[MIR] libcupsfilters libppd cups-browsed

[Till Kamppeter]

========== Summary =========================

Source packages to be promoted to Main:
- libcupsfilters
- libppd
- cups-browsed

Binary packages to be promoted to Main:
- libcupsfilters2
- libcupsfilters2-common
- libppd-dev
- libppd2
- libppd2-common
- ppdc

No source packages and no binary packages which are in Main should get demoted to Universe.

========== Overview ========================

Due to a major change in the printing architecture [1] the
cups-filters upstream project at OpenPrinting got split into 5
components [2]:

- libcupsfilters
- libppd
- cups-filters
- braille-printer-app
- cups-browsed

[1] https://openprinting.github.io/current/#the-new-architecture-for-printing-and-scanning
[2] https://openprinting.github.io/cups-filters-Second-Generation-First-Beta-Release/

To reflect this in the Debian/Ubuntu packaging also the cups-filters
source package there is getting split, rendering 3 new source
packages (+) and therefore we need this MIR:

Binaries: Source BEFORE (1.x) Source AFTER (2.x)
---------------------------------------------------------------------
cups-browsed cups-filters cups-browsed +
cups-filters cups-filters cups-filters
cups-filters-core-drivers cups-filters cups-filters
libcupsfilters-dev cups-filters libcupsfilters +
libcupsfilters1 X cups-filters Replaced by
                                                  libcupsfilters2 *
libcupsfilters2 + libcupsfilters + (NEW)
libcupsfilters2-common + libcupsfilters + (NEW)
libfontembed-dev X cups-filters REMOVED **
libfontembed X cups-filters REMOVED **
libppd-dev + libppd + (NEW) ***
libppd2 + libppd + (NEW) ***
libppd2-common + libppd + (NEW) ***
ppdc + libppd + (NEW) ***

* : libcupsfilters has new API generation/SONAME 1 -> 2
** : libfontembed code folded into libcupsfilters, API removed, no other
     package is using it.
***: libppd contains all PPD-supporting code of CUPS, as in CUPS 3.x
     this code will get removed. libppd is for legacy-retro-fitting of
     classic CUPS drivers with PPD files. Code comes from CUPS source:
     cups/ppd*.[ch], scheduler/cups-driverd.cxx, ppdc/*
X: Binary package getting REMOVED from Lunar
+: Source or binary package to be promoted to Main via this MIR

The purposes of the new generation's binary packages are principally
the same as before:

- cups-browsed: Daemon to auto-create queues for network printers and to
                form printer clusters
- cups-filters: Print data format conversion filters and printer
                communication backends for CUPS 2.x - Complete set
- cups-filters-core-drivers: Print data format conversion filters and
                printer communication backends for CUPS 2.x - Essential
                ones for minimum configurations, like mobile or IoT
- libcupsfilters-dev: C Header files for libcupsfilters2
- libcupsfilters2: Shared library containing common code for print data
                conversion filters, printer drivers, printer model
                identification and distinction, PDF file manipulation,
                PDF font embedding, color space conversion, ...
- libcupsfilters2-common: Architecture-indpendent auxiliary files
- libppd2-dev: C Header files for libppd2
- libppd2: Shared library for support of PPD files, parsing the
                files, converting PPD options into IPP attributes,
                managing collections of PPDs, finding PPD for given
                printer, generating PPDs from CUPS' *.drv files
- libppd2-common: Architecture-indpendent auxiliary files
- ppdc: Command line tools to generate PPD files from *.drv
                files (only for development and debugging, or to
                keep scripts using them working, not end-user-facing)

--> ALL THESE BINARY PACKAGES MUST BE IN MAIM, SO THE FOLLOWING BINARY
    PACKAGES NEED TO GET PROMOTED:

      - libcupsfilters2
      - libcupsfilters2-common
      - libppd-dev
      - libppd2
      - libppd2-common
      - ppdc

For current CUPS (2.x, provided by Debian packages) there is actually
no change. CUPS depends on cups-filters ("cups" binary on
"cups-filters" binary and "cups-core-drivers" binary on
"cups-filters-core-drivers") to get its filters and additional
backends which it needs for actual printing, now the new-generation
cups-filters. The new "cups-filters" and "cups-filters-core-drivers"
depend on "libcupsfilters2" and "libppd2" providing the common
functionality they need. "cups-browsed" is recommended by
"cups-daemon". I do not know whether any of these packages is also
seeded and whether the recommend of "cups-browsed" by "cups-daemon" is
strong enough to pull "cups-browsed" into Main when the MIR is
approved.

cups-core-drivers
  |
  +--Depends--> cups-filters-core-drivers
                  |
    +--Depends--> libcupsfilters2
    +--Depends--> libppd2
                    |
      +--Depends--> libcupsfilters2

cups
  |
  +--Depends--> cups-filters
                  |
    +--Depends--> cups-filters-core-drivers
    +--Depends--> libcupsfilters2
    +--Depends--> libppd2
                    |
      +--Depends--> libcupsfilters2

cups-daemon
  |
  +--Recommends--> cups-browsed
                     |
       +--Depends--> libcupsfilters2
       +--Depends--> libppd2
         |
         +--Depends--> libcupsfilters2

--> SO NO NEW DEPENDENCIES IN PACKAGES ALREADY EXISTING
    IN MAIN AND NO NEW SEEDS ARE NEEDED TO ACTUALLY GET EVERYTHING
    INTO MAIN AFTER THE APPROVAL OF THIS MIR.

As one can see from the table above, the former SOURCE package cups-filters is
replaced by 4 SOURCE packages now:

- libcupsfilters +
- libppd +
- cups-filters
- cups-browsed +

--> ALL THESE SOURCE PACKAGES NEED TO BE IN MAIN, THE ONES WITH + NEED
    TO GET PROMOTED.

--> CUPS-FILTERS IS ALREADY IN MAIN AND IT SHOULD CONTINUE IN MAIN.

The braille-printer-app package is not yet completed upstream. As soon
as this is done, it will also get uploaded to Ubuntu and a MIR for it
posted.

The splitting upstream is done to prepare for the New Architecture of
printing, where printer drivers are not filters and PPD files any more
but emulators of driverless IPP printers (Printer Applications). So a
standard system installation does not need PPD file support any more,
so we needed to completely separate the PPD file support code of CUPS
and cups-filters into one optionally installable library but conserver
as much as possible of the still valuable PPD-independent code in
cups-filters, of 20 years of development and experience. Also filters
need to get more accesible for Printer Applications, therefore we
turned the former individual executables into library functions, the
filter functions.

With the introduction of libppd all use of libcups is now restricted
to functionality which does not support PPD files and therefore will
continue to be in libcups of CUPS 3.x ([1], future libcups3 binary
package to appear in Ubuntu 24.04 LTS). This way we expect only small
changes for the transition from libcups2 to libcups3.

[1] https://github.com/OpenPrinting/libcups

So we have now:

libcupsfilters
--------------

All the internal functionality of the filters which formerly was in
the individual filter executables (cups-filters and
cups-filters-core-drivers binary packages, new source package
cups-filters) has moved into libcupsfilters (binary package
libcupsfilters2, new source package libcupsfilters) as filter
functions (source files cupsfilters/*to*.c*,
cupsfilters/ghostscript.c, cupsfilters/pdftopdf/*, infrastructure in
cupsfilters/filter.c, API in cupsfilters/filter.h).

The handling of printer capabilities (media sizes, margins, color
spaces, ...) and matching them with the jobs and job IPP attributes
got vastly improved (cupsfilters/ipp.[ch], cupsfilters/raster.[ch].)

Also API functions for handling human-readable strings/translations
for option and choice names got created
(cupsfilters/catalog.[ch]). The strings are taken from CUPS' message
catalogs and also downloaded from driverless IPP printers.

General functions for printers drivers, filters, color handling, PDF
handling, ... from the old libcupsfilters (old binary package
libcupsfilters1) got overtaken into the new libcupsfilters.

The new libcupsfilters DOES NOT CONTAIN ANY SUPPORT FOR PPD FILES ANY
MORE AND DOES NOT DEPEND ON LIBPPD.

libppd
------

All PPD support which one finds in Linux distros with a
CUPS/cups-filters printing stack is concentrated in libppd now. This
way having PPD file support is completely optional. The library only
needs to be installed if needed and being in a separate upstream repo
and seperate Debian packages its maintenance can be stopped at any
time while the maintenance and development of libcupsfilters
continues.

libppd (binary package libppd2, new source package libppd) is
currently used by cups-filters (new binary packages cups-filters and
cups-filters-core-drivers, new source package cups-filters) and
pappl-retrofit ([1], added to Ubuntu in the next days, used by Printer
Application which retro-fit classic CUPS drivers [2]). The former use
case is only for systems using CUPS 2.x, the latter is mainly for
systems in the New Architecture, using CUPS 3.x or the CUPS Snap
[3][4] as these require all printer drivers being Printer
Applications.

None of the packages of the new cups-filters generation, PAPPL [5],
pappl-retrofit, and the new (2.x) generation of CPDB [6] uses any
PPD-file supporting functionality of libcups, so that a smooth
transition to the libcups of CUPS 3.x is assured. Any PPD file support
needs for legacy driver retro-fitting are covered by libppd.

[1] https://github.com/OpenPrinting/pappl-retrofit
[2] https://openprinting.github.io/achievements/#all-free-drivers-in-a-ppd-less-world---or---all-free-drivers-in-snaps
[3] https://openprinting.github.io/achievements/#the-cups-snap
[4] https://github.com/OpenPrinting/cups-snap
[5] https://github.com/michaelrsweet/pappl/
[6] https://openprinting.github.io/achievements/#common-print-dialog-backends

The source code is nearly completely overtaken from the CUPS source
code: PPD file parsing and handling support in libcups (CUPS source:
cups/ppd*.[ch], libppd source: ppd/*.c, API: ppd/ppd.h), PPD file
collection handling and PPD file assignment to given printer (CUPS
source: scheduler/cups-driverd.cxx, libppd source:
ppd/ppd-collection.cxx, API: ppd/ppd.h), and generating PPD files from
*.drv files (CUPS source: ppdc/*, libppd source: ppd/ppdc*.cxx, API
ppd/ppdc.h). The PPD file generator for driverless printers
(ppd/ppd-generator.c) is not the one from libcups but the one from the
former libcupsfilters1, as that one supports generating the PPDs
needed by printer clusters formed by cups-browsed.

Some infrastructure got added for keeping PPD file support in the
filter executables of CUPS 2.x, in ppd/ppd-filter.c, ppd/ppd-ipp.c,
API is in ppd/ppd-filter.h. This infrastructure mainly parses the PPD
file and turns the content of the PPD file into printer IPP attributes
(what a driverless printer would respond when querying its
capabilities). This way the non-PPD-supporting filter functions of
libcupsfilters get to know the capabilities of the printer.

cups-filters
------------

We get practically the same binaries as we had before in the
cups-filters and cups-filters-core-drivers binary packages (old and
new source package cups-filters), but they have changed internally:

As told here earlier we have moved all the core functionality of the
CUPS filters into libcupsfilters to have it available as library
functions, the filter functions, so that they can be easily used by
Printer Applications. Therefore the actual filter executables used for
CUPS 2.x are only small wrappers which call a filter function to do
the "dirty work".

Only what does not make sense in the future PPD-less world keeps its
code in the cups-filters upstream project: Legacy CUPS backends
(backend/*), classic CUPS drivers (filter/*pclx*.c, filter/*escpx*.c),
and the "driverless" utility (utils/*).

A new feature is the "universal" CUPS filter (CUPS wrapper:
filter/universal.c, PPD support wrapper in libppd: ppd/ppd-filter.c,
core functionality in libcupsfilters: cupsfilters/universal.c). It
makes use of having all filters as library functions in libcupsfilters
to reduce the number of resource-consuming external executable calls
by CUPS. It converts printer from practically any input format to
practically any output format by calling chains of filter
functions. So CUPS calls a single filter, "universal" instead of a
chain of external filters.

cups-filters will only be needed as long as we are using CUPS 2.x from
Debian packages. If we have a distro using CUPS 3.x (planned from
24.04 LTS on) or the CUPS Snap (any CUPS version, planned from Ubuntu
23.10 on) cups-filters does not make sense any
more, as we cannot add filters or backends either because CUPS is
running from a sandboxed immutable image or does not support the
filter/backend concept any more.

cups-browsed
------------

The new cups-browsed binary package and the old one are practically
identical in functionality. It is only split into its own upstream
repository and with this into its own source Debian package for
consistency of the splitting of cups-filters and for major changes in
the future [1].

The actual source code suffered only changes for bug fixes and also
for adaptation to changes in the API of the new libcupsfilters.

It depends on the new libcupsfilters and also on libppd now. In the
future it will get turned into a Printer Application [1] and not
support and use PPD files any more, dropping the dependency on
libppd. As all the rest of the current code from OpenPrinting it only
uses non-PPD-supporting functionality of libcups, for a smooth
transition to CUPS 3.x.

[1] https://wiki.linuxfoundation.org/gsoc/google-summer-code-2023-openprinting-projects#turn_cups-browsed_into_a_printer_application

=== MIR REQUIREMENTS FOLLOWING TEMPLATE ====

https://github.com/canonical/ubuntu-mir

=== LIBCUPSFILTERS =========================

[Availability]

The package is uploaded to Ubuntu Universe:
https://launchpad.net/ubuntu/+source/libcupsfilters

It builds for the architectures it is designed to work on.

It currently builds and works for the architetcures:
  amd64, arm64, armhf, ppc64el, riscv64, s390x

[Rationale]

Generally, see the above under OVERVIEW for the rationale of this MIR and
the need of the packages in question in Main.

 - The package is required in Ubuntu Main as it is the libcupsfilters
   which the cups-filters 2.x source package does not contain any
   more, as it got separated into its own upstream source repo.
 - libcupsfilters is part of Ubuntu's printing stack.
 - libcupsfilters is part of the update of cups-filters from 1.x to 2.x
 - The packages libcupsfilters is a new runtime dependency of the
   package cups-filters that we already support

 - The packages is required in Ubuntu Main no later than FF of Lunar,
   as cups-filters 2.0~b2 is already uploaded to Lunar Main.

[Security]

Security vulnerabilities of cups-filters, which is the origin of the code
of libcupsfilters:

CVE: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=cups-filters
 - All vulnerabilities are fixed, version with fix mentioned in the list.
 - Last vulnerability is from 2015.
Openwall: 'site:www.openwall.com/lists/oss-security cups-filters'
 - Shows the same vulnerabilities as CVE
Ubuntu: https://ubuntu.com/security/cve?package=cups-filters
 - Shows the same vulnerabilities as CVE, none as not fixed in a supported
   Ubuntu release ("Not vulnerable", "Does not exist")

Remark: On all GitHub repositories of OpenPrinting I have activated
private bug reporting for security bugs this week. I only need to post
a News Flash to announce it.

 - no `suid` or `sgid` binaries
 - No sbin binaries in libcupsfilters

 - Packages libcupsfilters does not install services,
   timers or recurring jobs
 - Package does not open privileged ports (ports < 1024)
 - Package libcupsfilters provides the code for the filters run by
   CUPS as the user "lp", to process print jobs. Most of the code is
   the same as in the former cups-filters (1.x).

[Quality assurance - function/usage]

The transition from cups-filters 1.x to cups-filters 2.x with the new
source package libcupsfilters does not cause any user-facing
changes. All printing stack operations, as creating and modifying
print queues, configuring printers, printing files, ... work as
before.

The user will only perceive some improvements in printing results due to
improvements in internal code consistency, bug fixes, ...

 - The package works well right after install

[Quality assurance - maintenance]

 - The package is maintained well in Debian/Ubuntu and has not too many
   and long term critical bugs open
   - Ubuntu https://bugs.launchpad.net/ubuntu/+source/libcupsfilters/+bug
   - Ubuntu https://bugs.launchpad.net/ubuntu/+source/cups-filters/+bug
   - Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=cups-filters
   - Upstream: https://github.com/OpenPrinting/libcupsfilters/issues
   - Upstream: https://github.com/OpenPrinting/cups-filters/issues

   Note that the new package libcupsfilters is not yet introduced in
   Debian. It will get introduced to Debian Experimental
   soon. Unstable is in freeze for the Bookworm release.
 - The package does not deal with exotic hardware we cannot support
   (no printer drivers, only print data file format converters, output
    can be displayed with easily available, common free software tools:
    evince, Ghostscript, eog, rasterview)

[Quality assurance - testing]

 - The packages libcupsfilters runs test suites on build time, if they
   fail it makes the builds fail, link to build log
   - https://launchpad.net/ubuntu/+source/libcupsfilters/2.0~b2-0ubuntu10/+build/25524340/+files/buildlog_ubuntu-lunar-amd64.libcupsfilters_2.0~b2-0ubuntu10_BUILDING.txt.gz

 - The packages libcupsfilters runs autopkgtests, and is
   currently passing on all architectures listed under [Availability].
   The very first migration process did not yet finish for
   libcupsfilters
   https://people.canonical.com/~ubuntu-archive/proposed-migration/lunar/update_excuses.html#libcupsfilters
 - The package libcupsfilters does not have failing autopkgtests right now

[Quality assurance - packaging]
 - debian/watch is present and works
 - debian/control defines a correct Maintainer field

 - Build log:
   https://launchpad.net/ubuntu/+source/libcupsfilters/2.0~b2-0ubuntu10/+build/25524340/+files/buildlog_ubuntu-lunar-amd64.libcupsfilters_2.0~b2-0ubuntu10_BUILDING.txt.gz

 - This package does not yield massive lintian Warnings, Errors
 - This package has only
   P: libcupsfilters source: very-long-line-length-in-source-file 525 >
   512 [Makefile.in:1759]
   This is not a problem, Makefile.in is auto-generated by the autotools
   and the package builds without problems.
 - Lintian overrides are not present for libcupsfilters
 - This package does not rely on obsolete or about to be demoted
   packages.
 - This package has no python2 or GTK2 dependencies

 - This package will be installed by default, but does not ask debconf
   questions higher than medium
   - It does not ask debconf questions at all

 - Packaging and build is easy, debian/rules file attached.

[UI standards]

 - Application is not end-user facing (does not need translation)

[Dependencies]

 - No further depends or recommends dependencies that are not yet in
   main

[Standards compliance]

 - This package correctly follows FHS and Debian Policy

[Maintenance/Owner]

 - Owning Team will be Ubuntu Printing Team - ubuntu-printing
 - Team is already subscribed to this package

 - This does not use static builds
 - This does not use vendored code
 - This package is not rust based

 - The package has been built in the archive more recently than the last
   test rebuild

[Background information]

The Package descriptions explain the packages well
Upstream Name are libcupsfilters (unchanged)

Link to upstream projects:
 - https://github.com/OpenPrinting/libcupsfilters

=== LIBPPD =================================

[Availability]

The package is uploaded to Ubuntu Universe:
https://launchpad.net/ubuntu/+source/libppd

It builds for the architectures it is designed to work on.

It currently builds and works for the architectures:
  amd64, arm64, armhf, ppc64el, riscv64, s390x

[Rationale]

Generally, see the above under OVERVIEW for the rationale of this MIR and
the need of the packages in question in Main.

 - To be prepared for the removal of PPD support in CUPS 3.x,
   libcupsfilters does not contain any PPD file support any more. The
   PPD file support got moved into libppd and cups-filters 2.x which
   provides the filters for CUPS 2.x therefore needs libppd to
   maintain the PPD support in these filters.
 - libppd is part of Ubuntu's printing stack.
 - libppd is part of the update of cups-filters from 1.x to 2.x
 - libppd is a new runtime dependency of the package cups-filters that
   we already support

 - The package is required in Ubuntu Main no later than FF of Lunar,
   as cups-filters 2.0~b2 is already uploaded to Lunar Main.

[Security]

Security vulnerabilities of cups, which is the origin of the code
of libppd:

CVE: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=cups
 - All vulnerabilities are fixed, version with fix mentioned in the list.
Openwall: 'site:www.openwall.com/lists/oss-security cups'
 - Shows the same vulnerabilities as CVE
Ubuntu: https://ubuntu.com/security/cve?package=cups
 - Shows the same vulnerabilities as CVE, none as not fixed in a supported
   Ubuntu release ("Released", "Not vulnerable", "Does not exist")

Remark: On all GitHub repositories of OpenPrinting I have activated
private bug reporting for security bugs this week. I only need to post
a News Flash to announce it.

 - no `suid` or `sgid` binaries
 - No sbin binaries in libppd

 - Package libppd does not install services timers or recurring jobs
 - Package does not open privileged ports (ports < 1024)
 - Package libppd provides code for the filters run by CUPS as the
   user "lp", to process print jobs. Most of the code is the same as
   in libcups2.

[Quality assurance - function/usage]

The transition from cups-filters 1.x to cups-filters 2.x with the new
source package libppd does not cause any user-facing changes. All
printing stack operations, as creating and modifying print queues,
configuring printers, printing files, ... work as before.

The user will only perceive some improvements in printing results due to
improvements in internal code consistency, bug fixes, ...

 - The package works well right after install

[Quality assurance - maintenance]

 - The package is maintained well in Debian/Ubuntu and has not too many
   and long term critical bugs open
   - Ubuntu https://bugs.launchpad.net/ubuntu/+source/libppd/+bug
   - Ubuntu https://bugs.launchpad.net/ubuntu/+source/cups-filters/+bug
   - Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=cups-filters
   - Upstream: https://github.com/OpenPrinting/libppd/issues
   - Upstream: https://github.com/OpenPrinting/cups-filters/issues
   Note that the new package libppd is not yet introduced in
   Debian. It will get introduced to Debian Experimental
   soon. Unstable is in freeze for the Bookworm release.
 - The package does not deal with exotic hardware we cannot support
   (no printer drivers, only print data file format converters, output
    can be displayed with easily available, common free software tools:
    evince, Ghostscript, eog, rasterview)

[Quality assurance - testing]

 - The package libppd runs test suites on build time, if they fail it
   makes the builds fail, links to build log
   - https://launchpadlibrarian.net/648114885/buildlog_ubuntu-lunar-amd64.libppd_2%3A2.0~b2-0ubuntu8_BUILDING.txt.gz

 - The package libppd runs autopkgtests, and is currently passing on
   all architectures listed under [Availability].
   The very first migration process did not yet finish for both
   libppd
   https://people.canonical.com/~ubuntu-archive/proposed-migration/lunar/update_excuses.html#libppd
 - The packages libppd does not have failing autopkgtests right now

[Quality assurance - packaging]
 - debian/watch is present and works
 - debian/control defines a correct Maintainer field

 - Build log:
   https://launchpadlibrarian.net/648114885/buildlog_ubuntu-lunar-amd64.libppd_2%3A2.0~b2-0ubuntu8_BUILDING.txt.gz

 - These packages do not yield massive lintian Warnings, Errors
 - No lintian warnings or errors for libppd
 - Lintian overrides are not present for libppd
 - This package does not rely on obsolete or about to be demoted
   packages.
 - This package has no python2 or GTK2 dependencies

 - This package will be installed by default, but does not ask debconf
   questions higher than medium
   - It does not ask debconf questions at all

 - Packaging and build is easy, debian/rules files attached.

[UI standards]

 - Application is not end-user facing (does not need translation)
    - Executables in binary package ppdc are only for development and
      debugging, or to keep existing scripts running, so nothing for
      end users.

[Dependencies]
 - No further depends or recommends dependencies outside this MIR that
   are not yet in main
 - There are further dependencies that are not yet in main, the MIR
   process for them is handled as part of this bug here.
   - libppd depends on libcupsfilters -> in this same MIR

[Standards compliance]
 - This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- Owning Team will be Ubuntu Printing Team - ubuntu-printing
- Team is already subscribed to this package

- This does not use static builds
- This does not use vendored code
- This package is not rust based

- The package has been built in the archive more recently than the last
  test rebuild

[Background information]
The Package description explains the package well
Upstream Name is libppd (unchanged)
Links to upstream project:
 - https://github.com/OpenPrinting/libppd

=== CUPS-BROWSED ===========================

[Availability]

The package is uploaded to Ubuntu Universe:
https://launchpad.net/ubuntu/+source/cups-browsed

It builds for the architectures it is designed to work on.

It currently builds and works for the architetcures:
  amd64, arm64, armhf, ppc64el, riscv64, s390x

[Rationale]

Generally, see the above under OVERVIEW for the rationale of this MIR and
the need of the packages in question in Main.

 - The package is required in Ubuntu Main as it is the cups-browsed
   which the cups-filters 2.x source package does not contain any
   more, as it got separated into its own upstream source repo.
 - cups-browsed is part of Ubuntu's printing stack.
 - cups-browsed is part of the update of cups-filters from 1.x to 2.x
 - cups-browsed has to be in Main as, as before, it needs to overcome
   the lack of support for temporary CUPS queues in some print
   dialogs.

 - The package is required in Ubuntu Main no later than FF of Lunar,
   as cups-filters 2.0~b2 is already uploaded to Lunar Main.

[Security]

Security vulnerabilities of cups-filters, which is the origin of the code
of cups-browsed:

CVE: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=cups-filters
 - All vulnerabilities are fixed, version with fix mentioned in the list.
 - Last vulnerability is from 2015.
Openwall: 'site:www.openwall.com/lists/oss-security cups-filters'
 - Shows the same vulnerabilities as CVE
Ubuntu: https://ubuntu.com/security/cve?package=cups-filters
 - Shows the same vulnerabilities as CVE, none as not fixed in a supported
   Ubuntu release ("Not vulnerable", "Does not exist")

Remark: On all GitHub repositories of OpenPrinting I have activated
private bug reporting for security bugs this week. I only need to post
a News Flash to announce it.

 - no `suid` or `sgid` binaries
 - Binary /usr/sbin/cups-browsed (of package cups-browsed) in sbin is
   no problem. It is the cups-browsed which we already use for several
   years, provided by the cups-filters (1.x) source package.

   No actual changes have been done in the functionality of
   cups-browsed, only minor bug fixes. Changes in the underlying
   libraries (libcupsfilters, libppd) did not change the communication
   of cups-browsed with the outside world, but only improve the PPD
   files it uses and the reliability of a job being assigned to a
   destination printer in a cluster.

   The daemon listens to avahi-daemon (via D-Bus) to find out about IPP
   network printers (physical devices, remote CUPS queues, Printer
   Applications) appearing and disappearing and creates/removes/
   modifies print queues on the running CUPS appropriately. It also
   listens to CUPS on the D-Bus whether a new job got submitted
   and in case it being on a queue managed by cups-browsed tells
   to CUPS which is the destination printer.

   So it listens on the (system) D-Bus and submits administrative
   requests to CUPS (some kind of automatic, UI-less printer setup
   tool).

 - Package cups-browsed installs daemon, see above.
    - /usr/sbin/cups-browsed
      - Listens on system D-Bus (avahi-daemon, CUPS)
      - Applies administrative requests (creating/removing/modifying
        print queues) on CUPS
      - Has AppArmor profile
 - Package does not open privileged ports (ports < 1024)

[Quality assurance - function/usage]

The transition from cups-filters 1.x to cups-filters 2.x with the new
source package cups-browsed does not cause any user-facing
changes. All printing stack operations, as creating and modifying
print queues, configuring printers, printing files, ... work as
before.

The user will only perceive some improvements in printing results due to
improvements in internal code consistency, bug fixes, ...

 - The package works well right after install

[Quality assurance - maintenance]

 - The package is maintained well in Debian/Ubuntu and has not too many
   and long term critical bugs open
   - Ubuntu https://bugs.launchpad.net/ubuntu/+source/cups-browsed/+bug
   - Ubuntu https://bugs.launchpad.net/ubuntu/+source/cups-filters/+bug
   - Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=cups-filters
   - Upstream: https://github.com/OpenPrinting/cups-browsed/issues
   - Upstream: https://github.com/OpenPrinting/cups-filters/issues
   Note that the new package cups-browsed is not yet introduced in
   Debian. It will get introduced to Debian Experimental
   soon. Unstable is in freeze for the Bookworm release.
 - The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]

 - The package cups-browsed does not run a test at build time because
   as it was part of cups-filters there was no testing of the
   cups-browsed daemon.

