[MIR] percona-xtradb-cluster-5.7, percona-xtrabackup, libdbd-mysql-perl

[Corey Bryant]

percona-xtradb-cluster-5.7
--------------------------
[Availability]
Currently in universe

[Rationale]
Percona XtraDB cluster is the database deployed with every OpenStack deployment performed and recommended by Canonical and therefore should be fully supported by Canonical and in Ubuntu Main.

[Security]
While there aren't CVEs open for percona-xtradb-cluster-5.7, it is the latest in a series of package versions where previous versions do have CVE histories as can be seen by searching for "percona-xtradb-cluster" at https://people.canonical.com/~ubuntu-security/cve/universe.html.

[Quality Assurance]
The package does prompt for a MySQL administrative "root" user password during install. Note that 2 systemd unit files are provided, one for the bootstrap node (can be started with 'systemctl start mysql@bootstrap') and another for non-bootstrap nodes (can be started with 'systemctl start mysql') in order to bootstrap a cluster. There are no major bugs in Ubuntu and there are no major bugs in Debian. Note that there are bugs currently open for prior versions of this package as can be seen at https://bugs.launchpad.net/ubuntu and searching for "percona-xtradb-cluster".

[Dependencies]
All are in main except for libdbd-mysql-perl

[Standards Compliance]
FHS and Debian Policy compliant.

[Maintenance]
?

[Background]
Percona XtraDB Cluster is based on the Percona Server database server and provides a High Availability solution. Percona XtraDB Cluster provides synchronous replication, supports multi-master replication, parallel applying on slaves, automatic node provisioning with primary focus on data consistency.

percona-xtrabackup
------------------
[Availability]
Currently in universe

[Rationale]
Percona XtraBackup is the backup utility that is used to backup Percona XtraDB cluster databases in OpenStack deployments performed and recommended by Canonical and therefore should be fully supported by Canonical and in Ubuntu Main.

[Security]
There are 2 CVEs listed for percona-xtrabackup at https://people.canonical.com/~ubuntu-security/cve/universe.html.

[Quality Assurance]
Package works out of the box with no prompting. There are no major bugs in Ubuntu. There is a "Grave" and a "Serious" bug open in Debian for old versions of the package.

[Dependencies]
All are in main except for libdbd-mysql-perl

[Standards Compliance]
FHS and Debian Policy compliant.

[Maintenance]
?

[Background]
Percona XtraBackup is an open-source hot backup utility for MySQL that doesn't lock your database during the backup. It can back up data from InnoDB, XtraDB and MyISAM tables on MySQL/Percona Server 5.1 and 5.5 servers, and has many advanced features.

libdbd-mysql-perl
-----------------
[Availability]
Currently in universe

[Rationale]
libdbd-mysql-perl is a dependency of percona-xtradb-cluster-5.7 and percona-xtrabackup.

[Security]
No security history.

[Quality Assurance]
Package works out of the box with no prompting. There are no major bugs in Ubuntu and there are no major bugs in Debian. Unit tests are run during build.

[Dependencies]
All are in main

[Standards Compliance]
FHS and Debian Policy compliant.

[Maintenance]
?

[Background]
Perl5 database interface to the MariaDB/MySQL database

[Christian Ehrhardt  (paelzer)]

Updated the tasks to assign Cyphermox as mentioned in the MIR Team Meeting of today

[Christian Ehrhardt  (paelzer)]

Subscribed Rbasak who seems to be the one working on this if approved.

[Mathieu Trudel-Lapierre (cyphermox)]

All these have a very active security history, it would be good to have an official buy-in from the Security team. They will also benefit from a security review.

I'm concerned by percona-xtrabackup, it does not seem well maintained in Debian, which increases the work for us. It is not up to date in the Ubuntu archive either. There's also a patch for mips assembler, which doesn't fill me with confidence.

percona-xtradb-cluster has had a lot of CVEs in the past. It also seems to be slightly out of date in the Ubuntu archive, and newer versions are not at all in Debian.

libdbd-mysql-perl is in a set of packages that we typically consider to be well-maintained in Debian, which is a good sign. Tests exists and are run at build time, that's good.

Are there any plans, any steps to move away from percona software, which seems to be relatively poorly maintained?

[Joshua Powers (powersj)]

Due to discussions with the security team and concerns around the supportability of Percona with respect to CVEs I am closing this MIR.