[MIR] openconnect

[Luís Infante da Câmara]

[Availability]
The package openconnect is already in Ubuntu universe.
The package openconnect builds for the architectures it is designed to work on.
It currently builds and works for architectures: amd64 arm64 armhf ppc64el riscv64 s390x
Link to package [[https://launchpad.net/ubuntu/+source/openconnect|openconnect]]

[Rationale]
- The package openconnect is required in Ubuntu main because it is a dependency of network-manager-openconnect.
- The package openconnect will generally be useful for a large part of our user base
- Two Ubuntu flavors (Kubuntu and Ubuntu Studio) preinstall this package.

- It would be great and useful to community/processes to have the
  package openconnect in Ubuntu main, but there is no definitive deadline.

[Security]
- Had 10 security issues in the past
  - links to such security issues in trackers:
    https://ubuntu.com/security/CVE-2009-5009
    https://ubuntu.com/security/CVE-2010-3901
    https://ubuntu.com/security/CVE-2010-3902
    https://ubuntu.com/security/CVE-2010-3903
    https://ubuntu.com/security/CVE-2012-3291
    https://ubuntu.com/security/CVE-2012-6128
    https://ubuntu.com/security/CVE-2019-16239
    https://ubuntu.com/security/CVE-2013-7098
    https://ubuntu.com/security/CVE-2020-12105
    https://ubuntu.com/security/CVE-2020-12823
    These pages usually contain links to context that shows how these issues got
    handled in the past (and in Ubuntu).
    I am preparing a security update for the unpatched issues in bug #1987569.

- no `suid` or `sgid` binaries
- Binary openconnect in sbin is no problem because TBD
- Package does not install services, timers or recurring jobs
- Package does not contain extensions to security-sensitive software
  (filters, scanners, plugins, UI skins, ...)

[Quality assurance - function/usage]
- The package works well right after install

[Quality assurance - maintenance]
- The package is maintained well in Debian/Ubuntu and has not too many
  and long term critical bugs open
  - Ubuntu https://bugs.launchpad.net/ubuntu/+source/openconnect/+bug
  - Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=openconnect
- The package has important open bugs, listing them:
  https://gitlab.com/openconnect/openconnect/-/issues/162
  https://gitlab.com/openconnect/openconnect/-/issues/259
- The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
- For Ubuntu 20.04, the package runs a test suite on build time, if it fails
  it makes the build fail, link to build log https://launchpadlibrarian.net/472633798/buildlog_ubuntu-focal-amd64.openconnect_8.05-1_BUILDING.txt.gz
- For Ubuntu 22.04 and Kinetic, the package does not run a test at build time because the Debian maintainer disabled them to an issue with Debian builders in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=974836. This can be re-enabled in Ubuntu.

- The package runs an autopkgtest, and is currently passing on
  all architectures, link to test logs TBD

- The package does have failing autopkgtests tests right now, but since
  they always failed they are handled as "ignored failure", this is
  ok because TBD

[Quality assurance - packaging]
- debian/watch is present and works

- debian/control defines a correct Maintainer field

- This package does not yield massive lintian Warnings, Errors
- Please link to a recent build log of the package
  https://launchpad.net/ubuntu/+source/openconnect/8.05-1/+build/19117730/+files/buildlog_ubuntu-focal-amd64.openconnect_8.05-1_BUILDING.txt.gz
  https://launchpad.net/ubuntu/+source/openconnect/8.20-1/+build/23186157/+files/buildlog_ubuntu-jammy-amd64.openconnect_8.20-1_BUILDING.txt.gz
  https://launchpad.net/ubuntu/+source/openconnect/9.01-1/+build/23596572/+files/buildlog_ubuntu-kinetic-amd64.openconnect_9.01-1_BUILDING.txt.gz
- Please attach the full output you have got from
  `lintian --pedantic` as an extra post to this bug.
- Lintian overrides are present, but ok because one of the scripts in the
  package is to be run on Android, whose shell is /system/bin/sh instead of /bin/sh

- This package does not rely on obsolete or about to be demoted packages,
  except on Ubuntu 20.04 (see the following point).
- This package has no python2 or GTK2 dependencies, except on Ubuntu 20.04 where the script trojans/tncc-wrapper.py has to be converted to Python 3.

