Comment 1 for bug 1949776

Review for Package: wireplumber

[Summary]
- The essence of the review result from the MIR POV
MIR team ACK constrained to an answer or fix to the questions below.

Required TODOs:
- There is no autopkgtests here and there is no statement on why they can’t be included. Can you investigate aroud here to see if we can leverage the package quality this way and avoid regressions?

Recommended TODOs:
- As you mentioned, this FTBFS on s390x. Can you try building with the patch you mentioned (https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/1747) so that we can have s390x and promote them all in one go? Would be great to have it in debian and resync.

This does not need a security review
List of specific binary packages to be promoted to main: libwireplumber-0.4-0, wireplumber
Specific binary packages built, but NOT to be promoted to main: libwireplumber-0.4-dev, gir1.2-wp-0.4

[Duplication]
There is no other package in main providing the same functionality.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
 - checked with check-mir
 - not listed in seeded-in-ubuntu
 - none of the built reverse-depends are in universe
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
more tests now.

[Embedded sources and static linking]

OK:
- no embedded source present
- no static linking
- does not have odd Built-Using entries

OK:
- not a go package, no extra constraints to consider in that regard

[Security]

OK:
- history of CVEs does not look concerning
- does run a daemon as root, but the service files drops a lot of priviledges first
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats
- does not open a port/socket
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)

[Common blockers]

OK:
- does not FTBFS currently but on x390x (see recommended TODO on top)
- does have a test suite that runs at build time
- no new python2 dependency
- Python package, but using dh_python
- Go package, but using dh-golang

Problems:
- does not have autopkgtests

[Packaging red flags]

OK:
- Ubuntu does not carry a delta
- symbols tracking is in place
- d/watch is present and looks ok
- Upstream update history is good
- Debian/Ubuntu update history is good
- the current release is not packaged, but lag by only one minor version behind
- promoting this does not seem to cause issues for MOTUs that so far
- no massive Lintian warnings
- d/rules is rather clean
- It is not on the lto-disabled list

[Upstream red flags]

OK:
- no excessive Errors/warnings during the build
- no incautious use of malloc/sprintf (as far as we can check it)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests)
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- no dependency on webkit, qtwebkit, seed or libgoa-*
- not part of the UI for extra checks
- no translation present, but none needed for this case (not user visible)