[MIR] python-s3transfer as indirect dependency of simplestreams (simplestreams -> python-boto3 -> python-s3transfer)

[Alberto Contreras]

[Availability]
The package python-s3transfer is already in Ubuntu universe.
The package python-s3transfer build for the architectures it is designed to work on.
They build amd64 only (but binary is arch-all)
Link to package https://launchpad.net/ubuntu/+source/python-s3transfer

[Rationale]
The package python-s3transfer is required in Ubuntu main for python-boto3
The package python-s3transfer will not generally be useful for a large part of
our user base, but is important/helpful still because it is required by python-boto3
which is in the MIR process as a dependency of simplestreams.
python-boto3 MIR link: https://bugs.launchpad.net/ubuntu/+source/python-boto3/+bug/2061217

- The package python-s3transfer is required in Ubuntu main through the same scheduled requested for the python-boto3 promotion, since python-boto3 depends on it.

[Security]
- No CVEs/security issues in this software in the past:
(0)https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=python-s3transfer
(0)https://security-tracker.debian.org/tracker/source-package/python-s3transfer
(0)https://ubuntu.com/security/cves?q=&package=python-s3transfer&priority=&version=&status=

No `suid` or `sgid` binaries
No executables in `/sbin` and `/usr/sbin`
Package does not install services, timers or recurring jobs
Packages does not open privileged ports (ports < 1024).
Package does not expose any external endpoints
Packages does not contain extensions to security-sensitive software
(filters, scanners, plugins, UI skins, ...)

[Quality assurance - function/usage]
The package works well right after install. It's a python library.

[Quality assurance - maintenance]
- The package is maintained well in Debian/Ubuntu/Upstream and does
  not have too many, long-term & critical, open bugs
  - Ubuntu (1)https://bugs.launchpad.net/ubuntu/+source/python-s3transfer/+bugs
  - Debian (0)https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=python-s3transfer
  - Upstream's bug tracker (24)https://github.com/boto/s3transfer/issues
    Looks normal for the age and impact of these libraries
- The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
- The package does not run a test at build time because it is not configured to do so,
the upstream source code contains unit tests
- The package does not run an autopkgtest because they are not configured to do so.

[Quality assurance - packaging]
- debian/watch is present and works
- debian/control defines a correct Maintainer field
- Lintian does not run as part of the build https://launchpadlibrarian.net/709963913/buildlog_ubuntu-noble-amd64.python-s3transfer_0.10.0-1_BUILDING.txt.gz
- Lintian output attached
- Lintian overrides are not present

- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies
- The package will not be installed by default
- Packaging and build is easy, link to debian/rules: https://git.launchpad.net/ubuntu/+source/python-s3transfer/tree/debian/rules

[UI standards]
- Application is not end-user facing (does not need translation)

[Dependencies]
- There are further dependencies that are not yet in main, MIR for them
  is at:
  - python-botocore: https://bugs.launchpad.net/ubuntu/+source/python-botocore/+bug/2061751

[Standards compliance]
- This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- The owning team will be Ubuntu Server and I have their acknowledgement for
  that commitment
- The future owning team is already subscribed to the package
- This does not use static builds
- This does not use vendored code
- This package is not rust based

[Background information]
The Package description explains the package well
Upstream Name is s3transfer
Link to upstream project https://github.com/boto/s3transfer

[Alberto Contreras (aciba)]

$ lintian --pedantic python-s3transfer_0.10.0-1.dsc

[Alberto Contreras (aciba)]

I am working on adding build / autopkg test in https://code.launchpad.net/~aciba/ubuntu/+source/python-s3transfer/+git/python-s3transfer/+merge/464413 .

[Christian Ehrhardt  (paelzer)]

Review for Source Package: python-s3transfer

[Summary]

MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.

List of specific binary packages to be promoted to main: python3-s3transfer

Specific binary packages built, but NOT to be promoted to main: <none>

This does need a security review, so I'll assign ubuntu-security

Some special conditions apply, please read bug 2061217 which has all those
details.

Required TODOs:
- #1 please add testing as discussed.

Recommended TODOs:
- #2 please update to the minor fix in 0.10.1
- #3 please update the package description to include the warning of this
     being good for use through boto3 but not for direct use. You can grab
     that from the projects webpage.

I've spoken with Alberto and he is already on extending the package to have
proper tests as well as considering the two recommended changes.

[Rationale, Duplication and Ownership]
Out of the stack around boto3 this is the only slight difference. boto already
had the boto interface for s3 and boto3 evolved on that. In fact the package
even suggests to only ever rely on the s3 interface in boto.
So there is another package in main providing the same high functionality:
python-boto. And that is what will be replaced via python-boto3 (bug 2061217),
But to be able to provide that it needs the low level functions in
python-s3transfer.
=> OK

A team is committed to own long term maintenance of this package.
=> Server, team-subscription already added

The rationale given in the report seems valid and useful for Ubuntu,
for simplestreams via the dependency as reported and for other of python-boto3.

Usually I suggest direct users of the lib as well, but in this case that should
be avoided (more on that below).

[Dependencies]
OK:
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

Problems:
- No other Dependencies to MIR due to this

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

Problems: None

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not expose any external endpoint (port/socket/... or similar)
- does not process arbitrary web content
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates,
  signing, ...)
- this makes appropriate (for its exposure) use of established risk
  mitigation features (being a lib only it can not yet know the use-case
  and thereby not define profiles)

Problems:
- does parse data formats in its interaction with the cloud. Since
  many other things nowadays also provide AWS compatible backends one
  can not safely...

[Christian Ehrhardt  (paelzer)]

Assigning to security

Please see https://bugs.launchpad.net/ubuntu/+source/python-boto3/+bug/2061217/comments/8 for details on delayed security reviews and why we want to accept this already.

[Alberto Contreras (aciba)]

New MR including 0.10.1 and tests: https://code.launchpad.net/~aciba/ubuntu/+source/python-s3transfer/+git/python-s3transfer/+merge/464461

[Christian Ehrhardt  (paelzer)]

[0] has completed, migrated out of proposed. It now runs tests at build time [2] and via autopkgtest-pkg-python [1].

[0]: https://launchpad.net/ubuntu/+source/python-s3transfer/0.10.1-1ubuntu2
[1]: https://autopkgtest.ubuntu.com/packages/p/python-s3transfer
[2]: https://launchpadlibrarian.net/725135509/buildlog_ubuntu-noble-amd64.python-s3transfer_0.10.1-1ubuntu2_BUILDING.txt.gz

[Christian Ehrhardt  (paelzer)]

Thanks also for the warning in the package description and rebasing this onto the fixes in 0.10.1-1

[Christian Ehrhardt  (paelzer)]

Full stack is ready now

Override component to main
python-s3transfer 0.10.1-1ubuntu2 in noble: universe/misc -> main
python3-s3transfer 0.10.1-1ubuntu2 in noble amd64: universe/python/optional/100% -> main
python3-s3transfer 0.10.1-1ubuntu2 in noble arm64: universe/python/optional/100% -> main
python3-s3transfer 0.10.1-1ubuntu2 in noble armhf: universe/python/optional/100% -> main
python3-s3transfer 0.10.1-1ubuntu2 in noble i386: universe/python/optional/100% -> main
python3-s3transfer 0.10.1-1ubuntu2 in noble ppc64el: universe/python/optional/100% -> main
python3-s3transfer 0.10.1-1ubuntu2 in noble riscv64: universe/python/optional/100% -> main
python3-s3transfer 0.10.1-1ubuntu2 in noble s390x: universe/python/optional/100% -> main
Override [y|N]? y
8 publications overridden.