[needs-packaging] lenovo-wwan-unlock

Bug #2058622 reported by Dirk Su
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OEM Priority Project
Confirmed
Critical
Dirk Su
lenovo-wwan-unlock
New
Undecided
Unassigned
Ubuntu
New
Wishlist
Unassigned

Bug Description

[Availability]
The package lenovo-wwan-unlock build for the architectures it is designed to work on.
It currently builds and works for architectures: amd64
Link to package https://launchpad.net/ubuntu/+source/lenovo-wwan-unlock

[Rationale]
 - The package lenovo-wwan-unlock is required in Ubuntu multiverse for WWAN hardware support
 - The package lenovo-wwan-unlock will generally be useful for a large part of
   our user base
 - There is no other/better way to solve this that is already in main or
   should go universe->main instead of this.
 - It would be great and useful to community/processes to have the
   package lenovo-fccunlock and lenovo-cfgservice in Ubuntu restricted, but there is no definitive deadline.

[Security]
 - No CVEs/security issues in this software in the past
 - no `suid` or `sgid` binaries
 - Binary configservice_lenovo and DPR_Fcc_unlock_service in /opt/fcc_lenovo/ is no problem because AppArmor constraints applied
 - Package does install services, timers or recurring jobs
   lenovo-fccunlock.service
   lenovo-cfgservice.service
 - Security has been kept in mind and common isolation/risk-mitigation
   patterns are in place utilizing the following features:
   AppArmor constraints had been included:
   - opt.fcc_lenovo.DPR_Fcc_unlock_service
   - opt.fcc_lenovo.configservice_lenovo
- Packages does not open privileged ports (ports < 1024).
- Packages does not expose any external endpoints
- Packages does not contain extensions to security-sensitive software
   (filters, scanners, plugins, UI skins, ...)

[Quality assurance - function/usage]
 - The package works well right after install

[Quality assurance - maintenance]
 - The package is maintained well in Debian/Ubuntu/Upstream and does
   not have too many, long-term & critical, open bugs
   - https://github.com/lenovo/lenovo-wwan-unlock/issues
 - The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
 - The package does not run a test at build time because it contains only binary files

 - The package can not be well tested at build or autopkgtest time
   because it will need real hardware for testing. To make up for that:
   - We have access to such hardware in the team
 - Based on that access outlined above, here are the details of the
   test plan
      execute service by systemd command
   sudo systemctl start lenovo-fccunlock
   sudo systemctl start lenovo-cfgservice
   and (if already possible) example output of a test run:
     - output of lenovo-fccunlock: https://pastebin.ubuntu.com/p/nsFBW3jXDk/
  - output ot lenovo-cfgservice: https://pastebin.ubuntu.com/p/8rCFqRHQ8V/
   We will execute that test plan
   on-uploads

[Quality assurance - packaging]
 - debian/watch is not present because it is a native package and need to add
   AppArmor configs
 - debian/control defines a correct Maintainer field

 - This package does not yield massive lintian Warnings, Errors
 - Please link to a recent build log of the package
   https://launchpadlibrarian.net/719472309/buildlog_ubuntu-noble-amd64.lenovo-wwan-unlock_1.2ubuntu3-0~202403150905~ubuntu24.04.1_BUILDING.txt.gz
 - Please attach the full output you have got from
   `lintian --pedantic` log: https://pastebin.ubuntu.com/p/Mm6CX7QgFc/
 - Lintian overrides are not present

 - This package does not rely on obsolete or about to be demoted packages.
 - This package has no python2 or GTK2 dependencies
 - The package will not be installed by default

 - Packaging and build is easy, link to debian/rules
   https://git.launchpad.net/lenovo-wwan-unlock/tree/debian/control

[UI standards]
 - Application is not end-user facing (does not need translation)

[Dependencies]
 - No further depends or recommends dependencies that are not yet in main

[Standards compliance]
 - This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
 - The owning team will be canonical-mainstream and I have their acknowledgement for
   that commitment
 - The future owning team is already subscribed to the package

 - This does not use static builds
 - This does not use vendored code
 - This package is not rust based

- The package was test rebuilt in PPA or sbuild recently
  PPA: https://launchpad.net/~dirksu/+archive/ubuntu/fccunlock-test

[Background information]
 The Package description explains the package well
 Upstream Name is lenovo-wwan-unlock
 Link to upstream project https://github.com/lenovo/lenovo-wwan-unlock

Dirk Su (dirksu)
Changed in ubuntu:
importance: Undecided → Wishlist
Dirk Su (dirksu)
tags: added: oem-priority originate-from-1956804 sutton
Changed in oem-priority:
assignee: nobody → Dirk Su (dirksu)
status: New → Confirmed
Revision history for this message
Lucas Kanashiro (lucaskanashiro) wrote :

Hi Dirk Su,

If I understood correctly, what you want here is someone to sponsor the upload of lenovo-wwan-unlock, and this is the git repo with the source package:

https://launchpad.net/ubuntu/+source/lenovo-wwan-unlock

Did I get it right?

You added the MIR bug description template here and it seems a bit confusing.

Dirk Su (dirksu)
tags: added: needs-packaging
Revision history for this message
Dirk Su (dirksu) wrote :

Hi Lucas Kanashiro,

The source git repo is at https://git.launchpad.net/lenovo-wwan-unlock.
This package been requested to go through normal review & sponsorship into multiverse. Will you suggest to use different template in the description.

Revision history for this message
Lucas Kanashiro (lucaskanashiro) wrote :

Hi Dirk Su,

I cloned the git repo and for instance the debian/changelog is confusing, there are many entries which makes me think that this package is already maintained somewhere else, is this maintained in a PPA and now you are trying to put it in the Ubuntu archive? When the package is landing for the first time in the Ubuntu archive we usually have just a single changelog entry.

The version string you are using does not seem correct. Right now, I see version 1.2ubuntu3. This version string could be used for a native package (something Ubuntu specific), but I see this a project from Lenovo and it is maintained here:

https://github.com/lenovo/lenovo-wwan-unlock

I'd expect a version similar to 2.0.0-0ubuntu1 (version 2.0.0 was releases 2 weeks ago in the repo above). So before the '-' we have the upstream version. And after that, we have the Debian revision, since this package is not in Debian, just in Ubuntu, we use '0ubuntu1'.

I did not read the proprietary license of this software, but in debian/copyright you are using the GPL-3 license for the debian directory. Could you make sure this is OK?

I am also unsure how to generate the tarball for this version, due to that I was not able to build the package and run lintian for instance. However, I think you already have something to work on. I am unsubscribing ~ubuntu-sponsors for now. Once you address the issues presented above subscribe ~ubuntu-sponsors again.

Revision history for this message
Dirk Su (dirksu) wrote :

Hi,

I packed version v2.0.0 and upload to the git repo. The files under debian folder are all created by Canonical, I think it should be no problem using GPL-3 license.

Revision history for this message
Dirk Su (dirksu) wrote :
Revision history for this message
Dirk Su (dirksu) wrote :
Dirk Su (dirksu)
Changed in oem-priority:
importance: Undecided → Critical
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.