[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
There is only one version in questing-release, nothing in proposed or else to cover rust-hwlib | 0.9.1 | questing/universe | source Seeing it in mismatches, and all if approved resolving ... Hmm, it bails out on: ./change-override --dry-run --component main --suite questing --source-and-binary rust-hwlib Override component to main rust-hwlib 0.9.1 in questing: universe/rust -> main hwctl 0.9.1 in questing amd64: universe/rust/optional/100% -> main No known owning team subscribed to 'rust-hwlib'. Do you really want to promote? [y|N] We have recently added your team to be considered a Canonical team that can own it, I see it listed e.g. in: http://reqorts.qa.ubuntu.com/m-r- package-team-mapping.html#canonical-hw-cert But indeed there and in checking the subscription seems empty. Odd I thought you said this was done. Double checking ... ./get-packages-subscribed.py --team canonical-hw-cert Yeah it is empty. Please subscribe the team And stay subscribed if that is what happened :-) ? After all this is meant to express ownership and that you e.g triage incoming bugs on it and all such. -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Fix Released Status in rust-hwlib package in Ubuntu: Fix Committed Status in ubuntu-meta package in Ubuntu: New Status in The Focal Fossa: New Status in rust-hwlib source package in Focal: New Status in ubuntu-meta source package in Focal: New Status in The Jammy Jellyfish: New Status in rust-hwlib source package in Jammy: New Status in ubuntu-meta source package in Jammy: New Status in The Noble Numbat: New Status in rust-hwlib source package in Noble: New Status in ubuntu-meta source package in Noble: New Status in The Oracular Oriole: New Status in rust-hwlib source package in Oracular: New Status in ubuntu-meta source package in Oracular: New Status in The Plucky Puffin: New Status in rust-hwlib source package in Plucky: New Status in ubuntu-meta source package in Plucky: New Status in The Questing Quokka: Fix Released Status in rust-hwlib source package in Questing: Fix Committed Status in ubuntu-meta source package in Questing: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
** Also affects: ubuntu-meta (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Fix Released Status in rust-hwlib package in Ubuntu: Fix Committed Status in ubuntu-meta package in Ubuntu: New Status in The Focal Fossa: New Status in rust-hwlib source package in Focal: New Status in ubuntu-meta source package in Focal: New Status in The Jammy Jellyfish: New Status in rust-hwlib source package in Jammy: New Status in ubuntu-meta source package in Jammy: New Status in The Noble Numbat: New Status in rust-hwlib source package in Noble: New Status in ubuntu-meta source package in Noble: New Status in The Oracular Oriole: New Status in rust-hwlib source package in Oracular: New Status in ubuntu-meta source package in Oracular: New Status in The Plucky Puffin: New Status in rust-hwlib source package in Plucky: New Status in ubuntu-meta source package in Plucky: New Status in The Questing Quokka: Fix Released Status in rust-hwlib source package in Questing: Fix Committed Status in ubuntu-meta source package in Questing: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
** Merge proposal linked: https://code.launchpad.net/~slyon/ubuntu-seeds/+git/ubuntu/+merge/486840 -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Fix Released Status in rust-hwlib package in Ubuntu: Fix Committed Status in The Focal Fossa: New Status in rust-hwlib source package in Focal: New Status in The Jammy Jellyfish: New Status in rust-hwlib source package in Jammy: New Status in The Noble Numbat: New Status in rust-hwlib source package in Noble: New Status in The Oracular Oriole: New Status in rust-hwlib source package in Oracular: New Status in The Plucky Puffin: New Status in rust-hwlib source package in Plucky: New Status in The Questing Quokka: Fix Released Status in rust-hwlib source package in Questing: Fix Committed Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
We now have Security ACK and MIR ack. Let's get this landed in the seeds, to make it show up in component-mismatches, so it can get promoted to "main" by an archive-admin. I'm including it in the "supported" seed for now. @mz2 mentioned that this should eventually be pre-installed in Server & Desktop images. So we need to get confirmations from owners of those images that this is OK to be included and add it to the corresponding seeds, too. I'd suggest adding it as a "Recommends" to those seed, so that it would be pre- installed, but could also be removed, if needed. ** Changed in: rust-hwlib (Ubuntu Questing) Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Fix Released Status in rust-hwlib package in Ubuntu: Fix Committed Status in The Focal Fossa: New Status in rust-hwlib source package in Focal: New Status in The Jammy Jellyfish: New Status in rust-hwlib source package in Jammy: New Status in The Noble Numbat: New Status in rust-hwlib source package in Noble: New Status in The Oracular Oriole: New Status in rust-hwlib source package in Oracular: New Status in The Plucky Puffin: New Status in rust-hwlib source package in Plucky: New Status in The Questing Quokka: Fix Released Status in rust-hwlib source package in Questing: Fix Committed Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
