Comment 19 for bug 1854362

I reviewed python-configshell-fb 1.1.fb25-1.1 as checked into focal. This
shouldn't be considered a full audit but rather a quick gauge of
maintainability.

python-configshell-fb provides a python library which is used for building
CLI based user-interfaces. Upstream appears healthy and responsive.

- CVE History:
  - None
- No security relevant Build-Depends
  - debhelper, dh-python, python3-all, python3-pyparsing, python3-setuptools, python3-six
- pre/post inst/rm scripts
  - These are fine - just the auto-generated ones by dh_python3 to
    py3compile on postinst and py3clean on prerm
- No init scripts
- No systemd units
- No dbus services
- No setuid binaries
- No binaries in PATH
- No sudo fragments
- No polkit files
- No udev rules
- No unit tests / autopkgtests
  - This will make doing any security updates hard to test...
- No cron jobs
- Clean build log

- No processes spawned
- File IO
  - Uses files for preferences and logging but these are all parameters to
    the library and not hard-coded
  - Preferences are saved and restored using pickle which could present a
    security issue since this does little sanity checking on formats etc -
    however this is done using a file-name provided by the user of the
    library and relative to the user's home directory so this is likely
    safe - although there is no use of umask() to ensure this file is not
    accessible by others so perhaps that at least should be employed
- Logging
  - Uses general python format strings etc - this is safe
- No environment variable usage
- No Use of privileged functions
- No Use of cryptography / random number sources etc
- No Use of temp files
- No Use of networking
- No Use of WebKit
- No Use of PolicyKit

Static analysis via bandit and Coverity does not show anything significant

Security team ACK for promoting python-configshell-fb to main however I
would be happier if some unit tests were added so that some testing can be
done for any future updates to ensure regressions are not introduced.