[MIR] libscalar-list-utils-perl

[Heather Ellsworth]

[Availability]
It is available for any architecture in the universe.

https://launchpad.net/ubuntu/+source/libscalar-list-utils-perl

[Rationale]
A dependency of libmail-authenticationresults-perl (which is a new dependency of libmail-dkim-perl)

[Security]
No known CVEs.

https://security-tracker.debian.org/tracker/source-package/libscalar-list-utils-perl
https://launchpad.net/ubuntu/+source/libscalar-list-utils-perl/+cve

[Quality assurance]
- Desktop Packages team subscribed
- dh_auto_test runs as part of build (2091 tests)
- autopkgtest-pkg-perl

[Dependencies]
Depends on perl - already in main

[Standards compliance]
debhelper

[Maintenance]
The upstream appears to be somewhat active and the package is maintained by the Debian perl team

https://salsa.debian.org/perl-team/modules/packages/libscalar-list-utils-perl

[Heather Ellsworth (hellsworth)]

libscalar-list-utils-perl is being requested to satisfy a dependency of libmail-authenticationresults-perl.

libmail-authenticationresults-perl also has an open MIR to satisfy a dependency of libmail-dkim-perl:
https://bugs.launchpad.net/ubuntu/+source/libmail-dkim-perl/+bug/1853175

[Christian Ehrhardt  (paelzer)]

Hi Heather,
the MIR bugs are filed against the package that has to be evaluated.
Thanks to your explanations that is clear now and I fixed it up in the bug tasks.

[Christian Ehrhardt  (paelzer)]

[Summary]
- All looks pretty straight forward, MIR Team ack
- Needs security review (assigned)

[Duplication]
I first thought https://metacpan.org/pod/List::Util would be something else that sounds similar but it IS the same. I found no other such perl lib in main. And while one could say "just do it without the lib" it is fine that such helpers exist.

[Embedded sources and static linking]
- no embedded sources
- no (static) liking (perl)

[Security]
- no history of CVEs
- no daemon as root
- doesn't use webkit1,2
- doesn't use lib*v8 directly
- doesn't opens a port
- doesn't processe arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- doesn't deal with system authentication (eg, pam), etc)

But it
- parses data formats

And that in a way that if there is a bug in the code of the lib all applications using it would be affected.
Since the need pulling this in is for mail-auth we should ask security to take a look, it isn't too huge so it might be fast.

[Common blockers]
- no FTBFS issues
- tests are present
- no translation, but also not user visible
- no python package for further constraints on that

[Packaging red flags]
- no Ubuntu delta atm
- perl has no symbols tracking
- d/watch is ok
- regularly updated in Debian
- the current release is packaged
- not causing a MOTU problem
- a few, but no massive Lintian warnings
- d/rules is as small as it can be
- no golang constraints to consider
- Desktop team is already subscribed

[Upstream red flags]
- no Errors/warnings during the build
- no incautious use of malloc/sprintf
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of User nobody
- no use of setuid
- no known Important bugs (crashers, etc) in Debian or Ubuntu
- no Dependency on webkit, qtwebkit, seed or libgoa-*
- not part of UI design

[Mark Morlino (markmorlino)]

I reviewed libscalar-list-utils-perl 1:1.53-1 as checked into focal. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.
The guts of this perl module is in ListUtil.xs which is turned into C code. I did run that
portion of the build through coverity, which did not complain about anything I found to be
concerning.

libscalar-list-utils-perl is a replacement for the default List::Util distribution that
is built into perl core and adds some additional subroutines.

- CVE History:
  - no CVEs found
- Build-Depends:
  - perl
- pre/post inst/rm scripts?
  - not applicable
- init scripts?
  - not applicable
- systemd units?
  - not applicable
- dbus services?
  - not applicable
- setuid binaries?
  - not applicable
- binaries in PATH?
  - not applicable
- sudo fragments?
  - not applicable
- udev rules?
  - not applicable
- unit tests / autopkgtests?
  - there is a fairly comprehensive test suite
- cron jobs?
  - not applicable
- Build logs:
  - Everything looks fine
- Processes spawned?
  - not applicable
- Memory management?
  - I do not see anything that looks problematic
- File IO?
  - not applicable
- Logging?
  - not applicable
- Environment variable usage?
  - not applicable
- Use of privileged functions?
  - not applicable
- Use of cryptography / random number sources etc?
  - not applicable
- Use of temp files?
  - not applicable
- Use of networking?
  - not applicable
- Use of WebKit?
  - not applicable
- Use of PolicyKit?
  - not applicable

- Any significant cppcheck results?
  - not applicable
- Any significant Coverity results?
  - not applicable

Security team ACK for promoting libscalar-list-utils-perl to main.