I reviewed rust-hwlib 0.9.1 as checked into questing. This shouldn't be considered a full audit but rather a quick gauge of maintainability. This is a second audit run, the first being: https://bugs.launchpad.net/ubuntu/+bug/2072561/comments/10 rust-hwlib is a library and client application that collects hardware and OS information and check certification status with a server. - CVE History - None - Build-Depends - cargo:native; jq; libssl-dev; python3; rustc:native - pre/post inst/rm scripts - Install/Remove AppArmor profile - init scripts - None - systemd units - None - dbus services - None - setuid binaries - None - binaries in PATH - ./usr/bin/hwctl - sudo fragments - None - polkit files - None - udev rules - None - unit tests / autopkgtests - unittests for hwlib, running in build time - autopkgtest also present, validating hwctl and the apparmor profile - cron jobs - None - Build logs - OK. a few warnings mainly from rust-vendor/ code. - Processes spawned - OK - Memory management - OK - File IO - OK - Logging - OK - Environment variable usage - OK - Use of privileged functions - OK - Use of cryptography / random number sources etc - OK - Use of temp files - OK - Use of networking - OK - Use of WebKit - None - Use of PolicyKit - None - Any significant cppcheck results - None - Any significant Coverity results - Coverity not available for Rust - Any significant shellcheck results - None - Any significant bandit results - None - Any significant govulncheck results - None - Any significant Semgrep results - None The rust-hwlib code itself seems consistent and the interactions with the in-house upstream were very satisfying giving us confidence that the package will have the support needed. The main challenge is with the rust vendored code environment, a known fact that we can live and work with. Security team ACK for promoting rust-hwlib to main. ** Changed in: rust-hwlib (Ubuntu Questing) Status: New => In Progress ** Changed in: rust-hwlib (Ubuntu Questing) Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned) -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Fix Released Status in rust-hwlib package in Ubuntu: In Progress Status in The Focal Fossa: New Status in rust-hwlib source package in Focal: New Status in The Jammy Jellyfish: New Status in rust-hwlib source package in Jammy: New Status in The Noble Numbat: New Status in rust-hwlib source package in Noble: New Status in The Oracular Oriole: New Status in rust-hwlib source package in Oracular: New Status in The Plucky Puffin: New Status in rust-hwlib source package in Plucky: New Status in The Questing Quokka: Fix Released Status in rust-hwlib source package in Questing: In Progress Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
** Changed in: rust-hwlib (Ubuntu Questing) Status: Fix Released => New ** Changed in: Ubuntu Questing Status: New => Fix Released ** Changed in: rust-hwlib (Ubuntu Questing) Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security) ** Changed in: Ubuntu Questing Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned) -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Fix Released Status in rust-hwlib package in Ubuntu: New Status in The Focal Fossa: New Status in rust-hwlib source package in Focal: New Status in The Jammy Jellyfish: New Status in rust-hwlib source package in Jammy: New Status in The Noble Numbat: New Status in rust-hwlib source package in Noble: New Status in The Oracular Oriole: New Status in rust-hwlib source package in Oracular: New Status in The Plucky Puffin: New Status in rust-hwlib source package in Plucky: New Status in The Questing Quokka: Fix Released Status in rust-hwlib source package in Questing: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
This bug was fixed in the package rust-hwlib - 0.9.1 --- rust-hwlib (0.9.1) questing; urgency=medium * Add AppArmor profile * Remove librust-hwlib-dev deb binary package * Replace lsb-release dependency with os-release Rust library * Replace dpkg command with Rust ARCH rust-hwlib (0.9.0) questing; urgency=medium * Package the project for Questing (LP: #2072561) * Add integration tests to autopkgtests * Update debian/copyright to include vendored dependencies licenses -- Nadzeya Hutsko Thu, 15 May 2025 16:44:17 +0200 ** Changed in: rust-hwlib (Ubuntu Questing) Status: New => Fix Released -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: New Status in rust-hwlib package in Ubuntu: Fix Released Status in The Focal Fossa: New Status in rust-hwlib source package in Focal: New Status in The Jammy Jellyfish: New Status in rust-hwlib source package in Jammy: New Status in The Noble Numbat: New Status in rust-hwlib source package in Noble: New Status in The Oracular Oriole: New Status in rust-hwlib source package in Oracular: New Status in The Plucky Puffin: New Status in rust-hwlib source package in Plucky: New Status in The Questing Quokka: New Status in rust-hwlib source package in Questing: Fix Released Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
