[MIR] suitesparse-graphblas

[Didier Roche-Tolomelli]

[Availability]
The package suitesparse-graphblas is already in Ubuntu universe.
The package suitesparse-graphblas builds for the architectures it is designed to work on.
It currently builds and works for architectures: amd64 arm64 armhf ppc64el riscv64 s390x
Link to package https://launchpad.net/ubuntu/+source/suitesparse-graphblas

[Rationale]
- The package suitesparse-graphblas is required in Ubuntu main to replace the current outdated copy included in suitesparse

It's following up the change in
https://launchpad.net/ubuntu/+source/suitesparse/1:5.10.1+dfsg-3

[Security]
- No CVEs/security issues in this software in the past
- no `suid` or `sgid` binaries
- no executables in `/sbin` and `/usr/sbin`
- Package does not install services, timers or recurring jobs
- Packages does not open privileged ports (ports < 1024)
- Packages does not contain extensions to security-sensitive software

[Quality assurance - function/usage]
- The package works well right after install

[Quality assurance - maintenance]
- The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
- The package doesn't run tests during the build. It's not a regression compared to the current situation but it is something we should work toward resolving.
The lack of tests has been reported to Debian, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003883
And on launchpad assigned to canonical-desktop-team, https://bugs.launchpad.net/ubuntu/+source/suitesparse-graphblas/+bug/1958152
- Similarly there is no autopkgtest, which is identic to the current situation pre split. It's mentioned in the previously referenced reports.
- The lack of tests was discussed in the MIR team meeting and it was agreed the issue wouldn't be a blocker for promotion since it's not a regression over the current situation.

[Quality assurance - packaging]
- debian/watch is present and works
- lintian --pedantic only warns about lines > 512 chars in upstream sources which doesn't sound like something we need to worry about
- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies

- The package will be installed by default, but does not ask debconf questions
- Packaging and build is easy, link to d/rules https://salsa.debian.org/science-team/suitesparse-graphblas/-/blob/master/debian/rules

[UI standards]
- Application is not end-user facing (does not need translation)

[Dependencies]
- No further depends or recommends dependencies that are not yet in main

[Standards compliance]
- This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- Owning Team will be desktop-packages
- Team is already subscribed to the package

- This does not use static builds
- This does not use vendored code

[Background information]
The Package description explains the package well
Upstream Name is GraphBLAS
Link to upstream project https://people.engr.tamu.edu/davis/GraphBLAS.html

[Christian Ehrhardt  (paelzer)]

This isn't a normal review, this is a source split, and we really have to see what we gain/lose due to that:
- Version upgrade 5.0.5 -> 6.0 (better)
- Maintained and tracked individually (better)
- No tests (as before)

Since it is the same code as before not that much review is needed to be repeated.

So while not perfect we are at no real loss and have some gains compared to the situation before.

I really would like to see some tests added and have taken the opportunity to bump the priority of that bug - because we want to see this as a non-blocking chance to get it tested. Not as hiccup to be ignored from now on.

MIR Team ack for:
- being code that already was in main
- making the situation slightly better overall
- no new dependencies/complexities added

No security review needed (again).

---

I was also checking if suitesparse is only in main for nostalgic reasons.
Back in 2008 this was promoted as build-depends which nowadays no more need to be in main (see bug 305790).
I found the mentione build-dependency (doesn't matter anymore) and a runtime dependency to src:suitesparse but not to src:suitesparse-graphblas
libreoffice-calc -> lp-solve -> libcolamd2 -> libsuitesparseconfig5 (of src:suitesparse, no deps from here)

If you look at germinate [1] it seems all of the rest only comes due to the auto-inclusion of libsuitesparse-dev and libsuitesparse-doc. You could consider trying to exclude their auto-promotion and to me it seems suitesparse-graphblas might then drop from component mismatches.
I might have missed a dependency, but wanted to ask if you had a reason to keep those bits of suitesparse*

[1]: https://people.canonical.com/~ubuntu-archive/germinate-output/ubuntu.jammy/all

---

TL;DR:
If you really do want it fine, but maybe it is not needed.
Setting to incomplete for Desktop to check motivations and details.

[Sebastien Bacher (seb128)]

Thanks for doing those checks Christian! Rico confirmed that lp-solve doesn't need graphblas so we went the road of demoting the dev and doc binaries, https://git.launchpad.net/~ubuntu-core-dev/ubuntu-seeds/+git/ubuntu/commit/?id=92d8664c

[Christian Ehrhardt  (paelzer)]

Ok, great - let me know if this worked out or if we all have missed a dependency path :-)

[Didier Roche-Tolomelli (didrocks)]

Seems this is not enough and it’s again in the graph:
 o suitesparse-graphblas: libgraphblas-dev libgraphblas-doc libgraphblas6
   [Reverse-Depends: Rescued from suitesparse-graphblas, libgraphblas-dev]
   [Reverse-Recommends: libsuitesparse-dev]

Seb, if you have some spare cycle, mind having another look? Let’s reuse this bug to track it.

[Jeremy Bícha (jbicha)]

I'm closing this bug since the package is no longer on the list to be promoted to main.