 - The package cups-browsed does not run an autopkgtest because when
   cups-browsed was still part of cups-filters there was no autopkgtest,
   especially not for the cups-browsed daemon.

[Quality assurance - packaging]
 - debian/watch is present and works
 - debian/control defines a correct Maintainer field

 - Build log:
   https://launchpadlibrarian.net/647984146/buildlog_ubuntu-lunar-amd64.cups-browsed_2.0~b2-0ubuntu4_BUILDING.txt.gz

 - This package does not yield massive lintian Warnings, Errors
 - No lintian warnings or errors at all for cups-browsed
 - Lintian overrides are present for cups-browsed, but ok because
   CUPS needs the special permissions and directory for its backends

   # Upstream choices; they need to be run as root
   cups-browsed: executable-is-not-world-readable usr/lib/cups/backend/implicitclass 0700
   # That's how CUPS does it
   cups-browsed: executable-in-usr-lib usr/lib/cups/backend/implicitclass

 - This package does not rely on obsolete or about to be demoted
   packages.
 - These package has no python2 or GTK2 dependencies

 - This package will be installed by default, but does not ask debconf
   questions higher than medium
   - It does not ask debconf questions at all

 - Packaging and build is easy, debian/rules file attached.

[UI standards]

 - Application is not end-user facing (does not need translation)

[Dependencies]
 - No further depends or recommends dependencies outside this MIR that
   are not yet in main
 - There are further dependencies that are not yet in main, the MIR
   process for them is handled as part of this bug here.
   - libppd depends on libcupsfilters -> in this same MIR
   - cups-browsed depends on libcupsfilters and libppd -> in this same
     MIR

[Standards compliance]
 - This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- Owning Team will be Ubuntu Printing Team - ubuntu-printing
- Team is already subscribed to all the packages

- This does not use static builds
- This does not use vendored code
- This package is not rust based

- The package has been built in the archive more recently than the last
  test rebuild

[Background information]
The Package description explains the package well
Upstream Name is cups-browsed (unchanged)
Links to upstream projects:
 - https://github.com/OpenPrinting/cups-browsed

========== Original Description ============

This is a simplified MIR for the splitting of the cups-filters source package.

With the second generation (2.x) cups-filters upstream got split into 5 independent component repositories:

- libcupsfilters
- libppd
- cups-filters
- braille-printer-app
- cups-browsed

See

https://openprinting.github.io/cups-filters-Second-Generation-First-Beta-Release/

braille-printer-app still needs some upstream work for getting released, the others were already released as 2.0b2.

libcupsfilters, cups-filters, and cups-browsed contain mainly the code from the former cups-filters (1.x) which is already in Main. libppd contains code from CUPS (libcups and cups-ppdc) which is also in Main.

As of

https://github.com/canonical/ubuntu-mir

----------
If a new source package contains only code which is already in main (e.g. the result of a source package split or rename, or source packages with a version in the name), it may not need a full review. Submitting a MIR bug with an explanation (but without the full template) or updating/extending on the existing old MIR bug and re-opening it by setting it to "NEW" is sufficient.
----------

This report does not need the full template.

The original packages (cups-filters and cups) are in Main already for more than a decade, so repetition of the original MIR would not be useful. cups was already in Ubuntu from the very beginning on and therefore probably in Main since the differentiation of Main and Universe got introduced.

The binary packages are named as before (except SONAME of libraries being 2 instead of 1 now), binary packages for libppd added. So current dependencies and seeding should pull in everything (libppd is a library and cups-filters depends on it).

libfontembed has been discontinued (folded into libcupsfilters, API removed) but no package uses it (except the components of cups-filters 1.x thenselves).

braille-printer-app will be added to this report (or a new simplified MIR report created) as soon as it gets released upstream. Its binary package(s) will need to get seeded.

[Till Kamppeter (till-kamppeter)]

Note that this is reported for "cups-filters" for now as the actual packages are not yet uploaded to Lunar. You can find them, plus the new cups-filters source package with the appropriate components removed, in this PPA:

https://launchpad.net/~till-kamppeter/+archive/ubuntu/new-arch-dev/+packages

[Didier Roche-Tolomelli (didrocks)]

Thanks for the MIR, however, as you wanted to do a simple MIR and not a full one, this is really lacking details and not tracking the real packages the MIRs are supposed to apply on.
Please be considerate for the reviewer and help them as much as possible by following the process, so that from one bug report, we can see:
- which source packages are impacted
- which binary packages needs to be promoted.

That, without any more verbiage.

Also, those packages were packaged a very long time ago, so it’s probably the right opportunity to ensure, especially with the split, that they all confirmant with the MIR policy.

So, do you mind:
- add one source package for any source package impacted.
- for each source package, check the MIR requirements and file the template, ONE FOR EACH, in the description (you can separate them by markers to make it clearer).
- state in each source package what code was moved where
- remove cups-filters source package from here, and tell what’s going to happens with current cups-filters source package. Should it be demoted?

Until there, I’m marking that bug as incomplete.

[Till Kamppeter (till-kamppeter)]

The 4 packages of the new generation of cups-filters are uploaded to Lunar now: libcupsfilters 2.0~b2, libppd 2:2.0~b2, cups-filters 2.0~b2, cups-browsed 2.0~b2, all but cups-filters considered NEW.

As soon as the NEW packages land in Universe I will add tasks for them to this MIR bug report.

[Till Kamppeter (till-kamppeter)]

Set importance to "High", as cups-filters 2.0b1 is already uploaded to Main and depends on libcupsfilters and libppd.

[Didier Roche-Tolomelli (didrocks)]

Thanks for the detailed description and bug report, this will really help getting it through faster :)

I still have one request: it’s to the reporter to check which packages are in main and if new dependencies needs MIR in main, not the MIR team which is only doing a double check ("bretelles et chaussures" check) :)

So, can you please amend the description after confirming exactly those 2 points:
* --> ALL THESE BINARY PACKAGES MUST GET PROMOTED INTO MAIN (IF THEY ARE
    NOT ALREADY THERE).

Please list packages that are not in main and do this research work.

* --> SO MOST PROBABLY NO NEW DEPENDENCIES IN PACKAGES ALREADY EXISTING
     IN MAIN AND NO NEW SEEDS ARE NEEDED TO ACTUALLY GET EVERYTHING
     INTO MAIN AFTER THE APPROVAL OF THIS MIR.

Please ensure this. there is no "probably", but it’s part of the reporter's work to do the checking. Once this work is done, feel free to assign the 3 bug tasks to me and revert the status to NEW.

[Till Kamppeter (till-kamppeter)]

Re-launched with the fixes asked for:

- Disussed the promotion needs on Mattermost, also with @seb128
- Checked all the package's situations with rmadison
- Updated the description text, checked for absence of words "probably" and "if" related to
  presence of anything in Main or Universe.
- Clearly marked at all appropriate points what needs to get promoted

Also found by failures of autopkgtests that there was a missing dependency of libcups2-dev in debian/tests/control in both libcupsfilters and libppd and an upstream bug which broke monochrome PCL-XL output in libcupsfilters. Uploaded libcupsfilters_2.0~b2-0ubuntu10 and libppd_2.0~b2-0ubuntu5. Also applied the fix to the upstream code, to be included in libcupsfilters 2.0~b3.

[Till Kamppeter (till-kamppeter)]

Sorry, libppd upload is libppd_2.0~b2-0ubuntu8.

[Didier Roche-Tolomelli (didrocks)]

Review for Package: libcupsfilters

[Summary]
MIR team ACK under the constraint to resolve the below listed required TODOs and as much as possible having a look at the recommended TODOs.

This package parse many formats from untrusted sources in many formats and use LD_LIBRARY_PATH. As the code within the package this is originated from has greatly changed
over the years and when it entered main, we even didn’t have a MIR process, I suggest that this package is audited
by our security team. Assigning to them, but let’s not that block the required and recommended todos that you can work in parallel to the security review.

List of specific binary packages to be promoted to main:
- libcupsfilters2
- libcupsfilters2-common

Required TODOs:
- The autopkgtests is marked as superficial, and indeed, when looking at what is done, it builds the lib and call a logging function in it.
For packages in main, we need non trivial autopkgtests. As this package is doing quite a lot, we need to get to a higher standard
and improve the autopkgtests suite.
- Remember to subscribe the desktop-packages team as I think it will be the official team owning the packages so that list of criticals bugs can be adressed.
Recommended TODOs:
- There are a lot of warnings during the build. This makes the build process hard to read if a new error occur and it’s a nice opportunity to fix them upstream and downstream.

[Duplication]
This is a transition from some older package, no package will duplicate this functionality.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- libcupsfilter checked with `check-mir`
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries

- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not open a port/socket
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)

Problems:
- Does parse many formats from untrusted sources. As the code within the package this is originated from has greatly changed
  over the years and when it entered main, we even didn’t have a MIR process, I suggest that this package is audited
  by our security team.

[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- no new python2 dependency

Problems:
- the autopkgtests is marked as superficial, and indeed, when looking at what is done, it builds the lib and call a logging function in it.
For packages in main, we nee...

