MIR for celt

[Steve Kowalik]

Binary package hint: celt

1. Availability: http://archive.ubuntu.com/ubuntu/pool/universe/c/celt; available for all supported architectures and hppa

2. Rationale:
    * Build dependency of opal

3. Security:
    * No CVE entries: http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=celt
    * No Secunia history: http://secunia.com/search/?search=celt
    * No binaries running as root or suid/sgid ? And no daemons ?
    * No Network activity
    * Yes, it directly processes binary data (audio).
    * No source code review.

4. Quality assurance:
    * Package works OOTB.
    * No debconfage.
    * Debian bugs: http://bugs.debian.org/cgi-bin/pkgreport.cgi?src=celt ; asking for 0.5, which Ubuntu has.
    * Maintenance in Debian looks to be dead.
    * Upstream is vigorous.
    * Can't find upstream bug tracker: https://trac.xiph.org/search?q=celt
    * Package doesn't deal with hardware.
    * There looks to be a test suite in the upstream source, and it isn't enabled to run during the build.

5. UI standards:
    * User-visible strings are internationalized using standard gettext system ? Yes
    * Package with translatable strings builds a PO template during package build ? Doesn't seem to.
    * End-user applications ship a desktop file ? No.

6. Standards compliance:
    * FHS, Debian Policy compliance ? Yes.
    * Packaging system (debhelper/cdbs/dbs) ? Bog-standard debehlper, no patch system or oddities.

7. Dependencies:
    * Build-Depends are libogg-dev, graphviz and doxygen which are all in main.

8. Maintenance:
    * How much maintenance is this package likely to need ? Not much.
    * Who is responsible for monitoring the quality of this package and fixing its bugs ? Are they Ubuntu or Debian developers ?

9. Background information:
    * The general purpose and context of the package should be clear from the package's debian/control file. If it isn't then please explain.
    * What do upstream call this software ? celt or celt-codec.

10. Internationalization:
    * Are graphical applications translatable? Do they support gettext? No graphical applications.

[Loïc Minier (lool)]

Packaging looks ok; copyright doesn't cover some files in tools, but this is minor (one author not listed and the glibc files don't seem to be used during our build).

Some unchecked fread/fwrite warnings when building celtdec/celtenc could probably be fixed.

You say "maintenance in Debian appears to be dead", and you don't answer to "Who is responsible for monitoring the quality of this package and fixing its bugs ? Are they Ubuntu or Debian developers ?". So perhaps people committed to opal's maintenance can commit to the maintenance of celt? Could you get an ack on this?

Would be nice to enable the testsuite.

There's a new upstream version available too.

[Loïc Minier (lool)]

The README claims the bitstream isn't final yet; I'm not sure it's a good idea to include this codec in opal if it has the potential to be used in ekiga: users from karmic's ekiga calling users of karmic+1's ekiga wont be able to detect that even if they support the same codec, it's not the same bitstream -- or is there some way to avoid that?

[Steve Kowalik (stevenk)]

After discussions with the Debian maintainer of celt, and it being pointed out that upstream have yet to finalize the library itself or the bitstream used, I have uploaded a new version of opal that doesn't use celt.