[MIR] tecla

[Jeremy Bícha]

[Availability]
The package tecla is already in Ubuntu universe.

[Rationale]
The package tecla is required in Ubuntu main because it is an expected dependency of both gnome-control-center 45 and gnome-shell 45. It will replace the source package libgnomekbd for Ubuntu Main and allow libgnomekbd to be demoted to Universe.

The package tecla is required in Ubuntu main no later than August 17 due to the need to package GNOME 45 Beta by Ubuntu 23.10 Feature Freeze

[Security]
- No CVEs/security issues in this software in the past

- no `suid` or `sgid` binaries
- no executables in `/sbin` and `/usr/sbin`
- Package does not install services, timers or recurring jobs
- Packages does not open privileged ports (ports < 1024)
- Packages does not contain extensions to security-sensitive software

[Quality assurance - function/usage]
- The package works well right after install

[Quality assurance - maintenance]
The package is maintained well in Debian/Ubuntu/Upstream and does
not have too many, long-term & critical, open bugs
- Ubuntu https://bugs.launchpad.net/ubuntu/+source/tecla
- Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=tecla
- Upstream https://gitlab.gnome.org/GNOME/tecla/-/issues

[Quality assurance - testing]
- The package does not run a test at build time because no upstream test suite is provided, the app is trivial, and there isn't a standards way of running automated tests for a purely graphical app like this one.

- The package does not run an autopkgtest because the app is trivial and we do not have a good system in place to autopkgtest purely graphical apps like this one.

- The package can not be tested at build or autopkgtest time. To make up for that here is a test plan:

https://wiki.ubuntu.com/DesktopTeam/TestPlans/tecla

[Quality assurance - packaging]
- debian/watch is present and works
(Actually, the Debian watch file follow Debian GNOME team conventions and only looks for stable, beta, or RC releases, but the only release so far is an Alpha. The Beta release is scheduled for early August.)

- debian/control defines a correct Maintainer field

- This package does not yield massive lintian Warnings, Errors

- Please link to a recent build log of the package
https://launchpad.net/ubuntu/+source/tecla/45~alpha-0ubuntu1/+latestbuild/amd64

- Lintian overrides are not present

- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies

- The package will be installed by default, but does not ask debconf

- Packaging and build is easy, link to debian/rules
https://salsa.debian.org/gnome-team/tecla/-/blob/debian/master/debian/rules

[UI standards]
- Application is end-user facing, Translation is present, via standard
intltool/gettext or similar build and runtime internationalization system

NOTE: This package is so new that it has not been translated yet but it is set up for translation via the standard meson gettext translations support. See po/POTFILES.in . There is only a single binary package for tecla and the translations will be automatically included in the binary package in a future release.

[Dependencies]
- No further depends or recommends dependencies that are not yet in main

[Standards compliance]
- This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- Owning Team will be Desktop Packages
- Team is not yet, but will subscribe to the package before promotion

- This does not use static builds
- This does not use vendored code
- This package is not rust based

- The package has been built in the archive more recently than the last test rebuild
https://launchpad.net/ubuntu/+source/tecla/45~alpha-0ubuntu1/+latestbuild/amd64

[Background information]
The Package description explains the package well
Upstream Name is tecla
Link to upstream project https://gitlab.gnome.org/GNOME/tecla

This package will be co-maintained with the Debian GNOME team.

[Jeremy Bícha (jbicha)]

W: tecla: no-manual-page [usr/bin/tecla]
I: tecla source: adopted-extended-field (in section for source) XSBC-Original-Maintainer [debian/control:9]

I: Lintian run was successful.

[Didier Roche-Tolomelli (didrocks)]

Review for Source Package: tecla

[Summary]
MIR team ACK, ready to be promoted once it gets the team bug subscriber.
This does not need a security review
List of specific binary packages to be promoted to main: tecla

[Duplication]
This package will replace libgnomekbd for Ubuntu Main and allow libgnomekbd to be demoted to Universe.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- tecla checked with `check-mir`
- all dependencies can be found in `seeded-in-ubuntu` (already in main)
- none of the (potentially auto-generated) dependencies (Depends
  and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats (files [images, video, audio,
  xml, json, asn.1], network packets, structures, ...) from
  an untrusted source.
- does not open a port/socket
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)

[Common blockers]
OK:
- does not FTBFS currently
- Is UI only and upstream provides no testsuite. There is a test plan and
  committment to cover that continuously.
- no new python2 dependency

[Packaging red flags]
OK:
- Ubuntu does not carry a delta (same package is currently in debian NEW and it will be resync)
- symbols tracking not applicable for this kind of code.
- debian/watch is present and looks ok
- New package, so hard to assess upstream and Debian/Ubuntu update history. However, it will follow GNOME releases.
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far
- no massive Lintian warnings
- debian/rules is rather clean
- It is not on the lto-disabled list

[Upstream red flags]
OK:
- no Errors/warnings during the build
- no incautious use of malloc/sprintf (as far as we can check it)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit, seed or libgoa-*
- part of the UI, desktop file is ok
- translation present (even if not yet fully translated, see description)

[Sebastien Bacher (seb128)]

I've subscribed desktop-packages now and will do the promotion once needed

[Sebastien Bacher (seb128)]

$ ./change-override -c main -B tecla
Override component to main
tecla 45~rc-1 in mantic: universe/gnome -> main
tecla 45~rc-1 in mantic amd64: universe/gnome/optional/100% -> main
tecla 45~rc-1 in mantic arm64: universe/gnome/optional/100% -> main
tecla 45~rc-1 in mantic armhf: universe/gnome/optional/100% -> main
tecla 45~rc-1 in mantic ppc64el: universe/gnome/optional/100% -> main
tecla 45~rc-1 in mantic riscv64: universe/gnome/optional/100% -> main
tecla 45~rc-1 in mantic s390x: universe/gnome/optional/100% -> main
Override [y|N]? y
7 publications overridden.