[Didier Roche-Tolomelli (didrocks)]

Review for Package: cups-browsed

[Summary]
MIR team ACK under the constraint to resolve the below listed required TODOs and as much as possible having a look at the recommended TODOs.

This package is running as root, with an ungated (protected by apparmor, but not restriction on the systemd service itself). As the code within the package this is originated from has greatly changed over the years and when it entered main, we even didn’t have a MIR process, I suggest that this package is audited
by our security team. Assigning to them, but let’s not that block the required and recommended todos that you can work in parallel to the security review.

Only the source package needs promotion, as this package is a transition from another source.

Required TODOs:
- There are no package build time tests nor autopkgtests in the package which is a requirement for entering main. I know you mention that before this wazs already the case. However, this should have been addressed when we raised the bar in quality for packages in main and it seems the right opportunity to gate on having at least an initial autopkgtests testsuite with strong indication of improving it in the near future.
- Remember to subscribe the desktop-packages team as I think it will be the official team owning the packages so that list of criticals bugs can be adressed.
- The package does install one service, gated with apparmor. However, additional permission on the service would be great.
See the MIR template on which ones to add like reduced permissions, temp envronment, restricted users/groups...
Due to this service running as root and as this requires a security review too.

Recommended TODOs:
- This package do not ship library or symbol files, however, it has this in debian/rules, which is useless for that package:
override_dh_makeshlibs:
 dh_makeshlibs -- -c4
This could be cleaned.
- I suggest that you revisit the lintian override about file permission on the executable, if you look at <https://lintian.debian.org/tags/executable-is-not-world-readable>, there is no security gain by this permission set. It should be 0744 if you don’t want other users to be able to execute it.

[Duplication]
This is a transition from some older package, no package will duplicate this functionality.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- cups-browsed checked with `check-mir`
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not open a privilege port/socket
- does not parse data formats (files [images, video, audio,
 xml, json, asn.1], network packets, structures, ...) from
 an untrusted source.
- does not process arbitrary web content
- does not use centralized ...

[Sebastien Bacher (seb128)]

@Didier, I'm replying to that specific point about libcupsfilter since I'm the one who tweaked the symbols to the current state

> - The symbols file is not up to date. If you look at https://launchpadlibrarian.net/648110944/buildlog_ubuntu-lunar-amd64.libcupsfilters_2.0~b2-0ubuntu10_BUILDING.txt.gz, there are a lot of missing symbols for instance. I suggest that symbol files update will block and fail build by exporting DPKG_GENSYMBOLS=4.

in fact the debian/rules enforces that level. I've marked a stack of c++ symbols as optional since their mangling is different between architectures leading to different names, which isn't great but afaik we don't really have a proper solution for those and it's not the only packaging doing that.

Is that acceptable with that context or would you still like to see changes? One other alternative would be to create a .symbols.arch for each architecture but that's even more tedious and I don't think I've seen us go that way with other packages

[Till Kamppeter (till-kamppeter)]

For libcupsfilters the warnings are harmless and there are only 2 types signalling deprecations of feature in QPDF.

Very long term solution is replacing QPDF by PDFio (https://github.com/michaelrsweet/pdfio), to have simple C instead of C++ for easier maintenance

But for now, we will update the code to not use the deprecated features any more.

One deprecation is solved upstream now:

    https://github.com/OpenPrinting/libcupsfilters/commit/46f6896

The second is more complex to solve but one can suppress the warnings when building the package:

    CXXFLAGS='-DPOINTERHOLDER_TRANSITION=0' ./configure
    make

This would at least make warnings about atual problems more visible.

After applying above methods I currently do not get any warning at all any more.

[Till Kamppeter (till-kamppeter)]

How do I subscribe "desktop-packages" to a package? Under "Subscribe to bug mail" this group is not listed (for any of my packages, not only libcupsfilters).

[Didier Roche-Tolomelli (didrocks)]

@Till: excellent!

@seb128: It’s something that we phased in Unity and other projects too. IIRC, we unmangled the symbols to arch-independent ones beforehand with a debian helper (in the KDE toolset IIRC)? Do you mind having a look at this? I think that would be a good first set of efforts. If this is not successful then, the current mitigation with marking them optional is OK.

[Till Kamppeter (till-kamppeter)]

@didrocks, and how do I subscribe "desktop-packages" to my packages?

[Till Kamppeter (till-kamppeter)]

@didrocks, do yopu mean pkgkde-symbolshelper of pkg-kde-tools. It seems that the Debian people use it for libgs10 of Ghostscript, as it uses some C++ libraries.

[Sebastien Bacher (seb128)]

@Till, yes that's the utility Didier was referring to ... could you see if that would help simplifying the symbols?

[Till Kamppeter (till-kamppeter)]

@seb128, I tried to run a "rewrite"

    pkgkde-symbolshelper rewrite -i debian/libcupsfilters2.symbols

but the result is identical to what you have done manually. It only changes the order of the lines. The file has 569 lines.

If I do "create", "patch", or "batchpatch" I create a completely new file, without any history. But this should not be a problem as libcupsfilters2 is a new library.

So I try (after having built the package):

rm debian/libcupsfilters2.symbols
pkgkde-gensymbols -plibcupsfilters2 -v2.0~b2-0ubuntu11 -Osymbols.amd64 -edebian/libcupsfilters2/usr/lib/x86_64-linux-gnu/libcupsfilters.so.2.0.0 > out
pkgkde-symbolshelper create -o debian/libcupsfilters2.symbols -v 2.0~b2-0ubuntu11 symbols.amd64

This produces a debian/libcupsfilters2.symbols file with 405 lines, so many symbols of the old file are not present, but there are several internal (no public or private API of the library) C++ symbols again. All are marked as introduced in 2.0~b2-0ubuntu11 and none is marked as optional. The file "out" seems to be a patch which creates debian/libcupsfilters2.symbols from an empty file.

[Till Kamppeter (till-kamppeter)]

The attached file is the symbols file created from scratch as described in the previous comment. I found the method in the man page of pkgkde-symbolshelper.

[Till Kamppeter (till-kamppeter)]

The QPDF 11 warnings about the "PointerHolder" are solved upstream now. I gave the problem to a GSoC contributor candidate as part of the selection process. An hour later I had a pull request:

https://github.com/OpenPrinting/libcupsfilters/pull/13

Tested it, works. But had to set the -DPOINTERHOLDER_TRANSITION=0 independent of that as the warning is always issued, also without "PointerHolder" in the code.

Now the libcupsfilters code is free of warnings (on Lunar).

[Till Kamppeter (till-kamppeter)]

I have checked again, libcupsfilters has a test program, doing 6 individual tests, which is run by "make check". Can be that I had forgotten it in the first place.

[Till Kamppeter (till-kamppeter)]

The test program was inherited from the old cups-filter 1.x package.

[Till Kamppeter (till-kamppeter)]

Same for libppd. It also has a test program, run by "make check", 1 program doing a lot of tests.

$ make check
make[1]: Entering directory '/home/till/printing/openprinting/libppd/x'
make testppd
make[2]: Entering directory '/home/till/printing/openprinting/libppd/x'
  CC ppd/testppd.o
ppd/testppd.c: In function ‘main’:
ppd/testppd.c:1534:7: warning: pointer ‘filename’ may be used after ‘free’ [-Wuse-after-free]
 1534 | unlink(filename);
      | ^~~~~~~~~~~~~~~~
ppd/testppd.c:1352:5: note: call to ‘free’ here
 1352 | free(filename);
      | ^~~~~~~~~~~~~~
  CCLD testppd
make[2]: Leaving directory '/home/till/printing/openprinting/libppd/x'
make check-TESTS
make[2]: Entering directory '/home/till/printing/openprinting/libppd/x'
make[3]: Entering directory '/home/till/printing/openprinting/libppd/x'
PASS: testppd
============================================================================
Testsuite summary for libppd 2.0b3
============================================================================
# TOTAL: 1
# PASS: 1
# SKIP: 0
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 0
============================================================================
make[3]: Leaving directory '/home/till/printing/openprinting/libppd/x'
make[2]: Leaving directory '/home/till/printing/openprinting/libppd/x'
make[1]: Leaving directory '/home/till/printing/openprinting/libppd/x'
$ make testppd
$ ./testppd
ppdOpenFile("ppd/test.ppd"): PASS
ppdFindAttr(wildcard): PASS
ppdFindNextAttr(wildcard): PASS
ppdFindAttr(Foo): PASS
ppdFindNextAttr(Foo): PASS
ppdMarkDefaults: PASS
ppdEmitString (defaults): PASS
ppdEmitString (custom size and string): PASS
ppdGetConflicts(InputSlot=Envelope): PASS
ppdConflicts(): PASS (2)
ppdResolveConflicts(InputSlot=Envelope): PASS (Resolved by changing PageSize)
ppdResolveConflicts(No option/choice): PASS (Resolved by changing InputSlot)
ppdInstallableConflict(): PASS
ppdPageSizeLimits: PASS
ppdMarkOptions(media=iso-a4): PASS
ppdMarkOptions(media=na_letter_8.5x11in): PASS
ppdMarkOptions(media=oe_letter-fullbleed_8.5x11in): PASS
ppdMarkOptions(media=A4): PASS
ppdMarkOptions(media=Custom.8x10in): PASS
ppdLocalizeIPPReason(text): PASS
ppdLocalizeIPPReason(http): PASS
ppdLocalizeIPPReason(help): PASS
ppdLocalizeIPPReason(file): PASS
ppdLocalizeIPPReason(fr text): PASS
ppdLocalizeIPPReason(zh_TW text): PASS
ppdLocalizeMarkerName(bogus): PASS
ppdLocalizeMarkerName(cyan): PASS
ppdLocalizeMarkerName(fr cyan): PASS
ppdLocalizeMarkerName(zh_TW cyan): PASS
ppdOpenFile("ppd/test2.ppd"): PASS
ppdMarkDefaults: PASS
ppdEmitString (defaults): PASS
ppdConflicts(): PASS (1)
ppdResolveConflicts(Quality=Photo): PASS (Unable to resolve)
ppdResolveConflicts(No option/choice): PASS
ppdResolveConflicts(loop test): PASS
ppdInstallableConflict(): PASS
ppdPageSizeLimits(default): PASS
ppdPageSizeLimits(InputSlot=Manual): PASS
ppdPageSizeLimits(Quality=Photo): PASS
ppdPageSizeLimits(Quality=Photo): PASS
ppdRasterExecPS("setpagedevice"): PASS
ppdRasterExecPS("roll"): PASS
ppdRasterExecPS("dup index"): PASS
ppdRasterExecPS("%%Begin/EndFeature code"): PASS
$

[Till Kamppeter (till-kamppeter)]

I could re-use them as autopkgtest, so that they get re-run when a dependency gets into proposed migration.

