Review for Source Package: xdg-terminal-exec [Summary] xdg-terminal-exec is a generic wrapper around launching a default terminal. That is on a per-user level, rather than system-wide (think x-terminal-emulator alternative). It's the reference implementation of Freedesktop's "Default Terminal Execution" [spec], written in shell script. It has a long history and seems to be well maintained. There is also "xdg-terminal" upstream implementation, which is not currently packaged as part of xdg-utils.
[spec] https://gitlab.freedesktop.org/terminal- wg/specifications/-/merge_requests/3 MIR team ACK under the constraint to resolve the below listed required TODOs and as much as possible having a look at the recommended TODOs. This does need a security review, so I'll assign ubuntu-security List of specific binary packages to be promoted to main: xdg-terminal-exec Specific binary packages built, but NOT to be promoted to main: <None> Notes: #0 - I'm signing it up for security review because this is a big shell script, parsing configs and launching terminals. Required TODOs: #1 - Please swap the "xterm | x-terminal-emulator" Depends to avoid a false-positive component-mismatch, due to xterm not being in "main" Recommended TODOs: #2 - The package should get a team bug subscriber before being promoted #3 - consider using mitigation features (e.g. apparmor) to restrict the threat vectors #4 - please try to find out what's the plan for xdg-utils/xdg-terminal, see comment #2 => do we expect this to be a thing in the future? That would lead to duplication in main, as xdg-utils is currently in main. [Rationale, Duplication and Ownership] OK: - A team is committed to own long term maintenance of this package. (~desktop-packages) - The rationale given in the report seems valid and useful for Ubuntu Problems: - There are other packages in main providing the same/similar functionality. => x-terminal-emulator (virtual package) => xdg-utils/xdg-terminal [Dependencies] OK: - no other Dependencies to MIR due to this - SRCPKG checked with `check-mir` - all dependencies can be found in `seeded-in-ubuntu` (already in main) - none of the (potentially auto-generated) dependencies (Depends and Recommends) that are present after build are not in main - no -dev/-debug/-doc packages that need exclusion - No dependencies in main that are only superficially tested requiring more tests now. Problems: - Please swap the "xterm | x-terminal-emulator" Depends to avoid a false-positive component-mismatch, due to xterm not being in "main" [Embedded sources and static linking] OK: - no embedded source present - no static linking - does not have unexpected Built-Using entries - not a go package, no extra constraints to consider in that regard - not a rust package, no extra constraints to consider in that regard - Does not include vendored code Problems: None [Security] OK: - history of CVEs does not look concerning - does not run a daemon as root - does not use webkit1,2 - does not use lib*v8 directly - does not expose any external endpoint (port/socket/... or similar) - does not process arbitrary web content - does not use centralized online accounts - does not integrate arbitrary javascript into the desktop - does not deal with system authentication (eg, pam), etc) - does not deal with security attestation (secure boot, tpm, signatures) - does not deal with cryptography (en-/decryption, certificates, signing, ...) Problems: - shell code parsing config files (shellcheck clean, though) - consider using mitigation features (e.g. apparmor) to restrict the threat vectors [Common blockers] OK: - does not FTBFS currently - does have a test suite that runs at build time - test suite fails will fail the build upon error. - does have a non-trivial test suite that runs as autopkgtest - This does not need special HW for build or test - no new python2 dependency - not a Python package - not a Go package Problems: None [Packaging red flags] OK: - Ubuntu does not carry a delta - symbols tracking not applicable for this kind of code. - debian/watch is present and looks ok (if needed, e.g. non-native) - Upstream update history is good - Debian/Ubuntu update history is good - the current release is packaged - promoting this does not seem to cause issues for MOTUs that so far maintained the package - no massive Lintian warnings - debian/rules is rather clean - It is not on the lto-disabled list Problems: None [Upstream red flags] OK: - no Errors/warnings during the build - no incautious use of malloc/sprintf (the language has no direct MM) - no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests) - no use of user nobody - no use of setuid / setgid - no important open bugs (crashers, etc) in Debian or Ubuntu - no dependency on webkit, qtwebkit or libseed - not part of the UI for extra checks - no translation present, but none needed for this case (user visible)? Problems: None ** Changed in: xdg-terminal-exec (Ubuntu) Status: New => Confirmed ** Changed in: xdg-terminal-exec (Ubuntu) Assignee: Lukas Märdian (slyon) => Ubuntu Security Team (ubuntu-security) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2069308 Title: MIR xdg-terminal-exec To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/xdg-terminal-exec/+bug/2069308/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs