[MIR] zope.component as dependency of mailman3

Bug #1820233 reported by Christian Ehrhardt  on 2019-03-15
This bug affects 1 person
Affects Status Importance Assigned to Milestone
zope.component (Ubuntu)
Ubuntu Security Team

Bug Description

The package is already universe for quite a while and build/works fine so far.
It is for example already used for https://lists.canonical.com/mailman3/postorius/lists/
OTOH it is a utility that can/could be used for much more than just the mailman3 stack.

This source builds python2 and python3 binaries (being compatible) but we will only pull in the python3 package as part of the switch to mailman3.

This is part of the MIR activity for all dependencies of mailman3
The "main" MIR of it is at bug 1775427:

Mailman (2) has only python2 support, but we strive for python3,
therefore Mailman3 which has python3 support should be promoted to main.

Old mailman2 had no zope, no code in this package seems to be ported from mailman2 (which would ease review).


No known CVEs found.
Zope in general has quite some hits, but this component seems not to be part of it.
=> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=zope

[Quality assurance]

As part of the mailman3 stacks as of now (Disco) this installs fine and works fine.
On itself it is useful to (many) other dependencies and does not need a post install configuration on its own.

The package does not ask debconf questions.

Zero known bugs in Ubuntu and Debian only has a request for an MIA uploader (but not the last one) for this component.

The package seems ok, but wasn't touched since the initial furry in late 2015/2016.
There are newer (minor) versions in pypi so we might want to bump them somewhen before 20.04 at least.
IMHO we are not in a hurry with this as long as it works fine.

No exotic HW involved.

The package utilizes build time self tests as well as some (rather trivial) smoke test as autopkgtest.

Lintian only reports very minor issues, mostly by being older (compat 9, no gpg check on watch, no https usage, ...)

The package does not rely on demoted or obsolete packages.

[UI standards]

This is a low level library without (a lot) of user visible strings - no translations (needed).
No End-user applications that needs a standard conformant desktop file.


Some dependencies are not in main, but we drive MIR for all related packages
that are not in main at the same time.
Please check the list of bugs from the main Mailman3 MIR in bug 1775427 in bug 1775427 to get an overview.

[Standards compliance]
The package meets the FHS and Debian Policy standards.
The packaging itself is very straight forward and uses dh_* as much as possible - the d/rules fits on one screen.


The Server team will subscribe for the package for maintenance, but in
general it seems low on updates and currently is a sync from Debian.

The package description explains the general purpose and context of the package well.

No duplication for this functionality in main at the moment.

[Embedded sources and static linking]
This package does not contain embedded library sources.
This package doe not statically link to libraries.
No Go package

I can confirm that there seems to be no CVE history for this zope component.
But there is CVE for zope in general, so maybe that package was just never reviewed by anyone.

It Does not:
- run a daemon as root
- uses old webkit
- uses lib*v8 directly
- opens a port
- uses centralized online accounts
- integrates arbitrary javascript into the desktop
- deals with system authentication

It does due to its integration into zope to some extend it indirectly:
- processes arbitrary web content
- parse data formats

Therefore to err on the side of caution I mark it for security review.

[Common blockers]
- builds fine at the moment
- utilizes build time self tests
- utilized (rather trivial) smoke test as autopkgtest.
- server Team committed to subscribe once this gets promoted (enough for now)
- code is not user visible, no translation needed
- dh_python is used
- package produces python2 bits, but they are not pulled into main by mailman3

[Packaging red flags]
- no current ubuntu Delta to evaluate
- no library with classic symbol tracking
- watch file is present
- Lintian warnings are present bug ok
- debian/rules is rather clean
- no usage of Built-Using
- no golang package that would make things harder
- I was concerned if the ZPL license would be ok (as I haven't touched it ever),
  but zope.interface already is in main with the same license so that must be ok.

Not perfect but ok:
- past updates to the package were sporadic (mostly as-is since intial packaging
- due to that the most current release is not packaged (only a minor upgrade)
- The server team already took a task to check viability to update to the newest version on pypi

[Upstream red flags]
- no suspicious errors during build
- it is pure python, so no incautious use of malloc/sprintf
- no use of sudo, gksu
- no use of pkexec
- no use of LD_LIBRARY_PATH
- no important open bugs
- no Dependency on webkit, qtwebkit, libgoa-*
- no embedded copies in upstream either

MIR Team Ack as the package seems small, easy and sane to me.
As outlined above due to its integration into the zope web stack
I'll assign to security for review.

Changed in zope.component (Ubuntu):
assignee: nobody → Ubuntu Security Team (ubuntu-security)
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers