Activity log for bug #2060035

Date Who What changed Old value New value Message
2024-04-02 13:27:56 Sebastien Bacher bug added bug
2024-04-02 13:28:17 Sebastien Bacher bug added subscriber MIR approval team
2024-04-02 14:42:06 Lukas Märdian msgraph (Ubuntu): assignee Lukas Märdian (slyon)
2024-04-04 12:16:50 Sebastien Bacher description [Availability] The package msgraph is already in Ubuntu universe. The package msgraph build for the architectures it is designed to work on. It currently builds and works for architectures: amd64 arm64 armhf ppc64el riscv64 s390x Link to package https://launchpad.net/ubuntu/+source/msgraph [Rationale] - The package msgraph is required in Ubuntu main to be able to enable Microsoft OneDrive support in GNOME - The package msgraph will generally be useful for a large part of our user base - There is no other/better way to solve this that is already in main or should go universe->main instead of this. - The binary package libmsgraph-0-1 needs to be in main to turn on the onedrive support in gnome-online-accounts - We would like to enable the onedrive support in 24.04.1 if possible but it's not an hard commitment. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Security has been kept in mind and common isolation/risk-mitigation patterns are in place utilizing the following features: TBD (add details and links/examples about things like dropping permissions, using temporary environments, restricted users/groups, seccomp, systemd isolation features, apparmor, ...) - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails it makes the build fail, link to build log https://launchpadlibrarian.net/720553048/buildlog_ubuntu-noble-amd64.msgraph_0.2.1-0ubuntu1_BUILDING.txt.gz < to be updated once the infra catches up with the recent upload > - The package runs an autopkgtest, and is currently passing on this TBD list of architectures, link to test logs https://autopkgtest.ubuntu.com/packages/m/msgraph - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is present and works - debian/control defines a correct Maintainer - This package has minor lintian warnings # lintian --pedantic msgraph_0.2.1-0ubuntu1_amd64.changes E: libmsgraph-0-1: custom-library-search-path RUNPATH /usr/lib/x86_64-linux-gnu/libmsgraph [usr/lib/x86_64-linux-gnu/libmsgraph-0.so.0.2.1] W: libmsgraph-doc: stray-devhelp-documentation [usr/share/doc/msgraph-0/msgraph-0.devhelp2] The first one is because the upstream project uses an inconsistant naming (libmsgraph vs msgraph), we will add an override The devhelp one will be fixed in the next upload - Please link to a recent build log of the package https://launchpadlibrarian.net/720553048/buildlog_ubuntu-noble-amd64.msgraph_0.2.1-0ubuntu1_BUILDING.txt.gz - Lintian overrides are not present - This package does not rely on obsolete or about to be demoted packages. - This package has no python2 or GTK2 dependencies - The package will be installed by default, but does not ask debconf questions - Packaging and build is easy, link to debian/rules https://salsa.debian.org/gnome-team/msgraph/-/blob/debian/latest/debian/rules [UI standards] - Library is not end-user facing (does not need translation) [Dependencies] - No further depends or recommends dependencies that are not yet in main [Standards compliance] - This package correctly follows FHS and Debian Policy [Maintenance/Owner] - The future owning team (desktop-packages) is already subscribed to the package - This does not use static builds - This does not use vendored code - This package is not rust based - The package has been built in the archive more recently than the last test rebuild [Background information] The Package description explains the package well Upstream Name is msgraph Link to upstream project https://gitlab.gnome.org/GNOME/msgraph [Availability] The package msgraph is already in Ubuntu universe. The package msgraph build for the architectures it is designed to work on. It currently builds and works for architectures: amd64 arm64 armhf ppc64el riscv64 s390x Link to package https://launchpad.net/ubuntu/+source/msgraph [Rationale] - The package msgraph is required in Ubuntu main to be able to enable Microsoft OneDrive support in GNOME - The package msgraph will generally be useful for a large part of our user base - There is no other/better way to solve this that is