[MIR] wsdd

[Sebastien Bacher]

[Availability]
The package wsdd is already in Ubuntu universe.
The package wsdd build for the architectures it is designed to work on.
It currently builds and works for architectures: amd64 as a python arch-all package
Link to package https://launchpad.net/ubuntu/+source/wsdd

[Rationale]
- The package wsdd is required in Ubuntu main for enabling win10 shares discovery in nautilus.
- The package wsdd will generally be useful for a large part of our user base
- There is no other/better way to solve this that is already in main or
  should go universe->main instead of this.
- The binary package wssd needs to be in main to achieve shares enumeration in gvfs/nautilus. We don't plan to install wsdd-server which will stay in universe.
- The package wsdd is required in Ubuntu main no later than August 15th due to Oracular feature freeze.

[Security]
- No CVEs/security issues in this software in the past
- no `suid` or `sgid` binaries
- no executables in `/sbin` and `/usr/sbin`
- Package does install an user service which is going to be started by the corresponding gvfs backend
- Package does not install services, timers or recurring jobs
- Packages does not open privileged ports (ports < 1024).
- Package does not expose any external endpoints
- Packages does not contain extensions to security-sensitive software

[Quality assurance - function/usage]
- The package works well right after install

[Quality assurance - maintenance]
- The package is maintained well in Debian/Ubuntu/Upstream and does
  only has a wishlist request open in Debian and minor bugs upstream
  - Ubuntu https://bugs.launchpad.net/ubuntu/+source/wsdd/+bug
  - Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=wsdd
  - Upstream's bug tracker, https://github.com/christgau/wsdd/issues
- The package has no important open bugs
- The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
- The package runs a test suite on build time, if it fails
it makes the build fail, link to build log
1ubuntu1

- The package runs an autopkgtest, and is currently passing on
  amd64 arm64 armhf i386 ppc64el s390x
  https://autopkgtest.ubuntu.com/packages/w/wsdd

- The package does have not failing autopkgtests right now

[Quality assurance - packaging]
- debian/watch is present and works

- debian/control has a valid Maintainer definition

- This package has no lintian warnings
- Lintian overrides are not present

- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies

- The package will be installed by default, but does not ask debconf questions

- Packaging and build is easy, https://salsa.debian.org/grantma/wsdd/-/blob/master/debian/rules

[UI standards]
- Application is not end-user facing (does not need translation)

[Dependencies]
- No further depends or recommends dependencies that are not yet in main

[Standards compliance]
- This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- The owning team will be desktop-packages and I have their acknowledgement for that commitment
- The future owning team is already subscribed to the package

- This does not use static builds
- This does not use vendored code
- This package is not rust based

- The package has been built in the archive more recently than the last test rebuild

[Background information]
The Package description explains the package well
Upstream Name is wsdd
Link to upstream project https://github.com/christgau/wsdd

The desktop integration is done via a gvfs service (/usr/libexec/gvfsd-wsdd), which is already enabled in the Noble package but requires the wsdd backend to be installed to do anything.

The backend was added in https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/186

The shares listed by that services are added to the network backend and listed in the corresponding nautilus section (in the 'other locations' entry of the sidebar)

[Sebastien Bacher (seb128)]

Lintian's output

# lintian --pedantic wsdd_0.8-1_amd64.changes
W: wsdd: groff-message troff:<standard input>:145: error: character '*' is not allowed as a starting delimiter [usr/share/man/man1/wsdd.1.gz:1]
W: wsdd: groff-message troff:<standard input>:145: error: character '*' is not allowed as a starting delimiter [usr/share/man/man1/wsdd.1.gz:2]
P: wsdd source: package-uses-old-debhelper-compat-version 11
P: wsdd source: trailing-whitespace [debian/control:55]
P: wsdd source: trailing-whitespace [debian/control:5]
P: wsdd source: trailing-whitespace [debian/rules:31]
P: wsdd source: uses-debhelper-compat-file [debian/compat]

[Sebastien Bacher (seb128)]

@MIRteam, I'm submitting the report while we still have several identified 'TOFIX' which we are working on addressing because I believe it will require a security team review and I would like to get it in their backlog already, feel free to postpone to MIR review side until we land those fixes if you prefer.

[Launchpad Janitor (janitor)]

This bug was fixed in the package wsdd - 2:0.8-1ubuntu1

---------------
wsdd (2:0.8-1ubuntu1) oracular; urgency=medium

  * Enable regression tests at build time (LP: #2070025)

 -- Alessandro Astone <email address hidden> Fri, 21 Jun 2024 17:03:37 +0200

[Sebastien Bacher (seb128)]

Jeremy referenced the wrong bug in the changelog, reopening

[Christian Ehrhardt  (paelzer)]

Trying to take a look at this to speed it up as requested...

[Christian Ehrhardt  (paelzer)]

Review for Source Package: wsdd

[Summary]
MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.

This does need a security review, so I'll assign ubuntu-security

List of specific binary packages to be promoted to main: wsdd
Specific binary packages built, but NOT to be promoted to main: wsdd-server

Notes:
Required TODOs:
- #1 The build time tests you added are nice, but they just check for a few
  known regressions. Is there any chance to test for the function that you
  want to support from nautilus in an autopkgtest? We'd not mind where that
  is implemented, e.g. if you say this is easier from nautilus than from wsdd
  that would be ok.
  You are the experts, so feel free to correct me. But I'd think of something
  like setting up samba + wsdd-server on one side of a network and
  nautilus + wsdd on the other checking if it finds the shares. The samba
  tests themselve do a lot of this, feel free to copy what you need.
  (this one is already on your known to-do list in your report, thanks!)
- #2 Please consider adding a d/watch file
  (this one is already on your known to-do list in your report, thanks!)
- #3 Given the known security issues that even the package description states
  and furthermore the use in user context suggests that we should add a pretty
  strict apparmor profile before we promote it. Could you please have a look
  at that?
- #4 I failed to see how this will be used from nautilus, which makes it hard
  to rate the risk and exposure. I assume the security team wants to know
  as well. To avoid everyone searching for that, would you mind outlining how
  the "wsdd is required in Ubuntu main for enabling win10 shares discovery
  in nautilus" described by you will work in detail? Which component will call
  which other in which environment and with which options to achieve that?

Recommended TODOs:
- #4 Just to be nice and to further add on the "should be behind firewall" case,
  upstream provides example config for ufw and firewalld. It might make sense
  to ship those as part of wsdd which would also fix
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073265

[Rationale, Duplication and Ownership]
There is no other package in main providing the same functionality.
There is wsdd2, obviously similar but less maintained and in universe as well.

A team is committed to own long term maintenance of this package => Desktop

The rationale given in the report seems valid and useful for Ubuntu.

[Dependencies]
OK:
- no other Dependencies to MIR due to this. wsdd-server is held back by choice
  not by dependencies.
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

Problems: None

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking (python)
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

Problems: None

[Security]
OK:
- does not run a daemon as root (this is only for wsdd)
- d...

[Sebastien Bacher (seb128)]

Updating the description, a new revision has been uploaded adding the debian/watch, fixing the lintian warnings and enabling autpkgtests

[Sebastien Bacher (seb128)]

I've added some details on how nautilus access the feature in the 'Background information' section

[Sebastien Bacher (seb128)]

And updated the autopkgtest section, we have some now and they are green, https://autopkgtest.ubuntu.com/packages/w/wsdd