[MIR] python-tornado

[Chuck Short]

Availability: Currently in universe
Rationale: Dependency for python-urllib3
Security: No security history.
Quality Assurance: Package works out of the box with no prompting. There is no major bugs in Ubuntu and the is no major bugs in Debian.
Standards Compliance: FHS and Debian Policy compliant.
Maintenance: Simple python package that the Ubuntu Server Team will take care of.
Dependencies: All are in main

[Michael Terry (mterry)]

Test suite should be run. PYTHONPATH=. pythonX.X tornado/test/runtests.py seems to do it. Looking further.

[Michael Terry (mterry)]

Looks fine once the tests are enabled. But since there is a recent history of CVEs (security update in precise), I'll pass over to Jamie for a quick audit.

[Jamie Strandboge (jdstrand)]

Security review:
* One CVE: CVE-2012-2374. Issue was fixed prompted and with a one line patch
* Python library
* Lintian clean, no initscripts/upstart jobs, no dbus services, not setuid/fscaps/sudo/pkexec, no cron jobs. Has a testsuite, but not enabled.
* Uses the system ca-certificates file. Defaults to certificate verification.
* Minor nit: demos have predictable filenames in /tmp

Conditional ACK provided the testsuite is enabled.

[Julian Taylor (jtaylor)]

what exactly does urrlib3 need tornado for?
it isn't clear to me from the package descriptions.

the testsuites aren't enabled in debian because some where failing and others required internet access. It could not be resolved before the debian freeze.

[Matthias Klose (doko)]

test/README reads:

Test coverage is almost non-existent, but it's a start. Be sure to
set PYTHONPATH apprioriately (generally to the root directory of your
tornado checkout) when running tests to make sure you're getting the
version of the tornado package that you expect.

[Jamie Strandboge (jdstrand)]

Is it possible to enable the testsuite based on Matthias' comments?

[Chuck Short (zulcss)]

I enabled the testsuite in the last upload.

[Jamie Strandboge (jdstrand)]

With the testsuite enabled, ACK. Please feel to seed or make this a dependency/recommends of another package in main.

[Dave Walker (davewalker)]

Override component to main
python-tornado 2.3-2ubuntu1 in quantal: universe/python -> main
1 publication overridden.

[Christian Ehrhardt  (paelzer)]

FYI
This was demoted in Bionic and later but now came back as dependency of the PCS stack (bug 1953341).
The new case is here: https://bugs.launchpad.net/ubuntu/+source/python-tornado/+bug/1990191