Comment 3 for bug 1854849

[Summary]
- All looks pretty straight forward, MIR Team ack
- Needs security review (assigned)

[Duplication]
I first thought https://metacpan.org/pod/List::Util would be something else that sounds similar but it IS the same. I found no other such perl lib in main. And while one could say "just do it without the lib" it is fine that such helpers exist.

[Embedded sources and static linking]
- no embedded sources
- no (static) liking (perl)

[Security]
- no history of CVEs
- no daemon as root
- doesn't use webkit1,2
- doesn't use lib*v8 directly
- doesn't opens a port
- doesn't processe arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- doesn't deal with system authentication (eg, pam), etc)

But it
- parses data formats

And that in a way that if there is a bug in the code of the lib all applications using it would be affected.
Since the need pulling this in is for mail-auth we should ask security to take a look, it isn't too huge so it might be fast.

[Common blockers]
- no FTBFS issues
- tests are present
- no translation, but also not user visible
- no python package for further constraints on that

[Packaging red flags]
- no Ubuntu delta atm
- perl has no symbols tracking
- d/watch is ok
- regularly updated in Debian
- the current release is packaged
- not causing a MOTU problem
- a few, but no massive Lintian warnings
- d/rules is as small as it can be
- no golang constraints to consider
- Desktop team is already subscribed

[Upstream red flags]
- no Errors/warnings during the build
- no incautious use of malloc/sprintf
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of User nobody
- no use of setuid
- no known Important bugs (crashers, etc) in Debian or Ubuntu
- no Dependency on webkit, qtwebkit, seed or libgoa-*
- not part of UI design