Review for Source Package: mysql-9.7 Launchpad bug: https://bugs.launchpad.net/bugs/2160635 Target series: devel Analysed source version: 9.7.1-1 (proposed pocket) Review type: reorg (renamed/reorganised source) — Detected a renamed/reorganised source from mysql-8.4
[Summary] NOTE: - This is a renamed/reorganised source; per MIR policy all findings below are treated as non-blocking recommendations. OK: - Review for Source Package: mysql-9.7 - Reporter template not required for re-review/reorg; proceeding without it. - List of specific binary packages to be promoted to main: libmysqlclient24 libmysqlclient-dev mysql-client-core mysql-client mysql-server-core mysql-server (same names full takeover) - Specific binary packages built, but NOT to be promoted to main: mysql-testsuite mysql-source mysql-router - MIR team ACK (In addition to be "only" a rename No fundamental nack-level blockers were found, and the package shows many positive signals (symbols tracking, no vendored code, AppArmor profiles, no delta, non-trivial test suite).) - This does not need a security review (because former direct predecessors have been reviewed before). Recommended TODOs: - #1 does FTBFS currently (Launchpad build state shows failures: riscv64: Currently building - it is slow and build and test might follow after the current infra issues) [Rationale, Duplication and Ownership] OK: - There is no other package in main providing the same functionality. (The search identified postgresql-18 (main) as a relational database, but it is a distinct server implementation rather than a functional duplicate of MySQL. Other candidates are client libraries, documentation, or integration tools for PostgreSQL or SQLite.) And the old rationale of this being a prime DB server users want to use still holds true. - A team is committed to own long term maintenance of this package - please subscribe it asap Problems: none [Dependencies] - no runtime dependencies in universe need MIR - no other build-time Dependencies with active code in the final binaries to MIR due to this - no auto-included -dev/-debug/-doc packages need exclusion - No dependencies in main that are only superficially tested requiring more tests now. Problems: none [Embedded sources and static linking] OK: - not a go package, no extra constraints to consider in that regard - not a rust package, no extra constraints to consider in that regard - Does not include vendored code (No usual vendored directories (vendor/, third_party/, ...) were found in the source tree or shipped in the binaries. The package does not appear to embed third-party vendored code, so a refresh process is not required.) - Does not use static linking - No unexpected Built-Using entries Problems: none [Security] OK: - does not parse data formats (files [images, video, audio, xml, json, asn.1], network packets, structures, ...) from an untrusted source. (Source tree contains parsers for JSON (json_dom, json_binary), XML (strings/xml.cc), MySQL wire protocol (vio/, xplugin), protobuf messages, and storage engine file formats — all fed by network clients which may be untrusted. The dependency analysis failed due to a sbuild error, so runtime parser-library dependencies could not be independently verified, but the source evidence is conclusive that parsing untrusted data is inherent to MySQL's purpose.) - does not expose any external endpoint (port/socket/... or similar) (The package ships a systemd service file for mysql-server and AppArmor profiles for both mysql-server and mysql-router, confirming that network endpoint exposure is anticipated and confined. Source-level evidence shows network I/O modules (vio/) and X Protocol socket listener code, which is expected for a database server. The sbuild search for bind-address patterns returned no matches, but this is expected since bind-address is a runtime configuration directive, not a build-time output.) - does not process arbitrary web content (The package is clearly identified as a database server (Section: database, homepage http://dev.mysql.com/) and the source tree contains SQL engine, storage engines, replication, and client protocol code — none of which render or process arbitrary web content. While MySQL can store data that may include web content, it does not fetch, render, or interpret web pages.) - does not integrate arbitrary javascript into the desktop (The package targets database, libs, and libdevel sections with no desktop file present, and the build dependencies show no WebKit or JavaScript engine. As a server-side database, there is no mechanism for arbitrary JS integration into the desktop.) - does not deal with security attestation (secure boot, tpm, signatures) (No TPM, secure boot, or PKCS#11 patterns were found in the source tree. The cryptographic patterns present (SSL/TLS in vio/, SHA1/MD5 hashing) are standard database transport and authentication operations, not security attestation. The dependency analysis encountered a sbuild failure, so dependencies could