** Also affects: rust-hwlib (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: New Status in rust-hwlib package in Ubuntu: New Status in The Focal Fossa: New Status in rust-hwlib source package in Focal: New Status in The Jammy Jellyfish: New Status in rust-hwlib source package in Jammy: New Status in The Noble Numbat: New Status in rust-hwlib source package in Noble: New Status in The Oracular Oriole: New Status in rust-hwlib source package in Oracular: New Status in The Plucky Puffin: New Status in rust-hwlib source package in Plucky: New Status in The Questing Quokka: New Status in rust-hwlib source package in Questing: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a native package - debian/control defines a correct
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
I just sponsored a new version v0.9.1 with minor (non-blocking) remarks/comments around fixing lintian hints. - #1: fully resolved: the AppArmor profile is now included in the package - #2: canonical-hwcert as a distro team is now also fully resolved => MIR ACK still stands. Pending security review and ArchiveAdmin/NEW review, which can happen in parallel. https://launchpad.net/ubuntu/questing/+queue?queue_state=0&queue_text=rust- hwlib Addressing Simon's comment above, this version also drops the "librust- hwlib-dev" binary. Only shipping the "hwctl" binary now. I did not see any Python bits, but those bindings can probably be postponed to a later version. -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: New Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: New Status in The Questing Quokka: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
Hi, This was discussed with Nadzeya in-person, but here's a summary for the record. I will be rejecting this package from the NEW queue. IMHO, librust-hwlib-dev is not only useless, but actively harmful. As it stands, it *looks* like a normal debcargo package, but it's not part of that ecosystem. That means that any normal consumer of librust* packages will have nasty surprises when trying to resolve the dependencies. OTOH, any *other* prospective user of this specific dependency will have to vendor the rest of their Rust crates, and tooling does *not* support this hybrid scenario. As discussed, the one known user of this as a library would be the pro client, but since that's a Python program, my advice would be to actually build and provide the Python bindings *from* the rust-hwlib source package. That way, the Pro folks don't have to worry about Rust and can just focus on using the thing. -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: New Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: New Status in The Questing Quokka: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
Thank you Nadzeya for all of your work (and patience). I re-reviewed the 0.9.0~ppa8 version and will be sponsoring the upload into the archive. We'll then need an archive-admin to accept it from the NEW queue. My remarks have been addressed, except for #1 which is not yet fully deployed in an ideal way (AppArmor profile should be part of the package itself, also make it easier for future SRUs). But I'm downgrading this to a Recommended TODO, and will make sure it is included in the next version of the package and uploaded into Questing. => MIR ACK! (still waiting for a security re-review). Assigning ~ubuntu- security. #0 - Re-Flagging for security review (for Questing) Now that the vendored dependencies got updated and osv-scanner is looking clean. #1 - The AppArmor profile was reviewed by the upstream AppArmor team, thanks! https://gitlab.com/apparmor/apparmor/-/merge_requests/1658 Still, we probably want to ship this as part of the actual rust-hwlib package. => I'm downgrading this to a Recommended TODO. Please ship the AA profile with the next upstream & package version. #2 - Thanks for implementing the mock server and testing the actual "hwctl" binary. LGTM! #3 - We now have a v0.9.0 tag upstream, which matches the PPA package's contents. https://github.com/canonical/hardware-api/releases/tag/v0.9.0 (Except for the filtered rust-vendor/ directory) #4 - ACK. amd64-only for now. #5 - ACK. ~canonical-hw-cert is about to become a distro team https://code.launchpad.net/~nhutsko/ubuntu-archive-tools/+git/ubuntu-archive-tools/+merge/485759 #6 - ACK. That was an oversight on my end. #7 - This is a native package, so consider this TODO dropped. #8 & #9 - Ignoring those non-critical warnings for now. ** Changed in: Ubuntu Questing Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security) -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: New Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: New Status in The Questing Quokka: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
