[MIR] p7zip

[Bryan Quigley]

Availability: Very portable, available on all Ubuntu archs (x86_32/64). But not arm or powerpc for Ubuntu.. On Debian it is, available for them.

Rationale:
Primary reason is it's a dependency of UNetBootin, which we hope to get available for the default USB Creator job. (See blueprint and wiki page: https://blueprints.launchpad.net/ubuntu/+spec/community-1311-ubuntu-usb-startup-creator). Upstream is happy to do some other changes but using 7zip is really key for it being cross platform (Unetbootin also supports Windows & mac)
Note: we would specifically need the p7zip-full package for UNetBootin

It's also a nicer command line tool for extracting any compressed archive. Just run 7z e <anything> and it will extract it.

It could possibly replace some of the other compression libraries eventually.

Security:
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=7-zip
http://secunia.com/advisories/search/?search=p7zip
http://secunia.com/advisories/search/?search=7-zip

I don't see any of those CVEs being fixed in Debian or Ubuntu, so it would definitely need Security Team work that isn't being done right now, AFAICT.

I see no security issues of the package itself..

Quality assurance:
There are some old bugs in both bug trackers, didn't see any big blockers though:
http://bugs.debian.org/cgi-bin/pkgreport.cgi?pkg=p7zip;dist=unstable
https://launchpad.net/ubuntu/+source/p7zip/+bugs

Upstream has very long beta/alpha periods.

Unknown about a test suite.

Does include a debian/watch file.

Dependencies: Very simple, all in main.

Standards compliance: I believe this is true but I'm not qualified to evaluate the quality of the package.

Maintenance: Maintained in Debian, we just inherit. No new builds in quite a while, since January 2012.

Background information:
p7zip-full let's you create/edit in place/extract a large number of different archive types. The upstream is just called 7-zip.

[Michael Terry (mterry)]

There are several problems with p7zip:
* It uses built-in encoders/decoders for formats. This would be an ongoing maintenance and security problem. We already have encoders and decoders in main.
* It also pulls in a whole new toolkit (wxgtk2.8) which is a large burden for a package that we don't even envision using the GUI for.
* It seems like there are quite a few bugs and not a super lot of maintenance work on them in Debian and Ubuntu.

Is it possible to just patch unetbootin to use the main versions of any decoding formats it needs? (like call lzma instead of p7zip etc)

Also... is the plan to adopt unetbootin or rewrite it or something? My memories of unetbootin is that it was "ugly". If we are rewriting, surely we could rewrite in a way that wouldn't need p7zip.

[Bryan Quigley (bryanquigley)]

> Is it possible to just patch unetbootin to use the main versions of any decoding formats it needs? (like call > lzma instead of p7zip etc)
Initial answer was no, I'm asking for clarification. Upstream doesn't want to maintain separate code-paths for Linux and Windows/Mac.

> is the plan to adopt unetbootin or rewrite it or something?
We've found that our current solution is incredibly unreliable and a new solution is needed. Since we haven't been able to maintain our current solution, I suggested UNetBootIn because it is the biggest project of it's kind and will likely continue to be maintained and improved outside of Ubuntu. It would also let us customize UNetbootin for Windows/Mac deployment instead of using a third party.

Others *are* looking (in parallel) into trying to fix startup disk creator (and a first patch was just proposed). We are going to coordinate when we find which path is more sustainable.

>To the "ugly" part
New design work is being down as well as a port to QT5 has been proposed.

For reference:
https://bugs.launchpad.net/ubuntu/+source/usb-creator/ 128 New Bugs, 318 Open Bugs
https://bugs.launchpad.net/ubuntu/+source/unetbootin/ 10 New Bugs, 22 Open Bugs

[Launchpad Janitor (janitor)]

[Expired for p7zip (Ubuntu) because there has been no activity for 60 days.]