source-contains-unsafe-symlink src/github.com/prometheus/procfs/fixtures/26231/exe

[Curtis Hovey]

A run of
    lintian -I --pedantic
across the juju-core source package reveals
    E: juju-core source: source-contains-unsafe-symlink src/github.com/prometheus/procfs/fixtures/26231/exe

This issue is in an upstream Go package. Either upstream needs fixing, or juju needs to patch, or possibly the juju-release-tools/make-release-tarfile script purges the unsafe link.

[Curtis Hovey (sinzui)]

I added juju-release-tools because
    lintian -I --pedantic
should have been run on the package the error raised.

[Curtis Hovey (sinzui)]

Alexis This issue a blocker to being in Ubuntu The engineers needs to decide how to correct the symlink. As they put the dangrous package into Juju, they need to decide how to remove it. If you advise for the release scripts to indiscriminately delete, they can. This is downstream summary of the issue

The source contains an unsafe symlink. If followed, the link will escape the source root. Note that all absolute symlinks are unconditionally considered "unsafe" in this case (unlike in binary packages).

Severity: serious, Certainty: possible

Check: cruft, Type: source

[Curtis Hovey (sinzui)]

<mgz> sinzui: yeah, seems to be, I see it referenced from the tests only - lets remove the whole fixtures dir?

[Curtis Hovey (sinzui)]

I reported https://github.com/prometheus/procfs/issues/29

[Richard Harding (rharding)]

Per sinzui:

upstream has decided to ignore our request. I think we can close this as Wont Fix. We will never ship their tests