** Merge proposal linked: https://code.launchpad.net/~slyon/ubuntu-seeds/+git/ubuntu/+merge/485758 -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: New Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: New Status in The Questing Quokka: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a native package - debian/control defines a correct Maintainer field - Lintian overrides are not present - This package only has minor lintian pedantic warnings and one regular warnings (using lintian version 2.121.1): - The warning regarding Vendor-Sources-Rust header is expected, since it's required for Rust packages that use vendored dependencies and specify this header
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
I've updated the package build to fix the raised issues and remaining TODOs: #1 - The AppArmor profile has been created for /usr/bin/hwctl and merged to the master branch in the AppArmor repo. Here are the PR details: https://gitlab.com/apparmor/apparmor/-/merge_requests/1658/ Here is the hwctl profile in AppArmor master: https://gitlab.com/apparmor/apparmor/-/blob/master/profiles/apparmor.d/usr.bin.hwctl #2 - The rust-hwlib:hwctl autopkg test has been added. It mocks the hwapi server that returns a static response, runs the hwctl tool, and compares the output with the expected one. #3 and #4 - Were explained above Also, all the cargo dependencies are up-to-date and don't have known vulnerabilities: $ osv-scanner scan --verbosity warn -r --format table . No issues found The code has been updated to use the full paths of binaries like `lsmod`, `lsb_release`, and `dpkg`. I had to create a new PPA for the project due to Questing becoming the new target release that caused version conflicts for the Plucky release: https://launchpad.net/~nhutsko/+archive/ubuntu/hwlib-ppa Links to build log: * questing: https://launchpadlibrarian.net/792328895/buildlog_ubuntu-questing-amd64.rust-hwlib_0.9.0~ppa8_BUILDING.txt.gz * plucky: https://launchpadlibrarian.net/792332288/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~25.04~ppa8_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/792342288/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa8_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/792359943/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa8_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/792357487/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa8_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/792361770/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa8_BUILDING.txt.gz Links to test logs: * questing: https://autopkgtest.ubuntu.com/results/autopkgtest-questing-nhutsko-hwlib-ppa/questing/amd64/r/rust-hwlib/20250509_201510_aaf92@/log.gz * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwlib-ppa/plucky/amd64/r/rust-hwlib/20250509_201313_372f0@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwlib-ppa/oracular/amd64/r/rust-hwlib/20250509_201953_b5fd5@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwlib-ppa/noble/amd64/r/rust-hwlib/20250510_055131_ed790@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwlib-ppa/jammy/amd64/r/rust-hwlib/20250510_055142_2fbef@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwlib-ppa/focal/amd64/r/rust-hwlib/20250510_055123_2275f@/log.gz ** Changed in: Ubuntu Plucky Status: Incomplete => New ** Changed in: Ubuntu Questing Status: Incomplete => New -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: New Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: New Status in The Questing Quokka: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
** Also affects: Ubuntu Questing Importance: Undecided Status: Incomplete -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Incomplete Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: Incomplete Status in The Questing Quokka: Incomplete Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a native package - debian/control defines a correct Maintainer field - Lintian overrides are not present - This package only has minor lintian pedantic warnings and one regular warnings (using lintian version 2.121.1): - The warning regarding Vendor-Sources-Rust header is expected, since it's required for Rust packages that use vendored dependencies and specify this
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
Setting this back to "Incomplete", for the reporter to handle the remarks from security review. ** Changed in: Ubuntu Plucky Status: In Progress => Incomplete -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Incomplete Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: Incomplete Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a native package - debian/control defines a correct Maintainer field - Lintian overrides are not present - This package only has minor lintian pedantic warnings and one regular warnings (using lintian version 2.121.1): - The warning regarding Vendor-Sources-Rust header is expected, since it's required for Rust packages that use vendored
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
I reviewed rust-hwlib 0.9.0~ppa3 as checked into plucky. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.