- The package will be installed by default, but does not ask debconf
  questions higher than medium

- Packaging and build is easy, link to d/rules:
  - 20.04: https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openconnect/8.05-1/openconnect_8.05-1.debian.tar.xz (file debian/rules)
  - 22.04: https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openconnect/8.20-1/openconnect_8.20-1.debian.tar.xz (file debian/rules)
  - Kinetic: https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/openconnect/9.01-1/openconnect_9.01-1.debian.tar.xz (file debian/rules)

[UI standards]
- Application is end-user facing, Translation is present, via standard
  intltool/gettext or similar build and runtime internationalization
  system see TBD

- End-user applications without desktop file, not needed because it is a command-line application

[Dependencies]
- There are further dependencies that are not yet in main, MIR for them
  is at bug #1987448 and bug #1987571

[Standards compliance]
- This package correctly follows FHS and Debian Policy
- This package violates FHS or Debian Polciy, reasons for that are TBD

[Maintenance/Owner]
- Owning Team will be https://launchpad.net/~desktop-packages or https://launchpad.net/~desktop-bugs
- Team is not yet, but will subscribe to the package before promotion
- I have subscribed to all changes and comments for bugs in this package.

- This does not use static builds

- This does not use vendored code

- This does not use vendored code

- This package is not rust based

- For Ubuntu Kinetic, the package successfully built during the most recent test rebuild
- For Ubuntu 20.04, the package was test rebuilt in PPA or sbuild recently (provide link/logs)
  https://launchpad.net/~luis220413/+archive/ubuntu/security-updates/+build/24313137
  https://launchpad.net/~luis220413/+archive/ubuntu/security-updates/+build/24313138
  https://launchpad.net/~luis220413/+archive/ubuntu/security-updates/+build/24313139
  https://launchpad.net/~luis220413/+archive/ubuntu/security-updates/+build/24313140
  https://launchpad.net/~luis220413/+archive/ubuntu/security-updates/+build/24313141

[Background information]
The Package description explains the package well
Upstream Name is OpenConnect
Link to upstream project https://gitlab.com/openconnect/openconnect

[Luís Infante da Câmara (luis220413)]

For the .dsc file and for the changes file for a clean build of the version in Ubuntu Kinetic, Lintian produces the following output:

W: libopenconnect5: changelog-distribution-does-not-match-changes-file (unstable != kinetic)
W: openconnect changes: distribution-and-changes-mismatch kinetic unstable
W: openconnect-dbgsym: elf-error In program headers: Unable to find program interpreter name [usr/lib/debug/.build-id/15/60921d2ebc2a3eaeea8ae75284aeaba1757a11.debug]
N: 1 hint overridden (1 error); 0 unused overrides

The first two warnings can be ignored and the third warning is due to bug #1977883.

[Luís Infante da Câmara (luis220413)]

For the .dsc file and for the changes file for a clean build of the version in Ubuntu 20.04, Lintian produces the following output:

W: libopenconnect5: changelog-distribution-does-not-match-changes-file (focal-security != focal)
W: openconnect changes: distribution-and-changes-mismatch focal focal-security
N: 1 tag overridden (1 error)

[Jeremy Bícha (jbicha)]

I'm setting this as Incomplete for the same reason as https://launchpad.net/bugs/1986592

[Marc Deslauriers (mdeslaur)]

Is there a server component to this, or is the only way to test this would be to own one or more of the hardware devices it supports?

[Luís Infante da Câmara (luis220413)]

For the .dsc file and for the changes file for a clean build of the version in Ubuntu 22.04, Lintian produces the following output:

W: libopenconnect5: changelog-distribution-does-not-match-changes-file (unstable != jammy)
W: openconnect changes: distribution-and-changes-mismatch jammy unstable
W: openconnect-dbgsym: elf-error In program headers: Unable to find program interpreter name [usr/lib/debug/.build-id/a5/fc497c0f65bab64bdce73773ab564fa69d14a8.debug]
N: 1 hint overridden (1 error); 0 unused overrides

[Luís Infante da Câmara (luis220413)]

There is a server component to this at least for some of the supported VPN types. Furthermore, the ocserv binary package in Ubuntu provides a server that is compatible with Cisco AnyConnect VPN clients.

However, for other VPN types, the only way to completely test this package for those types would be to own one or more of the corresponding hardware devices for each type.

[Launchpad Janitor (janitor)]

[Expired for openconnect (Ubuntu) because there has been no activity for 60 days.]

[Luís Infante da Câmara (luis220413)]

I am reopening this bug for the same reason as bug #1986592, in https://bugs.launchpad.net/ubuntu/+source/network-manager-openconnect/+bug/1986592/comments/11.

[Mark Esler (eslerm)]

Setting to wontfix per @seb128's comment in https://bugs.launchpad.net/ubuntu/+source/network-manager-openconnect/+bug/1986592/comments/13