[Till Kamppeter (till-kamppeter)]

Warning in the compilation of the libppd test fixed upstream.

[Seth Arnold (seth-arnold)]

On Thu, Feb 16, 2023 at 10:58:19PM -0000, Till Kamppeter wrote:
> ppd/testppd.c:1534:7: warning: pointer ‘filename’ may be used after ‘free’ [-Wuse-after-free]
> 1534 | unlink(filename);
> | ^~~~~~~~~~~~~~~~
> ppd/testppd.c:1352:5: note: call to ‘free’ here
> 1352 | free(filename);
> | ^~~~~~~~~~~~~~

Is this shipped to users? Is it part of an automatic workflow, or is it a
debugging utility that almost no one will ever use?

Thanks

[Till Kamppeter (till-kamppeter)]

@seth-arnold, I have fixed this already now. And in general, it was only in the test program, not anything for the end user.

https://github.com/OpenPrinting/libppd/commit/32c1da4b6ce

[Didier Roche-Tolomelli (didrocks)]

@Till:
- I will let you go on the symbol file enhancements.
- For the tests, please hook them up during package build (for those where they were not running) and autopkgtests
- For desktop-packages, I know that seb has the right to do the subcription. He generally does it once the MIR is approved.

[Seth Arnold (seth-arnold)]

Thanks Till, I was curious if we ought to try to coordinate with other distros / vendors / users etc, but this seems innocuous enough if it's just a test program. (If we assigned CVEs for every less-than-perfect coding practice in test programs we'd be drowning in paperwork for very little benefit.)

[Didier Roche-Tolomelli (didrocks)]

Review for Package: pppd

[Summary]
MIR team ACK under the constraint to resolve the below listed required TODOs and as much as possible having a look at the recommended TODOs.

This package parse ppd formats from untrusted sources and is using setuid. As the code within the package this is originated from has greatly changed over the years and when it entered main, we even didn’t have a MIR process, I suggest that this package is audited by our security team. Assigning to them, but let’s not that block the required and recommended todos that you can work in parallel to the security review.

Binary packages to be promoted:
- libppd-dev
- libppd2
- libppd2-common
- ppdc (see below on ppdc)

Required TODOs:
- One question: do we really need ppdc to be promoted? You stated it’s a debugging/development binary, not for end user?
- There are no autopkgtests in the package which is a requirement for entering main. I know you mention that before this was already the case. However, this should have been addressed when we raised the bar in quality for packages in main and it seems the right opportunity to gate on having at least an initial autopkgtests testsuite with strong indication of improving it in the near future.
- Remember to subscribe the desktop-packages team as I think it will be the official team owning the packages so that list of criticals bugs can be adressed.

Recommended TODOs:
- There is one warning during build (variable that could be used after free) that would be good to fix.
- Check if we can enhance symbols file tracking (see the other MIR for this)

[Duplication]
This is a transition from some older package, no package will duplicate this functionality.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- ppd checked with `check-mir`
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not open a privilege port/socket
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)

Problem:
- This package parse ppd formats from untrusted sources.

[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- no new python2 dependency

Problems:
- There are no autopkgtests in the package which is a requirement for entering main. I know you mention that before this was already the case. However, this should have been addressed when we rais...

[Till Kamppeter (till-kamppeter)]

libppd 2.0~b4-0ubuntu2 uploaded.

- Has an autopkgtest now which runs the program `testppd` (also used by `make check`) on the libppd installed into the system.
- Was put through Coverity and appropriately fixed by Red Hat printing maintainer Zdenek Dohnal.
- The symbols file is created by KDE's symbolshelper and architecture-specific symbols (as of build logs of Launchpad builds of 2.0~b4-0ubuntu1) added afterwards, marked as (optional). See debian/NEWS.
- No compiler warnings on building `testppd`
- Bug fixes for reported bugs, see CHANGES.md

[Till Kamppeter (till-kamppeter)]

libcupsfilters 2.0~b4-0ubuntu4 uploaded.

- Has an autopkgtest now which runs the test programs used by `make check` on the libcupsfilters installed into the system.
- Was put through Coverity and appropriately fixed by Red Hat printing maintainer Zdenek Dohnal.
- The symbols file is created by KDE's symbolshelper and architecture-specific symbols (as of build logs of Launchpad builds) added afterwards, marked as (optional). See debian/NEWS.
- All deprecated functions of QPDF are replaced by the appropriate substitutions now, making the build of the package free of warnings.
- Bug fixes for reported bugs, see CHANGES.md

[Till Kamppeter (till-kamppeter)]

Cups-browsed 2.0~b4-0ubuntu1 uploaded.

- Daemon runs as normal user now, user only needs to be member of the "lpadmin" group to be able to create and modify CUPS queues. It is directly started as that user by systemd.
- Has both 'make check' and an autopkgtest now. The latter runs the test script used by `make check` on the cups-browsed installed into the system. The script I have designed appropriately to work in both modes.
- Was put through Coverity and appropriately fixed by Red Hat printing maintainer Zdenek Dohnal.
- Many upstream bug fixes for bugs discovered during the development of the test script, see CHANGES.md

[Till Kamppeter (till-kamppeter)]

Checked through everything whether I have nothing forgotten, seems that I overlooked the question with the ppdc.

The ppdc is actually only needed for development and debugging:

- CUPS 2.x needs ppdc as external executable, but it has its own ppdc.

- Printer Applications (the PPD/driver-retro-fitting ones) manage collections of PPDs (including *.drv files) with libppd's API for PPD collections and these call the library functions for the ppdc functionality directly (the functions are in libppd), without needing an external executable.

- CUPS 3.x does not support PPD files (and also not *.drv files) at all, so it will not need ppdc.

The code in the ppdc binary package is actually only wrappers which call corresponding library functions. The actual functionality is completely in libppd.

So an actual promotion of ppdc is not needed, but ppdc should not add any extra risks due to its functionality already residing in libppd.

[Till Kamppeter (till-kamppeter)]

The "setuid()" in libppd is harmless, it is only for dropping, not for gaining privileges, and the function where it is called, "PipeCommand()", is static, so it is only used in the same file and not available to the outside. Checking the calls in that file, ppd/ppd-collection.cxx, the privilege-dropping facility is even not made use of ...

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

I reviewed cups-browsed 2.0~b4-0ubuntu2 as checked into lunar.
This shouldn't be considered a full audit but rather a quick gauge of
maintainability.

cups-browsed is a a helper daemon to browse the network for remote CUPS
queues and IPP network printers and automatically create local queues
pointing to them. It used to be a binary in cups-filters source and was
now split into a new source.

- CVE History:
  - CVE history is applicable to cups-filter, and it is all good. The CVEs
    that existed were fixed.
- Build-Depends?
  - avahi, cups, dbus, glib2.0, openldap, pkgconf, poppler, zlib all in main
  - libppd, also targeted in the same MIR bug.
- pre/post inst/rm scripts?
  - preinst: runs dh_installdeb
  - prerm: runs dh_installsystemd dh_installdeb
  - postinst: runs dh_apparmor, dh_installdeb, dh_installsystemd and
    accepts a configure param to setup /var/ directories and add
    cups-browsed user.
  - postrm: runs dh_apparmor dh_installdeb dh_installsystemd and accepts a
    purge param to remove the previously setup /var/ directories and remove
    the cups-browsed user.
- init scripts?
  - NA
- systemd units?
  - starts the daemon /usr/sbin/cups-browsed
- dbus services?
  - NA
- setuid binaries?
  - NA
- binaries in PATH?
  - cups-browsed: ./usr/sbin/cups-browsed
  - cups-browsed-tests: ./usr/bin/run-tests.sh
- sudo fragments?
  - NA
- polkit files?
  - NA
- udev rules?
  - NA
- unit tests / autopkgtests?
  - Tests are defined in the script cups-browsed-2.0~b4/test/run-tests.sh,
  that seems to do a good job in creating the test setup. it gives the
  chance to make different types of tests. This is the script that runs in
  the autopkgtests.
- cron jobs?
  - NA
- Build logs:
  - build log is clean, there is an information about the tests being
    executed in the autopkgtest and not during the build, due to the
    need of avahi-daemon in the build chroot.
  - Lintian throws the following Errors and Warnings.
      E: cups-browsed: depends-on-obsolete-package Depends: lsb-base
      E: cups-browsed: maintainer-script-lacks-home-in-adduser "adduser --system --ingroup lpadmin cups-browsed" [postinst:8]
      W: cups-browsed: debian-news-entry-has-unknown-version 2.0~b1-0ubuntu1 [usr/share/doc/cups-browsed/NEWS.Debian.gz:1]
      W: cups-browsed: maintainer-script-needs-depends-on-adduser adduser (does not satisfy adduser) [postinst:8]
      W: cups-browsed: mismatched-override executable-in-usr-lib usr/lib/cups/backend/implicitclass [usr/share/lintian/overrides/cups-browsed:4]
      W: cups-browsed: non-standard-executable-perm 0744 != 0755 [usr/lib/cups/backend/implicitclass]
      W: cups-browsed: wrong-name-for-upstream-changelog [usr/share/doc/cups-browsed/CHANGES.md.gz]
      W: cups-browsed-tests: no-manual-page [usr/bin/run-tests.sh]
      W: cups-browsed-tests: script-with-language-extension [usr/bin/run-tests.sh]
    Some seems OK, like the warnings for 'cups-browsed-tests', but the
    others could be checked better.