Given the time frame for plucky and the findings we have already discussed
with regards to the vendored code, the Security team NACK for promoting
rust-hwlib 0.9.0~ppa3 in plucky to main.
It worth mentioning that it feels very promising that we can have (and
feasible maintain) this package in main in a next release very soon, once
we have the dependencies updated. Hopefully when we reach that time, we
could also have something better for the Rust ecosystem at all that we
could leverage.
An additional suggestion is to try to avoid using relative binary name as
in calls to 'dpkg', 'lsmod', and 'lsb_release'[1]. Using the full path
('/usr/bin/dpkg', '/usr/sbin/lsmod', and '/usr/bin/lsb_release') is
recommended to avoid the risk of trusting in PATH environment that could
be manipulated [2]
[1]:
https://github.com/canonical/hardware-api/blob/9a945111ee86b19910d88a106e95a72a897b370f/client/hwlib/src/collectors/os_info.rs#L27
[2]: https://cwe.mitre.org/data/definitions/426.html
** Changed in: Ubuntu Plucky
Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)
** Changed in: Ubuntu Plucky
Status: Confirmed => Won't Fix
** Changed in: Ubuntu Plucky
Status: Won't Fix => In Progress
--
You received this bug notification because you are a member of Canonical
Hardware Certification, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2072561
Title:
[MIR] rust-hwlib
Status in Ubuntu:
Confirmed
Status in The Focal Fossa:
New
Status in The Jammy Jellyfish:
New
Status in The Noble Numbat:
New
Status in The Oracular Oriole:
New
Status in The Plucky Puffin:
In Progress
Bug description:
[Availability]
- This package rust-hwlib is published to the PPA:
https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT
part of the universe. We have an exception to publish it directly to
main, since this library will help the development of solutions that
affect Canonical customers directly. Please check with ~paelzer for
more information.
- The package rust-hwlib build for the architectures it is designed to
work on.
- It currently builds and works for architectures: amd64
- Link to package:
https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages
[Rationale]
- This package rust-hwlib is part of the
[hardware-api](https://github.com/canonical/hardware-api) project,
owned and developed by Canonical Hardware Certification team. It
will be used by Ubuntu pro-client to retrieve information about the
machine and check its certification status.
- The package rust-hwlib will generally be useful for a large number
of users who use Ubuntu and want see what components have been
tested and certified and for which Ubuntu releases.
- There is no other/better way to solve this that is already in main
or should go universe->main instead of this.
- The package rust-hwlib is required in Ubuntu main no later than
April 2025 due to 25.04 release date, so users and Canonical
customer can install it for the latest Ubuntu release.
[Security]
- No CVEs/security issues in this software in the past
- no `suid` or `sgid` binaries
- no executables in `/sbin` and `/usr/sbin`
- Package does not install services, timers or recurring jobs
- Packages does not open privileged ports (ports < 1024).