already in main or   should go universe->main instead of this. - The binary package libmsgraph-0-1 needs to be in main to turn on the onedrive support in gnome-online-accounts - We would like to enable the onedrive support in 24.04.1 if possible but it's not an hard commitment. [Security] - No CVEs/security issues in this software in the past - no `suid` or `sgid` binaries - no executables in `/sbin` and `/usr/sbin` - Package does not install services, timers or recurring jobs - Security has been kept in mind and common isolation/risk-mitigation   patterns are in place utilizing the following features:   TBD (add details and links/examples about things like dropping   permissions, using temporary environments, restricted users/groups,   seccomp, systemd isolation features, apparmor, ...) - Packages does not open privileged ports (ports < 1024). - Package does not expose any external endpoints - Packages does not contain extensions to security-sensitive software [Quality assurance - function/usage] - The package works well right after install [Quality assurance - maintenance] - The package does not deal with exotic hardware we cannot support [Quality assurance - testing] - The package runs a test suite on build time, if it fails   it makes the build fail, link to build log https://launchpadlibrarian.net/720553048/buildlog_ubuntu-noble-amd64.msgraph_0.2.1-0ubuntu1_BUILDING.txt.gz < to be updated once the infra catches up with the recent upload > - The package runs an autopkgtest, and is currently passing on arm64 ppc64el s390x https://autopkgtest.ubuntu.com/packages/m/msgraph i386 is failing due installability issues of other components and isn't a target architecture - The package does have not failing autopkgtests right now [Quality assurance - packaging] - debian/watch is present and works - debian/control defines a correct Maintainer - This package has minor lintian warnings # lintian --pedantic msgraph_0.2.1-0ubuntu1_amd64.changes E: libmsgraph-0-1: custom-library-search-path RUNPATH /usr/lib/x86_64-linux-gnu/libmsgraph [usr/lib/x86_64-linux-gnu/libmsgraph-0.so.0.2.1] W: libmsgraph-doc: stray-devhelp-documentation [usr/share/doc/msgraph-0/msgraph-0.devhelp2] The first one is because the upstream project uses an inconsistant naming (libmsgraph vs msgraph), we will add an override The devhelp one is wrong and it's not an issue in newer versions - Please link to a recent build log of the package https://launchpadlibrarian.net/720553048/buildlog_ubuntu-noble-amd64.msgraph_0.2.1-0ubuntu1_BUILDING.txt.gz - Lintian overrides are not present - This package does not rely on obsolete or about to be demoted packages. - This package has no python2 or GTK2 dependencies - The package will be installed by default, but does not ask debconf questions - Packaging and build is easy, link to debian/rules https://salsa.debian.org/gnome-team/msgraph/-/blob/debian/latest/debian/rules [UI standards] - Library is not end-user facing (does not need translation) [Dependencies] - No further depends or recommends dependencies that are not yet in main [Standards compliance] - This package correctly follows FHS and Debian Policy [Maintenance/Owner] - The future owning team (desktop-packages) is already subscribed to the package - This does not use static builds - This does not use vendored code - This package is not rust based - The package has been built in the archive more recently than the last   test rebuild [Background information] The Package description explains the package well Upstream Name is msgraph Link to upstream project https://gitlab.gnome.org/GNOME/msgraph
2024-04-09 12:42:50 Lukas Märdian msgraph (Ubuntu): assignee Lukas Märdian (slyon)
2024-04-09 12:44:39 Lukas Märdian msgraph (Ubuntu): status New Incomplete
2024-04-09 13:37:49 Lukas Märdian msgraph (Ubuntu): status Incomplete Confirmed
2024-04-09 13:37:55 Lukas Märdian msgraph (Ubuntu): assignee Ubuntu Security Team (ubuntu-security)
2024-04-09 22:13:34 Mark Esler tags sec-4054
2024-04-15 07:37:59 Alex Murray msgraph (Ubuntu): assignee Ubuntu Security Team (ubuntu-security)
2024-04-16 15:02:47 Christian Ehrhardt  msgraph (Ubuntu): status Confirmed In Progress
2024-04-18 19:43:37 Lukas Märdian msgraph (Ubuntu): status In Progress Fix Committed
2024-04-19 06:39:33 Christian Ehrhardt  msgraph (Ubuntu): status Fix Committed Fix Released