- Processes spawned?
  - No
- Memory management?
  - malloc's and calloc's are being checked, strcpy and sprintf seems fine
  - some coverity reports on memory management will be forwarded to upstream,
    not...

[Nishit Majithia (0xnishit)]

I reviewed libcupsfilters 2.0~b4-0ubuntu5 as checked into lunar. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.

libcupsfilters contains backends, filters, and other software that was
once part of the core CUPS distribution. It contains more filters and software
developed once Apple stopped maintaining this library. For compiling and using
this package CUPS (2.2.2 or newer), libcupsfilters 2.x, and libppd are needed.

- CVE History:
  - No history of CVE found
- Build-Depends?
  - avahi, ghostscript, cups, dbus, glib2.0, pkgconfig, qpdf, tiff, poppler,
    zlib, exif
- pre/post inst/rm scripts?
  - NA
- init scripts?
  - NA
- systemd units?
  - NA
- dbus services?
  - NA
- setuid binaries?
  - NA
- binaries in PATH?
  - libcupsfilters-tests_2.0~b4-0ubuntu5_amd64.deb:
    -rwxr-xr-x root/root 14656 2023-02-24 13:43 ./usr/bin/test-analyze
    -rwxr-xr-x root/root 14656 2023-02-24 13:43 ./usr/bin/test-pdf
    -rwxr-xr-x root/root 14656 2023-02-24 13:43 ./usr/bin/test-ps
    -rwxr-xr-x root/root 14656 2023-02-24 13:43 ./usr/bin/test1284
    -rwxr-xr-x root/root 18752 2023-02-24 13:43 ./usr/bin/testcmyk
    -rwxr-xr-x root/root 14656 2023-02-24 13:43 ./usr/bin/testdither
    -rwxr-xr-x root/root 14656 2023-02-24 13:43 ./usr/bin/testimage
    -rwxr-xr-x root/root 14656 2023-02-24 13:43 ./usr/bin/testpdf1
    -rwxr-xr-x root/root 14656 2023-02-24 13:43 ./usr/bin/testpdf2
    -rwxr-xr-x root/root 14728 2023-02-24 13:43 ./usr/bin/testrgb
- sudo fragments?
  - NA
- polkit files?
  - NA
- udev rules?
  - NA
- unit tests / autopkgtests?
  - All the unit tests are resides in ./cupsfilters/test\*.c files.
    Also, drive test is defined in ./test-driver script. These test cases are
    included in autopkgtests and it is working as expected.
- cron jobs?
  - NA
- Build logs:
  - Lintian throws the following Warningsi and Errors
    E: libcupsfilters source: missing-build-dependency-for-dh-addon pkgkde_symbolshelper (does not satisfy pkg-kde-tools:any) [debian/rules]
    W: libcupsfilters source: build-depends-on-obsolete-package Build-Depends: libfontconfig1-dev => libfontconfig-dev
    W: libcupsfilters source: dependency-is-not-multi-archified libcupsfilters2 depends on libcupsfilters2-common (multi-arch: no)
    W: libcupsfilters-tests: no-manual-page [usr/bin/test-analyze]
    W: libcupsfilters-tests: no-manual-page [usr/bin/test-pdf]
    W: libcupsfilters-tests: no-manual-page [usr/bin/test-ps]
    W: libcupsfilters-tests: no-manual-page [usr/bin/test1284]
    W: libcupsfilters-tests: no-manual-page [usr/bin/testcmyk]
    W: libcupsfilters-tests: no-manual-page [usr/bin/testdither]
    W: libcupsfilters-tests: no-manual-page [usr/bin/testimage]
    W: libcupsfilters-tests: no-manual-page [usr/bin/testpdf1]
    W: libcupsfilters-tests: no-manual-page [usr/bin/testpdf2]
    W: libcupsfilters-tests: no-manual-page [usr/bin/testrgb]
    W: libcupsfilters2: symbols-file-contains-debian-revision on symbol Floyd16x16@Base and 388 others (libcupsfilters.so.2) [symbols]
    W: libcupsfilters2: wrong-name-for-upstream-changelog [usr/share/doc/libcupsfilters2/CHANGES.md.gz]

    ...

[Sebastien Bacher (seb128)]

@cups-browsed

The review feedback from Didier was

> Required TODOs:
> - There are no package build time tests nor autopkgtests in the package which is a requirement for entering main.

The autopkgtests got added
https://autopkgtest.ubuntu.com/packages/c/cups-browsed

The build was changed to call 'make check' but that was reverted because those tests expect avahi to be active which is not. Till could we skip part of the tests but still run the tests that don't rely on avahi?

> - Remember to subscribe the desktop-packages team as I think it will be the official team owning the packages so that list of criticals bugs can be adressed.

Subscribed

> - The package does install one service, gated with apparmor. However, additional permission on the service would be great.
> See the MIR template on which ones to add like reduced permissions, temp envronment, restricted users/groups...
> Due to this service running as root and as this requires a security review too.

The service didn't need the privilege, it was changed in to use https://launchpad.net/ubuntu/+source/cups-browsed/2.0~b4-0ubuntu1 User=cups-browsed

Security team review was also done and gave a +1

> Recommended TODOs:
> - This package do not ship library or symbol files, however, it has this in debian/rules, which is useless for that package:
> override_dh_makeshlibs:
> dh_makeshlibs -- -c4
> This could be cleaned.

fixed in https://launchpad.net/ubuntu/+source/cups-browsed/2.0~b4-0ubuntu2

> - I suggest that you revisit the lintian override about file permission on the executable, if you look at <https://lintian.debian.org/tags/executable-is-not-world-readable>, there is no security gain by this permission set. It should be 0744 if you don’t want other users to be able to execute it.

fixed in https://launchpad.net/ubuntu/+source/cups-browsed/2.0~b4-0ubuntu2

Till, could you check if there is a set of the tests we could do a build time still? Once that resolved we should be able to promote cups-browsed

[Sebastien Bacher (seb128)]

@libcupsfilters

The MIR review feedback was

> Required TODOs:
> - The autopkgtests is marked as superficial, and indeed, when looking at what is done, it builds the lib and call a logging function in it.
> For packages in main, we need non trivial autopkgtests. As this package is doing quite a lot, we need to get to a higher standard
> and improve the autopkgtests suite.

It was fixed in https://launchpad.net/ubuntu/+source/libcupsfilters/2.0~b4-0ubuntu1
Till added a libcupsfilters-tests binary including the same checks as the upstream testsuite and is using them as autopkgtests now
https://autopkgtest.ubuntu.com/packages/lib/libcupsfilters

> - Remember to subscribe the desktop-packages team as I think it will be the official team owning the packages so that list of criticals bugs can be adressed.

desktop-packages subscribed now

> Recommended TODOs:
> - There are a lot of warnings during the build. This makes the build process hard to read if a new error occur and it’s a nice opportunity to fix them upstream and downstream.

Till fixed some of the warnings upstream now.
@Till, should we also set CXXFLAGS='-DPOINTERHOLDER_TRANSITION=0' as you said it would help cut some of the remaining noise?

Security team also gave a +1 for promotion.

Since there is no remaining blocker item I'm promoting libcupsfilters now

[Sebastien Bacher (seb128)]

$ ./change-override -c main -t libcupsfilters
Override component to main
libcupsfilters 2.0~b4-0ubuntu5 in lunar: universe/net -> main
Override [y|N]? y
1 publication overridden.