- Package does not expose any external endpoints
- Packages does not contain extensions to security-sensitive software
[Quality assurance - function/usage]
- The package works well right after install
[Quality assurance - maintenance]
- The package is maintained well in Upstream and does not have too
many, long-term & critical, open bugs
- Upstream's bug tracker:
https://github.com/canonical/hardware-api/issues
- The package does not deal with exotic hardware we cannot support
[Quality assurance - testing]
- The package runs a test suite on build time, if it fails it makes
the build fail, link to build log:
* plucky:
https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz
* oracular:
https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz
* noble:
https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz
* jammy:
https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz
* focal:
https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz
- The package runs an autopkgtest, and is currently passing on amd64
architecture, link to test logs:
* plucky:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
Thank you for that early finding of your evaluation! Indeed an upstream (In this case Canonical) is expected to regularly keep their dependencies up to date to resolve such issues. Furthermore the owning team (in this case also Canonical) is required to make adaptions so it can build well in all target releases. This is a common, painful but required regular task of dependency management. Like if you have a stack build on all active releases, but the dependency update requires you to update to a version that no more build with the old toolchain. I'm glad you've spot this right now, not only to update it before being used widely, but also to ensure there is time and capacity planned for the same as regular updates and adaptation to all the supported target releases. -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Confirmed Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: Confirmed Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
Hey, I'm conducting the security audit from the security team perspective and I'm a bit concerned with the results of one the tools: 'osv-scanner'. It is showing a few security issues with a few of the vendored codes. I understand the vendored code could be a pain, but I wonder if there is anything we could do with regards to this report (as in: is it possible to update the crates to a newer version?). and, do you think it is feasible and sustainable to maintain those crates on top of the security issues in the future? I'm afraid we can lose track of those and end up with unnoticed security issues. the osv-scanner report for rust-hwlib-0.9.0~ppa3: https://pastebin.canonical.com/p/VSFYMYTyNF/ how to run: $ sudo snap install osv-scanner $ osv-scanner scan --verbosity warn -r --format table . -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Confirmed Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: Confirmed Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
Also, I'd like to explain the #3 and #4 TODOs #3 - hardware-api is a monorepo, so it has both client and server code together. The "Revision XXX" are the hwapi server releases, that's why these tags have the `hwapi-` prefix. Once our MIR is approved, we'll create the client release on github with the 0.9.0 version #4 - Currently all the other architectures but amd64 are not supported. This is because we have to figure out how to collect the hardware information we need on such machines. We're using `SMBIOS` data for `amd64` machines, which is not available for other architectures. This is also written in the `hwctl` man page (in the BUGS section). We already need this package to be in main so the pro-client team can start using it at least on amd64 machines -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Confirmed Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: Confirmed Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
** Tags added: sec-5931 -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Confirmed Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: Confirmed Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a native package - debian/control defines a correct Maintainer field - Lintian overrides are not present - This package only has minor lintian pedantic warnings and one regular warnings (using lintian version 2.121.1): - The warning regarding Vendor-Sources-Rust header is expected, since it's required for Rust packages that use vendored dependencies and specify this header in the `debian/control` file. # lintian --pedantic rust-hwlib_0.9.0\~ppa3_source.changes W:
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
*Summarising the discussion with ~slyon* We filter out unnecessary vendored crates in the `Cargo.toml` file (see https://github.com/canonical/hardware- api/blob/main/client/Cargo.toml#L10), so vendor-filterer replaces unreferenced packages with stub. As ~slyon confirmed, we can consider #6 resolved. -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Confirmed Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: Confirmed Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a native package - debian/control defines a correct Maintainer field - Lintian overrides are not present - This package only has minor lintian pedantic warnings and one regular warnings (using lintian version
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
I'm already assigning this to ~ubuntu-security for review. The outstanding TODOs should not affect the security review (except adding of an apparmor profile, which would only improve their verdict). -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Confirmed Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: Confirmed Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a native package - debian/control defines a correct Maintainer field - Lintian overrides are not present - This package only has minor lintian pedantic warnings and one regular warnings (using lintian version 2.121.1): - The warning regarding Vendor-Sources-Rust header is expected, since it's required for
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
For the autopkgtest in TODO #2 I'm considering something simple like: Preparing a corresponding (static) JSON response file and serving it via a simple web server: $ python3 -m http.server Then calling hwctl on that localhost mock server, querying a relevant endpoint and comparing the hwctl output to the static JSON repsonse. $ HW_API_URL="localhost:8000" hwctl -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: Confirmed Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: Confirmed Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a native package - debian/control defines a correct Maintainer field - Lintian overrides are not present - This package only has minor lintian pedantic
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
Review for Source Package: rust-hwlib
[Summary]
This Rust binary ("hwctl") queries the https://hw.ubuntu.com endpoint for
specific
CPU and hardware info, to check if the system runs on a certified device. It's
an Ubuntu/Canonical only solution. The output is structured JSON data, to be
consumed by "Ubuntu Pro". It's actively maintained in upstream/GitHub, but not
yet packaged in the archives. The Rust application code itself is fairly small
(~1k LoC), but comes with a huge pile of vendored crates (~1M LoC).
MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.
This does need a security review, so I'll assign ubuntu-security
List of specific binary packages to be promoted to main: hwctl
Specific binary packages built, but NOT to be promoted to main:
Notes:
#0 - Flagging for security review, due to parsing of system/device data and
parsing of HTTP responses from a centralized (trusted?) endpoint,
hw.ubuntu.com which can easily be modified at runtime via HW_API_URL
Required TODOs:
#1 - The binary is expected to run as root, but only needs access to specific
system data. Consider adding an apparmor profile for restricting it to the
mandatory data access. (I'm unclear about this, could potentially be
downgraded to a Recommended TODO.)
#2 - The autopkgtests is just a re-execution of the unit tests, including
re-compile, so not testing the actual, installed binaries. Adding a simple
integration tests, using a mock HTTP server to simulate hw.ubuntu.com and
make a test request using the real binary would be very valuable.
#3 - Please explain the release (upstream) release process, I see "Revision XXX"
as releases on GitHub, but this package (the hwlib client) uses versions
like v0.9.0 which are not referenced upstream.
#4 - Please explain the arch:amd64 limitation. I see arm64/rpi4b8g in test data
but the package is not built for arm64 or any other arch besides amd64.
Doesn't the Pro client need the data for devices of any architecture?
Recommended TODOs:
#5 - The package should get a team bug subscriber before being promoted
#6 - d/vendor-rust.sh: Consider using "cargo vendor-filterer" with the following
arguments "--platform '*-*-linux-gnu' --platform '*-*-linux-gnueabi'" to
avoid unnecessary windows crates
#7 - d/rules: Consider using a VENDOR_TARBALL for crates, see "vendor-tarball"
target in this example makefile:
https://github.com/canonical/ubuntu-mir/blob/main/vendoring/Rust.md#automation-via-debianrules
#8 - Consider fixing some lintian warnings, especially those (see below for more
warnings and details):
W: hwctl: synopsis-too-long
I: rust-hwlib source: override_dh_auto_test-does-not-check-DEB_BUILD_OPTIONS
[debian/rules:28]
P: rust-hwlib source: uses-debhelper-compat-file [debian/compat]
#9 - Consider fixing some build-time warnings, especially this one (see below
for more warnings and details):
warning: use of deprecated method `std::error::Error::description`: use the
Display impl or to_string()
[Rationale, Duplication and Ownership]
- There is no other package in main providing the same functionality.
=> Custom Canonical solution for checking hardware certification status.
- A team is committed to own long term maintenance of this package.
=> ~canonical-hw-cert
- The rationale given in the report seems valid and useful for Ubuntu.
[Dependencies]
OK:
- no other Dependencies to MIR due to this
- SRCPKG checked with `check-mir`
- all dependencies can be found in `seeded-in-ubuntu` (already in main)
- none of the (potentially auto-generated) dependencies (Depends
and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
more tests now.
Problems: None
[Embedded sources and static linking]
OK:
- not a go package, no extra constraints to consider in that regard
- does not have unexpected Built-Using entries
- Rust package that has all dependencies vendored. It does neither
have *Built-Using (after build). Nor does the build log indicate
built-in sources that are missed to be reported as Built-Using.
