[MIR] libayatana-appindicator

[Sebastien Bacher]

* Availability

It's available on the Ubuntu supported architectures
https://launchpad.net/ubuntu/+source/libayatana-appindicator/0.5.5-2

The package is in sync with Debian

* Rationale

The source is a community maintained replacement for our current libappindicator. Debian has transitioned and we plan to follow their lead now, demoting libappindicator to universe until we can remove it from the archive.

The binary to promote is libappindicator3-1

The request is low priority, it's a target of opportunity transition, it doesn't need to land this cycle

* Security

There is no known security issues

https://security-tracker.debian.org/tracker/source-package/libayatana-appindicator
https://people.canonical.com/~ubuntu-security/cve/pkg/libayatana-appindicator.html
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libayatana-appindicator

* Quality assurance

The desktop team is going to subscribe to the package

https://launchpad.net/ubuntu/+source/libayatana-appindicator/+bugs
https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=libayatana-appindicator

The source depends on some outdated libraries but that's because there are still old applications needing it, that's already the case with our libappindicator so not a change of status

The package enables upstream tests during the build but some are currently failing (and the Debian package doesn't stop the build on errors), that has been reported to Debian https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982845 and needs to be resolved before promotion
The package doesn't provide autopkgtests, which has been reported to Debian . That's not a regression compared to our current libappindicator

Update, the tests issue has been resolved in Debian and Impish now

* Dependencies

Package: libayatana-appindicator3-1
Depends: libayatana-indicator3-7 (>= 0.6.0), libc6 (>= 2.4), libdbusmenu-glib4 (>= 0.4.2), libdbusmenu-gtk3-4 (>= 0.4.2), libglib2.0-0 (>= 2.37.3), libgtk-3-0 (>= 3.0.0)

libayatana-indicator3-7 is currently in universe and bug #1915693

* Standards compliance

current 4.5.1 standards-version, debhelper compat 13, dh style simple rules

* Maintenance

Upstream is active, the package is maintained in Debian and desktop team is going to sign up for Ubuntu

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Didier Roche-Tolomelli (didrocks)]

[Summary]
Some work needed on tests as told in the description, and recommendations before final MIR ack. We can take the time to get them fixed as the request is not urgent.
The code didn’t change that much compared to our original projects already in main. Think of demoting the ones we have when handling the transition (probably next cycle)

Notes:
We should only promote the libayatana-appindicator3* flavors, not libayatana-appindicator which are depending on gtk2.

Required TODO:
- Fix test issues as in the description.

Recommended TODO:
- There are quite some deprecation warnings, would be great to get those fixed upstream.

[Duplication]
There is one package that is providing the exact same functionality, but it will be replaced by that one.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
no -dev/-debug/-doc packages that need exclusion

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats
- does not open a port
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)

[Common blockers]
OK:
- does not FTBFS currently (apart from tests failing, see below)
- does have a test suite that runs at build time. Test suite is currently failing: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982845
   - test suite fails will fail the build upon error.
- does not have a test suite that runs as autopkgtest, but similar than current situation
- The package will have a team bug subscriber
- no translation present, but none needed for this case (user visible)?
- not a python/go package, no extra constraints to consider in that regard

Problems:
- Ensure test suite is fixed in debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982845

[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- symbols tracking is in place
- d/watch is present and looks ok
- Upstream update history is good
- Debian/Ubuntu update history is good
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far
- no massive Lintian warnings
- d/rules is rather clean even if support 2 builds (gtk2 and gtk3)
- Does not have Built-Using

[Upstream red flags]
OK:
- no Errors / few minor autotools warnings during the build (on tests). Tests are not built with -Werror, would be better to get that fixed.
- no incautious use of malloc/sprintf (as far as I can check it)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit, seed or libgoa-*
- not part of the UI for extra checks

Problems:
- There are quite some deprecation warnings, would be great to get those fixed upstream.

[Sebastien Bacher (seb128)]

Reported the depreciation upstream on https://github.com/AyatanaIndicators/libayatana-appindicator/issues/18 , though most of the items are due to the use of 'Gtk' because the project builds gtk2 libraries and gtk_status_icon_* by the nature of the project (there is no newer API to port to, GNOME just disagrees with status icons or indicators and recommend using notifications instead)

[Sebastien Bacher (seb128)]

@Didier, the tests have been fixed now in Debian and they changed to make the build success conditional to the results so the remainign items should be addressed, the fixed revision is in impish, https://launchpadlibrarian.net/536381793/buildlog_ubuntu-impish-amd64.libayatana-appindicator_0.5.5-3_BUILDING.txt.gz

[Didier Roche-Tolomelli (didrocks)]

Thanks for looking into those, MIR ack for me then! Feel free to promote once desktop-packages is subscribed.