Review for source package: src:ruby-json [Summary] Package src:ruby-json is a JSON library for Ruby. It is the "json" gem that was provided by bin:libruby3.3 before version 3.3.5-1, when it was separated into a package of its own for better maintenance.
MIR team ACK under the constraint to resolve the below listed required TODOs and as much as possible having a look at the recommended TODOs. This does need a security review, so I'll assign ubuntu-security. List of specific binary packages to be promoted to main: bin:ruby-json. Specific binary packages built, but NOT to be promoted to main: None Notes: #0 An MIR for src:ruby-json was approved in Kinetic, so this is a re-review: https://bugs.launchpad.net/ubuntu/+source/ruby-json/+bug/1990572 #1 Packages like pcs which used the "json" gem only depended on bin:libruby. They would now need to explicitly depend on bin:ruby-json. Required TODOs: #2 The package should get a team bug subscriber before being promoted. => Please have the Server team subscribed. #3 The latest upstream release 2.13.0 needs to packaged. Recommended TODOs: #4 There is an unresolved memory leak reported upstream. Would it be feasible to assess the security impact of it? How easy is it to simulate/reproduce it? https://github.com/ruby/json/issues/460 [Rationale, Duplication and Ownership] OK: - There is no other package in main providing the same functionality. - A team is committed to own long term maintenance of this package. => server - The rationale given in the report seems valid and useful for Ubuntu Problems: None [Dependencies] OK: - no other Dependencies to MIR due to this - src:ruby-json checked with `check-mir` - all dependencies can be found in `seeded-in-ubuntu` (already in main) - none of the (potentially auto-generated) dependencies (Depends and Recommends) that are present after build are not in main - no -dev/-debug/-doc packages that need exclusion - No dependencies in main that are only superficially tested requiring more tests now. Problems: None [Embedded sources and static linking] OK: - no embedded source present - no static linking - does not have unexpected Built-Using entries - not a go package, no extra constraints to consider in that regard - not a rust package, no extra constraints to consider in that regard - Does not include vendored code Problems: None [Security] OK: - does not run a daemon as root - does not use webkit1,2 - does not use lib*v8 directly - does not expose any external endpoint (port/socket/... or similar) - does not process arbitrary web content - does not use centralized online accounts - does not integrate arbitrary javascript into the desktop - does not deal with system authentication (eg, pam), etc) - does not deal with security attestation (secure boot, tpm, signatures) - does not deal with cryptography (en-/decryption, certificates, signing, ...) - this package does not need isolation features Problems: - likely to parse JSON data from untrusted sources - does have a history of CVEs, all with CVSS 7.5 https://security-tracker.debian.org/tracker/source-package/ruby-json [Common blockers] OK: - does not FTBFS currently - does have a test suite that runs at build time - test suite fails will fail the build upon error. - does have a non-trivial test suite that runs as autopkgtest - This does not need special HW for build or test - not a Python package - not a Go package Problems: None [Packaging red flags] OK: - Ubuntu does not carry a delta - symbols tracking not applicable for this kind of code - debian/watch is present and looks ok - Upstream update history is sporadic - Debian/Ubuntu update history is sporadic - promoting this does not seem to cause issues for MOTUs that so far maintained the package - no massive Lintian warnings - debian/rules is rather clean - It is not on the lto-disabled list Problems: - the current release (2.13.0) is not packaged [Upstream red flags] OK: - no Errors/warnings during the build - no incautious use of malloc/sprintf (the language has no direct MM) - no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests) - no use of user 'nobody' outside of tests - no use of setuid / setgid - no important open bugs (crashers, etc) in Debian or Ubuntu - no dependency on webkit, qtwebkit or libseed - not part of the UI for extra checks - no translation present, but none needed for this case (user visible)? Problems: - There is an unresolved memory leak reported upstream https://github.com/ruby/json/issues/460 ** Bug watch added: github.com/ruby/json/issues #460 https://github.com/ruby/json/issues/460 ** Changed in: ruby-json (Ubuntu) Assignee: Pushkar Kulkarni (pushkarnk) => Ubuntu Security Team (ubuntu-security) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2115398 Title: [MIR] ruby-json To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ruby-json/+bug/2115398/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