- rust package using dh_cargo (dh ... --buildsystem cargo)
- Includes vendored code, the package has documented how to refresh this
code at ./README.md
Problems:
- embedded source present (vendored Rust dependencies)
- Rust, using static linking of the final binary
[Security]
OK:
- history of CVEs does not look concerning (new application, Jan 2024)
- does not run a daemon as root
- does not use webkit1,2 (references in
rust-vendor/vcpkg/../boost-build_1.67.0_x64-windows.list)
- does not use lib*v8 directly
- does not process arbitrary web content
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not
[Canonical-hw-cert] [Bug 2072561] Re: [MIR] rust-hwlib
** Changed in: Ubuntu Plucky Assignee: (unassigned) => Lukas Märdian (slyon) -- You received this bug notification because you are a member of Canonical Hardware Certification, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/2072561 Title: [MIR] rust-hwlib Status in Ubuntu: New Status in The Focal Fossa: New Status in The Jammy Jellyfish: New Status in The Noble Numbat: New Status in The Oracular Oriole: New Status in The Plucky Puffin: New Bug description: [Availability] - This package rust-hwlib is published to the PPA: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert, it'is NOT part of the universe. We have an exception to publish it directly to main, since this library will help the development of solutions that affect Canonical customers directly. Please check with ~paelzer for more information. - The package rust-hwlib build for the architectures it is designed to work on. - It currently builds and works for architectures: amd64 - Link to package: https://launchpad.net/~nhutsko/+archive/ubuntu/hwcert/+packages [Rationale] - This package rust-hwlib is part of the [hardware-api](https://github.com/canonical/hardware-api) project, owned and developed by Canonical Hardware Certification team. It will be used by Ubuntu pro-client to retrieve information about the machine and check its certification status. - The package rust-hwlib will generally be useful for a large number of users who use Ubuntu and want see what components have been tested and certified and for which Ubuntu releases. - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The package rust-hwlib is required in Ubuntu main no later than April 2025 due to 25.04 release date, so users and Canonical customer can install it for the latest Ubuntu release. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package is maintained well in Upstream and does not have too many, long-term & critical, open bugs - Upstream's bug tracker: https://github.com/canonical/hardware-api/issues - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log: * plucky: https://launchpadlibrarian.net/777209956/buildlog_ubuntu-plucky-amd64.rust-hwlib_0.9.0~ppa3_BUILDING.txt.gz * oracular: https://launchpadlibrarian.net/777212066/buildlog_ubuntu-oracular-amd64.rust-hwlib_0.9.0~24.10~ppa3_BUILDING.txt.gz * noble: https://launchpadlibrarian.net/777213502/buildlog_ubuntu-noble-amd64.rust-hwlib_0.9.0~24.04~ppa3_BUILDING.txt.gz * jammy: https://launchpadlibrarian.net/777215272/buildlog_ubuntu-jammy-amd64.rust-hwlib_0.9.0~22.04~ppa3_BUILDING.txt.gz * focal: https://launchpadlibrarian.net/777224054/buildlog_ubuntu-focal-amd64.rust-hwlib_0.9.0~20.04~ppa3_BUILDING.txt.gz - The package runs an autopkgtest, and is currently passing on amd64 architecture, link to test logs: * plucky: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-nhutsko-hwcert/plucky/amd64/r/rust-hwlib/20250217_164725_7b20c@/log.gz * oracular: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-nhutsko-hwcert/oracular/amd64/r/rust-hwlib/20250217_164928_490d4@/log.gz * noble: https://autopkgtest.ubuntu.com/results/autopkgtest-noble-nhutsko-hwcert/noble/amd64/r/rust-hwlib/20250217_164803_f2f62@/log.gz * jammy: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-nhutsko-hwcert/jammy/amd64/r/rust-hwlib/20250217_164854_d644b@/log.gz * focal: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-nhutsko-hwcert/focal/amd64/r/rust-hwlib/20250217_164822_8ffa3@/log.gz - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is not present because it is a native package - debian/control defines a correct Maintainer field - Lintian overrides are not present - This package only has minor lintian pedantic warnings and one regular warnings (using lintian version 2.121.1): - The warning regarding Vendor-Sources-Rust header is expected, since it's required for Rust packages that use vendored dependencies and specify this header in the `debian/control` file. # lintian
