[MIR] libhttp-cookiejar-perl

[Steve Langasek]

[Availability]
Architecture-all perl package present in Ubuntu since 2014. https://launchpad.net/ubuntu/+source/libhttp-cookiejar-perl

[Rationale]
Required by current libwww-perl in Debian. This duplicates / supersedes functionality already present in libhttp-cookies-perl, however libwww-perl describes libhttp-cookiejar-perl as "a safer cookie jar", "providing a better security model matching that of current Web browsers when Mozilla::PublicSuffix is installed".

libwww-mechanize-perl is also a reverse-dependency of libhttp-cookies-perl in main and has not migrated to libhttp-cookiejar-perl yet in Debian, so it doesn't appear we can do a straight swap of one source package for the other at present.

[Security]
- No results on https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=HTTP%3A%3ACookiejar or https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=http-cookiejar
- only false positives on unrelated packages when searching site:www.openwall.com/lists/oss-security
- 0 results on https://ubuntu.com/security/cves?package=libhttp-cookiejar-perl
- 0 security issues on https://security-tracker.debian.org/tracker/source-package/libhttp-cookiejar-perl

Package does not ship any executables, it's a perl module; but by definition it will be used to handle untrusted input from the Internet.

[Quality assurance - maintenance]
No open bugs at https://bugs.launchpad.net/ubuntu/+source/libhttp-cookiejar-perl or https://bugs.debian.org/src:libhttp-cookiejar-perl.

Single wishlist bug open at https://github.com/dagolden/HTTP-CookieJar/issues.
[Quality assurance - testing]
upstream tests are run via autodep8 and at package build time and pass on all archs https://autopkgtest.ubuntu.com/packages/libhttp-cookiejar-perl/mantic/amd64

[Quality assurance - packaging]
- debian/watch is present and works
- debian/control defines a correct Maintainer field
- Lintian overrides are not present
- This package does not rely on obsolete or about to be demoted packages.
- The package will be installed by default, but does not ask debconf
  questions
- Packaging and build is easy; trivial dh debian/rules

[UI standards]
- n/a, perl module only

[Dependencies]
- No further depends or recommends dependencies that are not yet in main

[Standards compliance]
- This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- Owning Team will be foundations-bugs and will subscribe to the package before promotion

[Background information]
The Package description explains the package well

[Didier Roche-Tolomelli (didrocks)]

Review for Package: libhttp-cookiejar-perl

[Summary]
Before giving the MIR ack, there is a pending question about the transition to this package to ensure we only have one perl cookie handler and don’t start having duplicated functionality from this perl lib.
Apart from that, the package needs a security review, so, once the opened question is solved, I'll assign ubuntu-security.
List of specific binary packages to be promoted to main: libhttp-cookiejar-perl

Notes:
- Required TODOs:
Question to resolve: It's mentioned that this "safer cookie jar" is supposed to replace libhttp-cookies-perl. However, as you have rightly written, libwww-mechanize-perl is still a reverse-dependency of libhttp-cookies-perl. Is there any bug/plan to track and transition a full migration to libhttp-cookiejar-perl so that we don’t have to maintain both in the long term? As this package is there for some years already, should we be concerned the transition might never happen?

Recommended TODOs:
- The package should get a team bug subscriber before being promoted.

[Duplication]
It's mentioned that this "safer cookie jar" is supposed to replace libhttp-cookies-perl. However, as you have rightly written, libwww-mechanize-perl is still a reverse-dependency of libhttp-cookies-perl. Is there any bug/plan to track and transition a full migration to libhttp-cookiejar-perl so that we don’t have to maintain both in the long term? As this package is there for some years already, should we be concerned the transition might never happen?

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- libhttp-cookiejar-perl checked with `check-mir`
- all dependencies can be found in `seeded-in-ubuntu` (already in main)
- none of the (potentially auto-generated) dependencies (Depends
  and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not open a port/socket
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)

Problems:
- does process arbitrary web content and parse data formats from an untrusted source and store them on disk. Require a security review then.

[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- does have a non-trivial test suite that runs as autopkgtest
- no new python2 dependency

[Packaging red flags]
OK:
- Ubuntu does not carry a delt...

[Steve Langasek (vorlon)]

I've opened a bug with Debian to discuss moving libwww-mechanize-perl to libhttp-cookiejar-perl. It would be a small change to switch the one script in this package.

Also I just noticed that libwww-mechanize-perl source has a similar claim about libhttp-cookiejar-perl being a safer implementation HOWEVER, it clarifies that it's only safer if you also have Mozilla::PublicSuffix installed, and that module is not packaged at all in Debian...

[Steve Langasek (vorlon)]

After closer review, I've noticed that libwww-perl itself still depends on both libhttp-cookiejar-perl and libhttp-cookies-perl; and by default it only uses libhttp-cookies-perl. And libhttp-cookiejar-perl is not "safer" unless coupled with another perl module not currently packaged. And it doesn't provide the same interfaces. So it is redundant and should not be a runtime dependency of libwww-perl; uploaded to remove the dep.