Ubuntu
gnome-sushi package

[MIR] gnome-sushi

Bug #1998862 reported by Jeremy Bícha on 2022-12-05

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	gnome-sushi (Ubuntu)	Incomplete	Undecided	Jeremy Bícha

Bug Description

[Availability]
The package gnome-sushi is already in Ubuntu universe.
The package gnome-sushi builds for the architectures it is designed to work on (all Ubuntu architectures except i386 which isn't needed)
https://launchpad.net/ubuntu/+source/gnome-sushi

[Rationale]
Sushi has been a part of GNOME Core since I think GNOME 3.2. It was included in the obsolete Ubuntu GNOME flavor. Although proposed for inclusion in the default Ubuntu install years ago, it just wasn't a high priority before. Generally, we want to include GNOME Core features in Ubuntu Desktop unless we have good reason not to.

Sushi is a quick file previewer that extends the default file browser Nautilus.

https://help.ubuntu.com/stable/ubuntu-help/files-preview.html

https://discourse.ubuntu.com/t/proposal-sushi-installed-by-default-as-file-previewer/28322

It is requested in Ubuntu main no later than February 23 because that's Feature Freeze for Ubuntu 23.04.

[Security]
- Had 1 security issue in the past
  + CVE-2019-19308 fixed in Ubuntu 22.04 LTS, unfixed in Ubuntu 20.04 LTS
    * https://security-tracker.debian.org/tracker/CVE-2019-19308
    * https://ubuntu.com/security/CVE-2019-19308 (tracker outdated)

- no `suid` or `sgid` binaries
- no executables in `/sbin` and `/usr/sbin`
- ***Package does install services, timers or recurring jobs***
  + a NautilusPreviewer D-Bus service
    * Which has the following security feature: webkitgtk sandbox
    * Because it's a separate process, a Sushi crash won't also crash Nautilus
- Packages does not open privileged ports (ports < 1024)
- Packages does not contain extensions to security-sensitive software

[Quality assurance - function/usage]
- The package works well right after install

[Quality assurance - maintenance]
- The package is maintained well in Debian/Ubuntu and has not too many open Ubuntu bug reports except for this MIR. No open Debian bugs.

- Ubuntu https://bugs.launchpad.net/ubuntu/+source/gnome-sushi
- Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=gnome-sushi
- The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
- The package does not run a test at build time because it's basically a graphical app and tests haven't been written.

- The package does not run an autopkgtest because same reason.

- TODO: To make up for that, the Desktop Team will add a manual test plan to https://wiki.ubuntu.com/CategoryDesktopTestPlans

[Quality assurance - packaging]
- debian/watch is present and works

- debian/control defines a correct Maintainer field

- This package does not yield massive lintian Warnings, Errors

- Please link to a recent build log of the package
https://launchpad.net/ubuntu/+source/gnome-sushi/43.0-2/+build/24903326

- Please attach the full output you have got from `lintian --pedantic` as an extra post to this bug.

- This package does not rely on obsolete or about to be demoted packages.

- This package has no python2 or GTK2 dependencies

- The package will be installed by default and does not ask debconf questions

- Packaging and build is easy using dh7 style rules
https://salsa.debian.org/gnome-team/gnome-sushi/-/blob/debian/master/debian/rules

[UI standards]
- Application is end-user facing, Translation is present, via standard
intltool/gettext or similar build and runtime internationalization

- End-user applications without desktop file, not needed because this is basically an extension to Nautilus which does provide a desktop file.

[Dependencies]
- No further depends or recommends dependencies that are not yet in main

[Standards compliance]
- This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- Owning Team will be Desktop Packages
- Team is not yet not yet, but will subscribe to the package before promotion

- This does not use static builds
- This does not use vendored code
- This package is not rust based
- The package has been built in the archive more recently than the last test rebuild

[Background information]
The upstream project name is "Sushi". The package is named GNOME Sushi in Debian and Ubuntu to avoid potential name conflicts.

Link to upstream code:
https://gitlab.gnome.org/GNOME/sushi

The upstream project is currently without a dedicated maintainer. However, the feature does work.

Because it doesn't have a dedicate maintainer, there was a suggestion to remove it from GNOME Core, but it was decided that there wasn't enough reason to remove it.
https://gitlab.gnome.org/GNOME/gnome-build-meta/-/issues/525

See original description

Tags:

Jeremy Bícha (jbicha) on 2022-12-05

Changed in gnome-sushi (Ubuntu):
status:	New → Incomplete

Revision history for this message

Jeremy Bícha (jbicha) wrote on 2022-12-06:

lintian output
--------------
W: gnome-sushi: no-manual-page [usr/bin/sushi]
I: gnome-sushi: spelling-error-in-binary Wheter Whether [usr/lib/x86_64-linux-gnu/sushi/libsushi-1.0.so]
P: gnome-sushi source: update-debian-copyright 2011 vs 2022 [debian/copyright:25]

description:	updated
Changed in gnome-sushi (Ubuntu):
status:	Incomplete → New
description:	updated

