[MIR] nose as dependency of mailman3

[Christian Ehrhardt ]

[Availability]
The package is already universe for quite a while and build/works fine so far.
It is for example already used for https://lists.canonical.com/mailman3/postorius/lists/
OTOH it is a library that can/could be used for much more than just the mailman3 stack.

It builds on amd64 only (arch:all)

This package builds python2 and python3 binaries, but the transition to mailman3 will only pull in the python3 binaries.

[Rationale]
This is part of the MIR activity for all dependencies of mailman3
The "main" MIR of it is at:
https://bugs.launchpad.net/ubuntu/+source/mailman3/+bug/1775427
Mailman (2) has only python2 support, but we strive for python3,
therefore Mailman3 which has python3 support should be promoted to main.

On one hand I think to have nose - being a test tool - as a dependency is a packaging mistake.
We are ok to follow upstream to switch one day to the newer nose2 as this is discontinued as seen in this statement:
https://groups.google.com/forum/#!msg/nose-dev/rkofU1WdNNc/um9FRb19BQAJ
and the releases since then
https://github.com/nose-devs/nose/releases

[Security]

No known CVEs found.

[Quality assurance]

The mailman3 stacks as of now (Disco) installs fine and provides a base
config. But due to the nature of the package that needs further modification
to be of real use.

The package does not ask debconf questions.

5 very old Ubuntu bugs and 5 bugs in Debian - none severe enough to cause us any pain for now.
Upstream has 379 open and 458 closed issues - nothing very severe for our intentions.

The package gets regular updates by upstream and Debian.

No exotic HW involved.

The package utilizes build time self tests.

d/watch is set up and ok.

No Lintian warning except newer Standards/Compat versions and no HTTPS links uses or GPG checks - nothing severe.
A warning on prebuilt python objects is slightly interesting.

The package does not rely on demoted or obsolete packages.
py2 packages in this src, but as mentioned we won't pull them into main.
No new gt2k dependencies

As mentioned above nose itself is discontinued, but continued in nose2.
Pre discussion in the MIR Team meeting I'm filing it still.
Yet the expectation is that we sooner or later can get rid of it either entriely or in favor of nose2.

[UI standards]

This discovers and runs tests, it is able to use different languages to run the programs (test the internationalization of thise).
Itself it seems to have no translations embedded, but since it is developer and not end user centric that should be fine.

No End-user applications that needs a standard conformant desktop file.

[Dependencies]

Some dependencies are not in main, but we drive MIR for all related packages
that are not in main at the same time.
Please check the list of bugs from the main Mailman3 MIR to get an overview.

[Standards compliance]
The package meets the FHS and Debian Policy standards.
The packaging itself is very straight forward and uses dh_* as much as possible - the d/rules fits on one screen.

[Maintenance]

The Server team will subscribe for the package for maintenance due to being pulled in by mailman3 stack.
But I actually think this should be owned by foundations who generally own most of python* which this belongs much more to.
I added a team task flag to clarify that.

[Background]
The package description explains the general purpose and context of the package well.

[Christian Ehrhardt  (paelzer)]

This is a bit special as nose was already in main for quite some time.
It was in main up until (including) Xenial especially since back in the day build-dependencies needed to be in main as well.

It was dropped since then but had passed all the checks in the past already.

My intention initially was to cut the dependency from lazr.delegates but for now was convinced otherwise.
Therefore as discussed in yesterday's MIR team meeting [1] we are ok to - re-promote the package.

[1]: https://irclogs.ubuntu.com/2019/03/19/%23ubuntu-meeting.html#t14:12

P.S. I'll still suggest to Debian to remove the nose dep, so hopefully down he road it can be demoted again.

[Christian Ehrhardt  (paelzer)]

I couldn't find the old bug for sure, I think it might be bug 493594 where it was promoted as build-dependency.

Anyway - as discussed let's ack that as it was already in main before.

[Christian Ehrhardt  (paelzer)]

After evaluating dependencies, required further changes and mostly maintainability for security and packaging it was decided there are too many concerns - not about any single package in particular, but the overall Mailman3 stack - about the ability to maintain and monitor it as well as we need it for support in main.

We have closed the primary LP bug already, the MIRs that are already approved - like this one - will stay that way, but we will make no seed change to pull things in for now. Yet if other needs come up for those they have a prepared MIR already.
Other bugs which are not yet completed in terms of review will be closed as Won't Fix.

Even thou it ended being aborted, I think that is a valid outcome of the MIR evaluations. Never the less I want to thank everybody involved for all the work spent in what was nearly a year working through these MIRs.