© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
1b1ed1a
(Get the code!)
Review for Package: src:isc-kea
[Summary]
isc-kea is a DHCP (v4/v6) server replacement for the deprecated isc-dhcp. Kea
seems to be the logical path forward, but we need a migration path for all the
current consumers of isc-dhcp (Server & CLIENT!) and maybe also dnsmasq (to
consolidate all around Kea).
MIR team ACK under the constraint to resolve the below listed required
TODOs and as much as possible having a look at the recommended TODOs.
This does need a security review, so I'll assign ubuntu-security
List of specific binary packages to be promoted to main: kea, kea-admin, kea-common, kea-ctrl-agent, kea-dev, kea-dhcp-
Specific binary packages built, but NOT to be promoted to main: None
Notes:
- We need a migration path for all the current consumers of isc-dhcp
(Server & CLIENT!) and maybe also dnsmasq (to consolidate all around Kea):
$ reverse-depends src:isc-dhcp -c main
Reverse-Recommends
* avahi-autoipd (for isc-dhcp-client)
Reverse-Depends
* cloud-init (for isc-dhcp-client)
* network-manager [amd64 arm64 armhf ppc64el s390x]
* ubuntu-minimal [amd64 arm64 armhf ppc64el s390x]
* walinuxagent [amd64 arm64] (for isc-dhcp-client)
$ reverse-depends src:dnsmasq -c main
Reverse-Recommends
* libvirt-
* network-manager [amd64 arm64 armhf ppc64el s390x]
Reverse-Depends
* neutron-dhcp-agent (for dnsmasq-utils)
* neutron-dhcp-agent (for dnsmasq-base)
Required TODOs:
#0 State a plan of how to migrate the existing reverse-deps from
isc-
#1 resolve src:log4cplus MIR (LP: #2003549)
#2 avoid pulling in external Mathjax Javascript via kea-docs
(hooks.html & umls.html via https:/
#3 provide DEP3-autopkgtests (LP: #1863102)
#4 update to most recent version (LP: #1023018, Debian #1023018)
#5 implement symbols tracking for all the .so libraries shipped by kea-common
#6 fix important (wrt. security) /tmp sockets bug (LP: #1863100, Debian: #1014929)
Recommended TODOs:
#7 work with upstream to resolve buildtime warnings (-Wdeprecated-
-Warray-bounds, -Wstringop-
LD_LIBRARY_PATH) => see below
#8 double check embedded sources (ext/{coroutine
src/
and/or minimal (i.e. not shipped by another package in the archive)
#9 double-check build-time unit tests, dh_auto_test seems to skip most
#10 Fix some lintian warnings (see below):
W: kea-dev: package-
W: kea-doc: privacy-
I: kea-admin: hardening-
I: kea-common: no-symbols-
X: kea-dhcp4-server: systemd-
=======
= DETAILS
=======
[Duplication]
There are other packages in main providing the same functionality and even more
in universe:
- https:/
- https:/
- https:/
- https:/
- https:/
- https:/
Problems:
- What is the migration path to reduce the set of supported packages (especially
isc-dhcp and dnsmasq)?
- Kea should probably replace src:isc-dhcp, but how do we replace the
isc-dhcp-client component?
[Dependencies]
OK:
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
more tests now.
Problems:
- other Dependencies to MIR due to this:
* The kea-common binary shows a dependency on liblog4cplus-2.0.5 (src:log4cplus) via the liblog4cplus-dev build-dependency (bug #2003549)
[Embedded sources and static linking]
OK:
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard
Problems:
- embedded source present:
ext/coroutine/
ext/gtest/
src/lib/asiodns/
src/lib/asiolink/
src/lib/cryptolink/
src/lib/util/
[Security]
OK:
- history of CVEs does not look concerning (upstream is handling them properly)
- does not use webkit1,2
- does not use lib*v8 directly
- does not process arbitrary web content
- does not use centralized online accounts
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
Problems:
- does integrate arbitrary javascript into the desktop:
kea-doc: usr/share/
- does run a daemon as root
- does parse data formats (network packets) from an untrusted source
- does not open a port/socket
- does deal with cryptography (--with-openssl in d/rules)
[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- This does not need special HW for build or test
- no new python2 dependency
Problems:
- does not have a non-trivial test suite that runs as autopkgtest
- many unit-tests seem to be skipped?
Most tests/ directories log something like this during dh_auto_test:
==================
All 0 tests passed
==================
[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- d/watch is present and looks ok (if needed, e.g. non-native)
- Upstream update history is good
- Debian/Ubuntu update history is good
- promoting this does not seem to cause issues for MOTUs that so far
maintained the package
- d/rules is rather clean
- It is not on the lto-disabled list
Problems:
- the current release is not packaged (2.2.0 -> 2.3.3, about 6 months behind,
see Debian #1023018)
- symbols tracking is not in place: kea-common/kea-dev is shipping a bunch of
public ".so" libraries and their corresponding symlinks, with not symbols
tracking in place
- Lintian warnings:
W: kea-dev: package-
W: kea-doc: privacy-
I: kea-admin: hardening-
I: kea-common: no-symbols-
X: kea-dhcp4-server: systemd-
[Upstream red flags]
OK:
- no Errors during the build
- no incautious use of malloc/sprintf (as far as we can check it)
- no use of sudo, gksu, pkexec
- no use of user nobody
- no use of setuid
- no dependency on webkit, qtwebkit, seed or libgoa-*
- not part of the UI for extra checks
- no translation present, but none needed for this case (user visible)?
Problems:
- some bug reports of interest:
* https:/
* https:/
* https:/
- use of LD_LIBRARY_PATH (see src/share/
- Warnings during the build:
* encode/
* /usr/include/
* /usr/include/
* ../../.
* ../../.