.

  [Dependencies]
  - Used check-mir from ubuntu-dev-tools to validate
    all dependencies or recommends are in main.

  [Standards compliance]
  - This package correctly follows FHS and Debian Policy

  [Maintenance/Owner]
  - The owning team is already ubuntu-openstack and I have their acknowledgment for
    that commitment
  - The owning team is already subscribed to the package
  - This does not use static builds
  - This does not use vendored code
  - This package is not rust based
  - The package has been built within the last 3 months in the archive
    - Build link on launchpad: https://launchpad.net/ubuntu/+source/neutron/2:26.0.1+git2025070714.71962255de-0ubuntu2/+build/31098638

  [Background information]
  The Package description explains the package well
  Upstream Name is neutron
  Link to upstream project: https://opendev.org/openstack/neutron

  Lintian –pedantic output:
  ubuntu at questing-vm:~$ lintian --pedantic neutron_26.0.1+git2025070714.71962255de-0ubuntu2.dsc 
  W: neutron source: obsolete-runtime-tests-restriction needs-recommends [debian/tests/control:23]
  W: neutron source: obsolete-runtime-tests-restriction needs-recommends [debian/tests/control:9]
  W: neutron source: superfluous-file-pattern tools/rfc.sh [debian/copyright:26]
  P: neutron source: maintainer-manual-page [debian/mans/neutron-openvswitch-agent.8]
  P: neutron source: maintainer-manual-page [debian/mans/neutron-rootwrap.8]
  P: neutron source: maintainer-manual-page [debian/mans/neutron-server.8]
  P: neutron source: trailing-whitespace [debian/changelog:1140]
  P: neutron source: trailing-whitespace [debian/changelog:1175]
  P: neutron source: trailing-whitespace [debian/changelog:1176]
  P: neutron source: trailing-whitespace ... use "--tag-display-limit 0" to see all (or pipe to a file/program)
  P: neutron source: unversioned-copyright-format-uri http://dep.debian.net/deps/dep5 [debian/copyright]

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/neutron/+bug/2121564/+subscriptions