not be fully verified, but the source itself clearly does not engage in security attestation.) - CVE history is good, there are cases as this is a primary workload but they are also well managed (minus only releasing them as new minor versions) - Does not use webkit1/2 - Does not use lib*v8 directly - does not use centralized online accounts - does not deal with system authentication (eg, pam), etc) - this makes appropriate (for its exposure) use of established risk mitigation features like apparmor Problems: - does run a daemon as root - MySQL extensively handles cryptography including TLS/SSL connections, password hashing (SHA1/SHA256/MD5), and AES keyring encryption, primarily delegating to system OpenSSL but also containing internal crypto implementations that require security review (which is already had in its former versions). [Common blockers] OK: - does have a non-trivial test suite that runs as autopkgtest (The test control file declares an 'upstream' test depending on mysql-testsuite, which is a comprehensive functional test suite and clearly non-trivial. The autopkgtest DB was unavailable due to a connection timeout, but per policy the declared non-trivial functional test is sufficient to resolve ok.) - This does not need special HW for build or test (MySQL is a database server that builds and tests on standard hardware using common build tools and autopkgtest suites (smoke and upstream tests with needs-root/breaks-testbed restrictions). There is no positive evidence in the reporter content or test metadata indicating exotic or dedicated hardware is required.) - no special hardware needed, so there is no compromise to accept - not a python package, no extra constraints to consider in that regard - not a go package, no extra constraints to consider in that regard - No new Python 2 dependency Problems: - does FTBFS currently (Launchpad build state shows failures: riscv64: Currently building) [Packaging red flags] OK: - Ubuntu does not carry a delta (The delta analysis reports a sync with no Ubuntu-specific changes and no Ubuntu revision in the version string. There is no diff to review, so no delta reasonableness concern applies.) - symbols tracking is in place (a symbols file is shipped: ./debian/libmysqlclient24.symbols) - debian/watch is present and looks ok - the current release is packaged - promoting this does not seem to cause issues for MOTUs that so far maintained the package (The package has no listed uploaders and the upload history shows empty uploader fields, indicating it is synced from Debian without regular Ubuntu-specific maintainers who would lose upload access.) - It is not on the lto-disabled list - Debian/Ubuntu update history is good (hard to get to commits as we all know, but regular) - No excessive lintian warnings Problems: - The debian/rules file is not a simple debhelper setup. It contains well over 100 non-comment lines with hand-rolled cmake configuration, custom source-tarball generation, fragile rpath stripping, and architecture-dependent test-failure handling. A reviewer should assess whether the complexity is justified. Ideally that could be simplified more, but then, we also understand that this is a complex package and for that this is fine (I happen to know that you are improving on this whenever you can). [Upstream red flags] OK: - no incautious use of malloc/sprintf (as far as we can check it) (The package is C/C++ (MySQL), so the manual-memory-management option applies, but the build log shows the build died at the unpack stage with 'No space left on device' and never reached compilation, so no warnings related to malloc or sprintf could be collected. A successful build is needed to scan for dangerous memory management patterns.) - no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests) - no important open bugs (crashers, etc) in Debian or Ubuntu (The only open Ubuntu bug is the MIR request itself, while Debian and upstream report zero open issues.) - not part of the UI for extra checks (The binary package sections are database, libs, and libdevel, which strongly indicate a server/library package rather than a desktop application. No GUI toolkit dependencies are present, and the package is well-known as a database server daemon.) - translation present (The source package includes debconf template translations under debian/po/ with .po files for over 20 languages, and the has_translation_files fact is true. While MySQL is primarily a database daemon, it does have debconf templates shown during installation, and translations for those templates are present.) - Build log is ok in regard to errors and warnings - No old webkit dependencies - No use of user 'nobody' - No use of setuid/setgid Problems: None ** Changed in: mysql-9.7 (Ubuntu) Status: New => In Progress -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2160635 Title: [MIR] mysql-9.7 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/mysql-9.7/+bug/2160635/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
