[MIR] tree

[Alexandre Esse]

[MIR] tree

[Availability]
The package tree is already in Ubuntu universe.
Tree is a general purpose utility that is built and works on all Ubuntu architectures.
Link to package https://launchpad.net/ubuntu/+source/tree

[Rationale]
The package tree is generally useful for a large part of our user base using the command-line. Tree itself is tiny, but is not currently seeded in our official images (albeit it is installed by default on a number of Ubuntu derivatives (Lubuntu - https://cdimage.ubuntu.com/lubuntu/releases/mantic/release/lubuntu-23.10-desktop-amd64.manifest , Xubuntu - https://cdimage.ubuntu.com/xubuntu/releases/mantic/release/xubuntu-23.10-desktop-amd64.manifest).
One specific reason for this MIR comes from the requirements of a commercial partner who would like to offer the tree command as part of their user experience on their Ubuntu based SDK images. This partner is working with the Canonical Partner Engineering team, albeit the maintenance of tree itself would likely be done by the Foundations team – this has been discussed with the Foundations team.
Package tree covers the same use case as ‘ls -lR’ or ‘find’, but is better because:
- It is specialized in directories tree rendering for command line interface, so it has a fancier output on a terminal.
- It provides machine-friendly output formats notably with its XML/JSON/HTML output formats.
- It would be useful to the community and to our partner to have “tree” in Ubuntu main, especially for their upcoming noble/24.04 based SDK.

[Security]
- Ubuntu CVE Tracker (https://ubuntu.com/security/cve?package=tree) : 0 results as of 2024-03-05.
- Debian Security Tracker: https://security-tracker.debian.org/tracker/source-package/tree: No issue as of 2024-03-05.
- Project Changelog: (CHANGES file: http://oldmanprogrammer.net/source.php?dir=projects/tree/CHANGES): No reference to any security issue.
- No CVEs/security issues (found) in this software in the past: NB: “tree” is a very commonly used keyword, notably in security vulnerabilities, but searching the CVE database for software names matching “tree” didn’t yield issues with the tree utility itself.
- no `suid` or `sgid` binaries: `find / -perm -u=s -type f 2>/dev/null | grep tree` returns nothing – it’s just providing a simple non-privileged command.
- `ls -l /usr/bin/tree` returns: `-rwxr-xr-x 1 root root 85400 Dec 12 16:06 /usr/bin/tree`.
- no executables in `/sbin` and `/usr/sbin`: `dpkg -L tree | grep sbin` returns nothing, it’s really just /usr/bin/tree.
- Package does not install services, timers or recurring jobs.
- Packages does not open privileged ports (ports < 1024).
- Package does not expose any external endpoints.
- I didn't spot any deprecated security algorithm in use.

[Quality assurance - function/usage]
- The package works well right after install and can be used to list the contents of directories.

[Quality assurance - maintenance]
The package is maintained well in Debian/Ubuntu/Upstream and does not have too many, long-term & critical, open bugs:
- Launchpad Bug Tracker (https://launchpad.net/ubuntu/+source/tree/+bugs): 2 bugs reported in Ubuntu:
  * One issue seems pretty serious (buffer overflow), and there were fixes in the upstream sources that could correspond, however this bug wasn’t forwarded back then and there is no data to reproduce it – we’ve pinged the bug to request a copy of the data and to try to reproduce with a more recent version.
  * One issue is a feature request
- Debian https://bugs.debian.org/src:tree / https://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=both;package=tree :
  * One resolved serious bug can be found on debian archived bug history.

Releases are relatively regular for a mature utility such as tree. Upstream recently changed its home site and seems responsive.
$ grep ^Version CHANGES
Version 2.1.1 (05/31/2023)
Version 2.1.0 (12/26/2022)
Version 2.0.4 (09/06/2022)
Version 2.0.3 (08/26/2022)
Version 2.0.2 (02/16/2022)
Version 2.0.1 (01/03/2022)

The package does not deal with exotic hardware we cannot support.