$ ./change-override -c main libcupsfilters2 libcupsfilters2-common
Override component to main
libcupsfilters2 2.0~b4-0ubuntu5 in lunar amd64: universe/libs/optional/100% -> main
libcupsfilters2 2.0~b4-0ubuntu5 in lunar arm64: universe/libs/optional/100% -> main
libcupsfilters2 2.0~b4-0ubuntu5 in lunar armhf: universe/libs/optional/100% -> main
libcupsfilters2 2.0~b4-0ubuntu5 in lunar ppc64el: universe/libs/optional/100% -> main
libcupsfilters2 2.0~b4-0ubuntu5 in lunar riscv64: universe/libs/optional/100% -> main
libcupsfilters2 2.0~b4-0ubuntu5 in lunar s390x: universe/libs/optional/100% -> main
libcupsfilters2-common 2.0~b4-0ubuntu5 in lunar amd64: universe/libs/optional/100% -> main
libcupsfilters2-common 2.0~b4-0ubuntu5 in lunar arm64: universe/libs/optional/100% -> main
libcupsfilters2-common 2.0~b4-0ubuntu5 in lunar armhf: universe/libs/optional/100% -> main
libcupsfilters2-common 2.0~b4-0ubuntu5 in lunar i386: universe/libs/optional/100% -> main
libcupsfilters2-common 2.0~b4-0ubuntu5 in lunar ppc64el: universe/libs/optional/100% -> main
libcupsfilters2-common 2.0~b4-0ubuntu5 in lunar riscv64: universe/libs/optional/100% -> main
libcupsfilters2-common 2.0~b4-0ubuntu5 in lunar s390x: universe/libs/optional/100% -> main
Override [y|N]? y
13 publications overridden.

[Till Kamppeter (till-kamppeter)]

@libcupsfilters

> > Recommended TODOs:
> > - There are a lot of warnings during the build. This makes the build process hard to read if a > new error occur and it’s a nice opportunity to fix them upstream and downstream.
>
> Till fixed some of the warnings upstream now.
> @Till, should we also set CXXFLAGS='-DPOINTERHOLDER_TRANSITION=0' as you said it would help cut
> some of the remaining noise?

As of CHANGES.md

https://github.com/OpenPrinting/cups-filters/blob/master/CHANGES.md

the POINTERHOLDER_TRANSITION should be fixed in current upstream version (2.0b4) which is base of the current Ubuntu package.

[Till Kamppeter (till-kamppeter)]

@cups-browsed

First off, cups-browsed got promoted off-MIR by @vorlon, as it is a spin-off of the former cups-filters 1.x which was in Main and the code base is merly the same.

Second, cups-browsed as we use it in Ubuntu does nothing at all if there is no avahi-daemon, it will even immediately exit as it has nothing to do.

I would need to add a "testing mode" to the upstream code of cups-browsed which fakes DNS-SD broadcasts, but this is very invasive and the risk of bugs to get introduced by that is higher than the probablility to discover bugs in the rest of cups-browsed's functionality.

Another solution would be to use the legacy CUPS browsing support, but with this I would test a functionality which is completely irrelevant to Ubuntu (it is there to interact with VERY old Red Hat Enterprise versions). Also I would need a counterpart, meaning that I had to re-implement legacy CUPS browsing in an external test program ...

Third, the security team has no problem with the missing build test as we have the autopkgtest which is testing cups-browsed very well:

> - unit tests / autopkgtests?
> - Tests are defined in the script cups-browsed-2.0~b4/test/run-tests.sh,
> that seems to do a good job in creating the test setup. it gives the
> chance to make different types of tests. This is the script that runs in
> the autopkgtests.
> - cron jobs?
> - NA
> - Build logs:
> - build log is clean, there is an information about the tests being
> executed in the autopkgtest and not during the build, due to the
> need of avahi-daemon in the build chroot.

[Mark Esler (eslerm)]

> First off, cups-browsed got promoted off-MIR by @vorlon, as it is a spin-off of the former cups-filters 1.x which was in Main and the code base is merly the same.

All new packages require MIR. There are no spin-off exceptions.

> Third, the security team has no problem with the missing build test as we have the autopkgtest which is testing cups-browsed very well:

MIR Team and Security Team are separate stakeholders and have separate requirements. I would check with MIR Team if their requirements for cups-browsed testing is satisfied.

[Mark Esler (eslerm)]

Since libppd MIR is no longer required per comment 37 and MM discussion, setting status to invalid and removing Security Team.

[Till Kamppeter (till-kamppeter)]

@eslerm, why is the libppd MIR not needed any more? The source package libppd and the binary packages libppd2, libppd-dev, and libppd2-common need to get promoted into Main, as they are used by cups-filters and cups-browsed, which are both in Main.

It was only ppdc which is not required to be in Main.

Also which MM discussion? Which channel?

[Mark Esler (eslerm)]

Till, Sebastien, and I have discussed libppd out-of-band. I'm giving libppd's MIR my full attention for the rest of today.

Coverity report is attached.

[Mark Esler (eslerm)]

I reviewed libppd 2:2.0~b4-0ubuntu3 as checked into lunar. This shouldn't be considered a full audit but rather a quick gauge of maintainability.

> libppd, the legacy support library for PPD files

- CVE History:
  - past cups-filters CVEs likely do not affect libppd code
    - most CVEs are reported to affect cups-filter's footmatic-rip
  - past cups-filters CVEs are mostly for "allows remote attackers to executing arbitrary commands"
- Build-Depends?
  - autoconf, debhelper-compat, dh-sequence-pkgkde-symbolshelper, ghostscript, libcups2-dev, libcupsfilters-dev, pkg-config, poppler-utils, and zlib1g-dev
- pre/post inst/rm scripts?
  - none
- init scripts?
  - none
- systemd units?
  - none
- dbus services?
  - none
- setuid binaries?
  - none
- binaries in PATH?
  - ./usr/bin/testppd
  - ./usr/bin/ppdc
  - ./usr/bin/ppdhtml
  - ./usr/bin/ppdi
  - ./usr/bin/ppdmerge
  - ./usr/bin/ppdpo
  - ./usr/bin/testppdfile
- sudo fragments?
  - none
- polkit files?
  - none
- udev rules?
  - none
- unit tests / autopkgtests?
  - has build and autopkgtests
  - see bug comments
- cron jobs?
  - none
- Build logs:
  - looks alright

- Processes spawned?
  - ppdCollectionGetPPD() -> PipeCommand() -> ExecCommand runs arbitrary execv(command, argv)
  - many functions lead to reading PPD files
  - several renders (e.g., poppler) can be executed
  - documentation is being added to warn downstream users to sanitize untrusted input
- Memory management?
  - heavy memory use
  - issues reported upstream
- File IO?
  - some cloexec
  - file IO appears okay and restrict mode
- Logging?
  - has logging and debugging
- Environment variable usage?
  - used for setting renderer executable paths at compile time
  - ./ppd/ppd-filter.c uses many env variables
    - $PPD loads a non-executable file
- Use of privileged functions?
  - used to prevent using file if setuid
  - elsewhere drops privilege
- Use of cryptography / random number sources etc?
  - none
- Use of temp files?
  - none
- Use of networking?
  - none
- Use of WebKit?
  - none
- Use of PolicyKit?
  - none

- Any significant Coverity results?
  - issues reported upstream
- Any significant cppcheck results?
  - see coverity
- Any significant shellcheck results?
  - okay - for compiling

Upstream added the ability to report security bugs privately and is adding security documentation \o/

Upstream and Desktop have agreed to own reported issue maintenance. Security team ACK for promoting libppd to main.

[Sebastien Bacher (seb128)]

Thanks Mark, promoting libppd now!

$ ./change-override -c main -t libppd
Override component to main
libppd 2:2.0~b4-0ubuntu3 in lunar: universe/libs -> main
Override [y|N]? y
1 publication overridden.

$ ./change-override -c main libppd-dev libppd2 libppd2-common
Override component to main
libppd-dev 2:2.0~b4-0ubuntu3 in lunar amd64: universe/libdevel/optional/100% -> main
libppd-dev 2:2.0~b4-0ubuntu3 in lunar arm64: universe/libdevel/optional/100% -> main
libppd-dev 2:2.0~b4-0ubuntu3 in lunar armhf: universe/libdevel/optional/100% -> main
libppd-dev 2:2.0~b4-0ubuntu3 in lunar ppc64el: universe/libdevel/optional/100% -> main
libppd-dev 2:2.0~b4-0ubuntu3 in lunar riscv64: universe/libdevel/optional/100% -> main
libppd-dev 2:2.0~b4-0ubuntu3 in lunar s390x: universe/libdevel/optional/100% -> main
libppd2 2:2.0~b4-0ubuntu3 in lunar amd64: universe/libs/optional/100% -> main
libppd2 2:2.0~b4-0ubuntu3 in lunar arm64: universe/libs/optional/100% -> main
libppd2 2:2.0~b4-0ubuntu3 in lunar armhf: universe/libs/optional/100% -> main
libppd2 2:2.0~b4-0ubuntu3 in lunar ppc64el: universe/libs/optional/100% -> main
libppd2 2:2.0~b4-0ubuntu3 in lunar riscv64: universe/libs/optional/100% -> main
libppd2 2:2.0~b4-0ubuntu3 in lunar s390x: universe/libs/optional/100% -> main
libppd2-common 2:2.0~b4-0ubuntu3 in lunar amd64: universe/libs/optional/100% -> main
libppd2-common 2:2.0~b4-0ubuntu3 in lunar arm64: universe/libs/optional/100% -> main
libppd2-common 2:2.0~b4-0ubuntu3 in lunar armhf: universe/libs/optional/100% -> main
libppd2-common 2:2.0~b4-0ubuntu3 in lunar i386: universe/libs/optional/100% -> main
libppd2-common 2:2.0~b4-0ubuntu3 in lunar ppc64el: universe/libs/optional/100% -> main
libppd2-common 2:2.0~b4-0ubuntu3 in lunar riscv64: universe/libs/optional/100% -> main
libppd2-common 2:2.0~b4-0ubuntu3 in lunar s390x: universe/libs/optional/100% -> main
Override [y|N]? y
19 publications overridden.