Thank you Nadzeya for all of your work (and patience).
I re-reviewed the 0.9.0~ppa8 version and will be sponsoring the upload
into the archive. We'll then need an archive-admin to accept it from the
NEW queue. My remarks have been addressed, except for #1 which is not
yet fully deployed in an ideal way (AppArmor profile should be part of
the package itself, also make it easier for future SRUs). But I'm
downgrading this to a Recommended TODO, and will make sure it is
included in the next version of the package and uploaded into Questing.
=> MIR ACK! (still waiting for a security re-review). Assigning ~ubuntu-
security.
#0 - Re-Flagging for security review (for Questing)
Now that the vendored dependencies got updated and osv-scanner is looking
clean.
#1 - The AppArmor profile was reviewed by the upstream AppArmor team, thanks!
https://gitlab.com/apparmor/apparmor/-/merge_requests/1658
Still, we probably want to ship this as part of the actual rust-hwlib
package.
=> I'm downgrading this to a Recommended TODO.
Please ship the AA profile with the next upstream & package version.
#2 - Thanks for implementing the mock server and testing the actual "hwctl"
binary.
LGTM!
#3 - We now have a v0.9.0 tag upstream, which matches the PPA package's
contents.
https://github.com/canonical/hardware-api/releases/tag/v0.9.0
(Except for the filtered rust-vendor/ directory)
#4 - ACK. amd64-only for now.
#5 - ACK. ~canonical-hw-cert is about to become a distro team
https://code.launchpad.net/~nhutsko/ubuntu-archive-tools/+git/ubuntu-archive-tools/+merge/485759
#6 - ACK. That was an oversight on my end.
#7 - This is a native package, so consider this TODO dropped.
#8 & #9 - Ignoring those non-critical warnings for now.
** Changed in: Ubuntu Questing
Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security)
--
You received this bug notification because you are a member of Canonical
Hardware Certification, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2072561
Title:
[MIR] rust-hwlib
Status in Ubuntu:
New
Status in The Focal Fossa:
New
Status in The Jammy Jellyfish:
New
Status in The Noble Numbat:
New
Status in The Oracular Oriole:
New
Status in The Plucky Puffin:
New
Status in The Questing Quokka:
New
Bug description:
[Availability]
- This package rust-hwlib is published to the PPA:
https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT
part of the universe. We have an exception to publish it directly to
main, since this library will help the development of solutions that
affect Canonical customers directly. Please check with ~paelzer for
more information.
- The package rust-hwlib build for the architectures it is designed to
work on.
- It currently builds and works for architectures: amd64
- Link to package:
https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages
[Rationale]
- This package rust-hwlib is part of the
[hardware-api](https://github.com/canonical/hardware-api) project,
owned and developed by Canonical Hardware Certification team. It
will be used by Ubuntu pro-client to retrieve information about the
machine and check its certification status.
- The package rust-hwlib will generally be useful for a large number
of users who use Ubuntu and want see what components have been
tested and certified and for which Ubuntu releases.
- There is no other/better way to solve this that is already in main
or should go universe->main instead of this.
- The package rust-hwlib is required in Ubuntu main no later than
April 2025 due to 25.04 release date, so users and Canonical
customer can install it for the latest Ubuntu release.
[Security]
- No CVEs/security issues in this software in the past
- no `suid` or `sgid` binaries
- no executables in `/sbin` and `/usr/sbin`
- Package does not install services, timers or recurring jobs
- Packages does not open privileged ports (ports < 1024).
- Package does not expose any external endpoints
- Packages does not contain extensions to security-sensitive software
[Quality assurance - function/usage]
- The package works well right after install
[Quality assurance - maintenance]
- The package is maintained well in Upstream and does not have too
many, long-term & critical, open bugs
- Upstream's bug tracker:
https://github.com/canonical/hardware-api/issues
- The package does not deal with exotic hardware we cannot support
[Quality assurance - testing]
- The package runs a test suite on build time, if it fails it makes
the build fail, link to build log:
* plucky:
https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz
* oracular:
https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz
* noble:
https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz
* jammy:
https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz
* focal:
https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz
- The package runs an autopkgtest, and is currently passing on amd64
architecture, link to test logs:
* plucky:
https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz
* oracular:
https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz
* noble:
https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz
* jammy:
https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz
* focal:
https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz
- The package does have not failing autopkgtests right now
[Quality assurance - packaging]
- debian/watch is not present because it is a native package
- debian/control defines a correct Maintainer field
- Lintian overrides are not present
- This package only has minor lintian pedantic warnings and one
regular warnings (using lintian version 2.121.1):
- The warning regarding Vendor-Sources-Rust header is expected,
since it's required for Rust packages that use vendored
dependencies and specify this header in the `debian/control`
file.
# lintian --pedantic rust-hwlib_0.9.0\~ppa3_source.changes
W: rust-hwlib source: unknown-field Vendored-Sources-Rust
P: rust-hwlib source: package-uses-old-debhelper-compat-version 12
P: rust-hwlib source: uses-debhelper-compat-file [debian/compat]
- This package does not rely on obsolete or about to be demoted
packages.
- This package has no python2 or GTK2 dependencies
- The package will be installed by default, but does not ask debconf
questions
- Packaging and build is easy, link to debian/rules:
https://github.com/canonical/hardware-api/blob/main/client/debian/rules
[UI standards]
- Application is not end-user facing
[Dependencies]
- No further depends or recommends dependencies that are not yet in
main
[Standards compliance]
- This package correctly follows FHS and Debian Policy
[Maintenance/Owner]
- The owning team will be ~canonical-hw-cert and I have their
acknowledgement for that commitment
- The future owning team is already subscribed to the package
- This does not use static builds
- The Canonical Hardware Certification team (~canonical-hw-cert) is
aware of the implications of vendored code and (as alerted by the
security team) commits to provide updates and backports to the
security team for any affected vendored code for the lifetime of the
release (including ESM).
- This package uses vendored rust code tracked in Cargo.lock as
shipped, in the package (at
`/usr/share/cargo/registry/hwlib-0.9.0/Cargo.lock` and
`/usr/share/doc/hwctl/Cargo.lock.gz`), refreshing that code is
outlined in debian/README.source
- This package uses vendored rust code tracked in Cargo.lock in the
repo: https://github.com/canonical/hardware-api/blob/main/client/Cargo.lock
- This package is rust based and vendors all non language-runtime
dependencies
- The package has been built within the last 3 months in PPA
- Build link on launchpad:
https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages
[Background information]
- The Package description explains the package well
- Upstream Name is hwlib and hwctl
- Link to upstream project:
https://github.com/canonical/hardware-api/tree/main/client/
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+bug/2072561/+subscriptions
--
Mailing list: https://launchpad.net/~canonical-hw-cert
Post to : [email protected]
Unsubscribe : https://launchpad.net/~canonical-hw-cert
More help : https://help.launchpad.net/ListHelp