[Quality assurance - testing]
There are no unit tests in the sources, and the autopkgtest (https://autopkgtest.ubuntu.com/packages/tree) is relatively trivial, but this seems adequate given this command-line utility.
A recent amd64 build log shows no warning nor errors: https://launchpadlibrarian.net/702286929/buildlog_ubuntu-noble-amd64.tree_2.1.1-2_BUILDING.txt.gz

[Quality assurance - packaging]
- debian/watch is present and works.
- debian/control defines a correct Maintainer field (currently: Florian Ernst <email address hidden>).
- Running `lintian --pedantic` on tree_2.1.1-2_amd64.deb doesn’t output anything.
- This package does not rely on obsolete or about to be demoted packages.
- There is no Debconf questions with this package.
- Packaging and build is easy, (link to debian/rules: https://git.launchpad.net/ubuntu/+source/tree/tree/debian/rules?h=applied/ubuntu/noble).

[UI standards]
Tree is a command line tool application with no real requirement for translation (man pages used to be available in french but got removed with package version 2.1.0-1).
There is no desktop file.

[Dependencies]
tree package (2.1.1-2) only depends on libc6 (>= 2.38) (:already in main).

[Standards compliance]
- This package correctly follows FHS and Debian Policy.

[Maintenance/Owner]
- The future owning team is not yet subscribed, but will subscribe to the package before promotion.
- tree does not use static builds nor vendored code.
- This package is not rust based.
- The package successfully built during the most recent test rebuild (https://launchpad.net/ubuntu/+source/tree/2.1.1-2).

[Background information]
The Package description explains the package well.
Link to upstream project: http://oldmanprogrammer.net/source.php?dir=projects/tree

[Alexandre Esse (ahresse)]

Github issue related to this MIR: https://github.com/canonical/ubuntu-mir/issues/52

[Łukasz Zemczak (sil2100)]

I think it makes sense for the Foundations team to own this package. I have subscribed foundations-bugs to the source package already.

[Ioanna Alifieraki (joalif)]

Review for Source Package: tree

[Summary]
This is mature software and the pacakge is in pretty good state.
They only problem is missing tests at build time.
MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.
This does not need a security review
List of specific binary packages to be promoted to main: tree
Specific binary packages built, but NOT to be promoted to main: <None>

Notes:
Required TODOs:
1. There are no tests running at build time. Could you please add some ?
   This could be the same tests with autopackage test, but running at build time,
   and fail the build in case of an error.

- The package should get a team bug subscriber before being promoted

[Rationale, Duplication and Ownership]
There are other packages in main providing the same functionality, however tree is better
and makes sense to have it in main.
Foundations team is committed to own long term maintenance of this package.
The rationale given in the report seems valid and useful for Ubuntu

[Dependencies]
OK:
- no other Dependencies to MIR due to this
 - SRCPKG checked with `check-mir`
 - all dependencies can be found in `seeded-in-ubuntu` (already in main)
 - none of the (potentially auto-generated) dependencies (Depends
   and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

Problems: None

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

Problems: None

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats (files [images, video, audio,
  xml, json, asn.1], network packets, structures, ...) from
  an untrusted source.
- does not expose any external endpoint (port/socket/... or similar)
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates,
  signing, ...)

Problems: None

[Common blockers]
OK:
- does not FTBFS currently
- does have a non-trivial test suite that runs as autopkgtest
- This does not need special HW for build or test
- no new python2 dependency

Problems:
- does not have a test suite that runs at build time

[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- symbols tracking not applicable for this kind of code.
- debian/watch is present and looks ok (if needed, e.g. non-native)
- Upstream update history is good
- Debian/Ubuntu update history is good
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far
  maintained the package
- no mas...

[Mark Esler (eslerm)]

Security is not asking to review this for NN, but this might have odd code.

```
/* Should probably use strdup(), but we like our xmalloc() */
#define scopy(x) strcpy(xmalloc(strlen(x)+1),(x))
```

[Lukas Märdian (slyon)]

Bypassing security-review, as per "This does not need a security review". So we'd still need the tests fixed before this is ready.

[Alexandre Esse (ahresse)]

Here is a proposition of testsuite introduction with https://gitlab.com/OldManProgrammer/unix-tree/-/merge_requests/19/diffs

[Loïc Minier (lool)]

Uploaded debdiff adding a basic unit test framework from upstream gitlab merge proposal to noble as tree 2.1.1-2ubuntu1

[Lukas Märdian (slyon)]

Thanks. I can see `dh_auto_test` being executed in the latest build logs. Package has a team-bug-subscriber (~foundations-bugs, comment #2). No other MIR requirements (comment #3).

Please move ahead and deploy the seed/dependency change to pull "tree" into main.

[Mate Kukri (mkukri)]

Someone please sponsor, this fixes a clitest autopkgtest regression caused by the introduction of the test framework patch.