MIR for moblin-applets

[Steve Kowalik]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

MIR for libmokoui2

1. Availability:
http://archive.ubuntu.com/ubuntu/pool/universe/libm/libmokoui2;
available for all supported architectures
2. Rationale: Dependancy of moblin-applets and moblin-media
3. Security:
   * No CVE entries:
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libmokoui2
   * No history in Secunia: http://secunia.com/search/?search=libmokoui2
   * No suid/sgid binaries or daemons.
   * No network access.
4. Quality assurance:
   * Package works out of the box.
   * No debconf questions.
   * Package is not in Debian.
   * Upstream is calm.
   * Upstream bug tracker is at http://bugzilla.openmoko.org ; no bugs
reported
   * Does not deal with hardware directly.
   * No test suite.
5. Standards compliance:
   * Compiles with FHS, and Debian Policy.
   * CDBS using debhelper, simple-patchsys patch system and no oddities.
6. Dependencies:
   * All Build-Depends and Depends are in main.

MIR for moblin-applets

1. Availability:
http://archive.ubuntu.com/ubuntu/pool/universe/m/moblin-applets;
available for all supported architectures
2. Rationale: Seeded by mobile.
3. Security:
   * No CVE entries:
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=moblin-applets
   * No history in Secunia: http://secunia.com/search/?search=moblin-applets
   * No suid/sgid binaries or daemons.
   * No network access.
4. Quality assurance:
   * Package works out of the box.
   * No debconf questions.
   * Package is not in Debian.
   * Upstream is vigorous.
   * Upstream is Intel, and they use Launchpad for bug reports.
   * Does not deal with hardware directly.
   * No test suite.
5. Standards compliance:
   * Compiles with FHS, and Debian Policy.
   * Package uses debhelper, with CDBS' simple-patchsys and no oddities.
6. Dependencies:
   * All Build-Depends and Depends aside from libmokoui2 are in main,
included.

 affects ubuntu/libmokoui2
 affects ubuntu/moblin-applets
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFICFtZCfB0CMh//C8RAud2AKDHI89Gc4KskNElVQmY5Rafaxfl6ACgynnt
0vXpEOnnmtgVZZd4GU8v1Ig=
=Ad7c
-----END PGP SIGNATURE-----

[Matthias Klose (doko)]

libmokoui2-vala:

 - missing X[BS]-PythonVersion in debian/control
 - libmokoui2-vala must stay in universe (valac dependency)

ok to promote with the debian/control change

[Matthias Klose (doko)]

moblin-applets:
 - capplets/common/launcher.c: char applet[1024]; command line args are written in this buffer ...
 - moblin-system-daemon/calibrator.cpp: assume that getxorgconf() returns something > 512, then cmd in editxorgconf will overflow
 - libvolumecontrol/volume.c: name, message overflows in process_elements?
 - other buffers with fixed size 1000, but those are filled with short enough strings

copyright & packaging look ok.

[Steve Kowalik (stevenk)]

libmokoui2 0.3+bzr20080407-0ubuntu2 has been uploaded, which adds the X[BS]-Python-Version fields.

[Martin Pitt (pitti)]

libmokoui2-dev libmokoui2-doc, and source promoted.

[Martin Pitt (pitti)]

Closing due to inactivity. Please reopen if you still want/need this and the identified problems were fixed. Thank you!