[MIR] libdisplay-info

[Jeremy Bícha]

[Availability]
The package libdisplay-info is already in Ubuntu universe.
The package libdisplay-info build for the architectures it is designed to work on.
It currently builds and works for all Ubuntu architectures except for i386 where it isn't needed
Link to package https://launchpad.net/ubuntu/+source/libdisplay-info

[Rationale]
- The package libdisplay-info is required in Ubuntu main as a build and runtime dependency of mutter. It is an optional dependency for mutter 46 but is expected to be a required dependency for mutter 47 (Ubuntu 24.10 will include mutter 47).
https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/3602

- The package libdisplay-info will generally be useful for a large part of our user base
- The binary package libdisplay-info needs to be in main for mutter to more effectively parse computer monitor display capabilities via the EDID protocol

- The package libdisplay-info is required in Ubuntu main no later than August 15 due to Ubuntu 24.10 Feature Freeze

[Security]
- No CVEs/security issues in this software in the past
- https://ubuntu.com/security/cve?package=libdisplay-info
- https://security-tracker.debian.org/tracker/source-package/libdisplay-info

- no `suid` or `sgid` binaries
- no executables in `/sbin` and `/usr/sbin`
- Packages do not install services, timers or recurring jobs
- Packages do not open privileged ports (ports < 1024).
- Packages do not expose any external endpoints
- Packages do not contain extensions to security-sensitive software (filters, scanners, plugins, UI skins, ...)

[Quality assurance - function/usage]
- The package works well right after install

[Quality assurance - maintenance]
- The package is maintained well in Debian/Ubuntu/Upstream and does not have too many, long-term & critical, open bugs
- Ubuntu https://bugs.launchpad.net/ubuntu/+source/libdisplay-info
- Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=libdisplay-info
- Upstream's bug tracker https://gitlab.freedesktop.org/emersion/libdisplay-info/-/issues

- The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
- The package runs a test suite on build time, if it fails it makes the build fail, link to build log https://launchpad.net/ubuntu/+source/libdisplay-info/0.1.1-2ubuntu2

- The package runs an autopkgtest, and is currently passing on all architectures (not run on i386)
https://autopkgtest.ubuntu.com/packages/libdisplay-info

- The package does have not failing autopkgtests right now

[Quality assurance - packaging]
- debian/watch is present and works
- debian/control defines a correct Maintainer field

- Lintian overrides are not present

- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies

- The package will be installed by default, but does not ask debconf questions

- Packaging and build is easy, link to debian/rules
https://salsa.debian.org/debian/libdisplay-info/-/blob/master/debian/rules

[UI standards]
- Application is not end-user facing (does not need translation or .desktop file)

[Dependencies]
- No further depends or recommends dependencies that are not yet in main

[Standards compliance]
- This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- The owning team will be Ubuntu Desktop (~desktop-packages) and I have their acknowledgement for that commitment

- This does not use static builds
- This does not use vendored code
- This package is not rust based

- The package has been built within the last 3 months in the archive
- Build link on launchpad: https://launchpad.net/ubuntu/+source/libdisplay-info/0.1.1-2ubuntu2

[Background information]
- The Package description explains the package well
- Upstream Name is libdisplay-info
- Link to upstream project https://gitlab.freedesktop.org/emersion/libdisplay-info

An additional binary packages has no reverse dependencies and can remain in universe:
libdisplay-info-bin

We intend to update libdisplay-info to 0.2 later in the cycle; it is a transition and needs to be coordinated.

[Jeremy Bícha (jbicha)]

W: libdisplay-info-bin: no-manual-page [usr/bin/di-edid-decode]

(We aren't promoting libdisplay-info-bin to main)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Lukas Märdian (slyon)]

Review for Source Package: libdisplay-info

[Summary]
libdisplay-info is still a relatively young project (with only 3 releases so
far), but seems to be well documented and tested (e.g. parser fuzzing). It can
be used for parsing & decoding EDID display data into human readable format.

MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.

This does not need a security review

List of specific binary packages to be promoted to main: libdisplay-info1
Specific binary packages built, but NOT to be promoted to main: libdisplay-info-bin

Notes:
#0 - The library parses EDID data, but commonly from trusted sources (kernel, sysfs).
     It looks well tested & fuzzed, so IMO we don't need security review here.
#1 - The project is still young, with only 3 releases so far and sporadic packaging updates.
     Upstream states "The public API is not yet stable." – The desktop team still wants to
     take it as a dependency, handle any changes necessary due to unstable API and help with
     maintenance.

Required TODOs:
#2 - the current release is not packaged: We have v0.2.0 as of mid-June

Recommended TODOs:
#3 - The package should get a team bug subscriber before being promoted
#4 - does have a non-trivial test suite that runs as autopkgtest
   => simply re-running build-time tests, consider testing against the pre-built binaries
#5 - Ubuntu does carry a delta
   => try upstreaming the tests, debian/watch and debhelper changes
#6 - Upstream & Debian/Ubuntu update history is sporadic consider helping with maintenance, see #1
#7 - Warnings during build, consider helping to fix some of them:
../gtf.c:116:12: warning: ‘pixel_freq’ may be used uninitialized [-Wmaybe-uninitialized]
../gtf.c:114:40: warning: ‘h_blank_pixels’ may be used uninitialized [-Wmaybe-uninitialized]
../gtf.c:113:44: warning: ‘total_pixels’ may be used uninitialized [-Wmaybe-uninitialized]
../gtf.c:112:22: warning: ‘v_sync_bp’ may be used uninitialized [-Wmaybe-uninitialized]
../di-edid-decode/edid.c:500:51: warning: ‘hratio’ may be used uninitialized [-Wmaybe-uninitialized]
../di-edid-decode/edid.c:500:61: warning: ‘vratio’ may be used uninitialized [-Wmaybe-uninitialized]

[Rationale, Duplication and Ownership]
- There is no other package in main providing the same functionality.
  => Some provide similar functionality, but not in "main":
     $ rmadison -c main {edid-decode,libparse-edid-perl,read-edid,wxedid}
- A team is committed to own long term maintenance of this package.
- The rationale given in the report seems valid and useful for Ubuntu

[Dependencies]
OK:
- no other Dependencies to MIR due to this
  - SRCPKG checked with `check-mir`
  - all dependencies can be found in `seeded-in-ubuntu` (already in main)
  - none of the (potentially auto-generated) dependencies (Depends
    and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

Problems: None

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does ...

[Daniel van Vugt (vanvugt)]

FTR, both bug 2066080 and bug 2063147 are dependent on this.