Jeremy Bícha (jbicha) on 2022-12-06

description:

updated

Jeremy Bícha (jbicha) on 2022-12-06

description:

updated

Lukas Märdian (slyon) on 2022-12-06

Changed in gnome-sushi (Ubuntu):
assignee:	nobody → Didier Roche-Tolomelli (didrocks)

Revision history for this message

Didier Roche-Tolomelli (didrocks) wrote on 2023-01-10:

Download full text (4.6 KiB)

Review for Package: gnome-sushi

[Summary]
There are too many opened issues to give a MIR ack right away. Please for your next MIR, ensure you do a real check of the package (dependencies on universe binary package is a check that the reporter should do) and that there are no remaining TODOs before setting the bug report to "New" for MIR team consideration.
Also, it’s as it’s depending on webkit, this will need a security review. They will be assigned once the MIR is acked.

Specific binary packages built, but NOT to be promoted to main: gnome-sushi

Notes:
Required TODOs:
- Write the testplan for this package to cope for non build nor autopkgtests tests. I would really prefer this to be done prior MIR, as it’s always time consuming to go back to a MIR, reread and get the context to check the testplan is valid. Please consider that for future MIR or keep the MIR incomplete until you have the time to do so.
- Some dependencies are still in universe like gir1.2-gtksource-4. Please check all dependencies of the binaries you want to promote, file MIR as needed and mention them in the description.
- There is no symbol tracking in place, only a shlibs. We require symbol tracking for all new packages entering main. However, if the lib is only used by gnome-sushi, this could be relaxed. Please state so explicitely in the MIR descriptiuon.
Recommended TODOs:
- As you identified some lintian warning which are not due to upstream code and which easy to fix, please fix them to not clutter the build output.
- There are a couple of upstream warnings during package build. Please report them upstream (seems deprecation warnings, so should be easy enough to propose a patch upstream).

[Duplication]
There is no other package in main providing the same functionality.

[Dependencies]
OK:
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring more tests now.

Problems:
- Some dependencies are still in universe like gir1.2-gtksource-4. Please check all dependencies of the binaries you want to promote, file MIR as needed and mention them in the description.

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats (files [images, video, audio, xml, json, asn.1], network packets, structures, ...) from an untrusted source.
- does not open a port/socket
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)

Note: the parsing is done within the process, but with external libraries already in main, not directly within t...

Review for Package: gnome-sushi

Specific binary packages built, but NOT to be promoted to main: gnome-sushi

Notes:
Required TODOs:
- Write the testplan for this package to cope for non build nor autopkgtests tests. I would really prefer this to be done prior MIR, as it’s always time consuming to go back to a MIR, reread and get the context to check the testplan is valid. Please consider that for future MIR or keep the MIR incomplete until you have the time to do so. 
- Some dependencies are still in universe like gir1.2-gtksource-4. Please check all dependencies of the binaries you want to promote, file MIR as needed and mention them in the description.
- There is no symbol tracking in place, only a shlibs. We require symbol tracking for all new packages entering main. However, if the lib is only used by gnome-sushi, this could be relaxed. Please state so explicitely in the MIR descriptiuon.
Recommended TODOs:
- As you identified some lintian warning which are not due to upstream code and which easy to fix, please fix them to not clutter the build output.
- There are a couple of upstream warnings during package build. Please report them upstream (seems deprecation warnings, so should be easy enough to propose a patch upstream).

[Duplication]
There is no other package in main providing the same functionality.

[Dependencies]
OK:
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring more tests now.

Problems:
- Some dependencies are still in universe like gir1.2-gtksource-4. Please check all dependencies of the binaries you want to promote, file MIR as needed and mention them in the description.

Note: the parsing is done within the process, but with external libraries already in main, not directly within this code.

[Common blockers]
OK:
- does not FTBFS currently
- no new python2 dependency

Problems:
- No autopkgtests nor build tests. Write the testplan for this package to cope for non build nor autopkgtests tests.

[Packaging red flags]

OK:
- Ubuntu does not carry a delta
- d/watch is present and looks ok (if needed, e.g. non-native)
- Upstream update history is good
- Debian/Ubuntu update history is good
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far
- no massive Lintian warnings
- d/rules is rather clean
- It is not on the lto-disabled list

Problems:
- There is no symbol tracking in place, only a shlibs. We require symbol tracking for all new packages entering main.
- As you identified some lintian warning which are not due to upstream code and which easy to fix, please fix them to not clutter the build output.

[Upstream red flags]
OK:
- no Errors during the build
- no incautious use of malloc/sprintf (as far as we can check it)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests)
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- part of the UI, desktop file is ok
- translation present

Problems:
- There are a couple of upstream warnings during package build. Please report them upstream (seems deprecation warnings, so should be easy enough to propose a patch upstream).
- Dependency of webkit, so require a security review.

Changed in gnome-sushi (Ubuntu):
status:	New → Incomplete
assignee:	Didier Roche-Tolomelli (didrocks) → Jeremy Bicha (jbicha)

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntugnome-sushi package

[MIR] gnome-sushi

Bug Description

Other bug subscribers

Remote bug watches

Ubuntu
gnome-sushi package