[MIR] juju-quickstart, python-jujuclient, urwid, websocket-client

[juju-quickstart]

Availability: in universe, arch: all.

Rationale: key component for the Juju ecosystem.

Security: no security history. No CVEs found. No suid or sgid
executables. No executables in /sbin or /usr/sbin. No daemons. No
privileged ports (although the Juju GUI does open a privileged port,
which this package deploys). One might consider Juju to be
security-sensitive, as it controls production deployments, and this
package bootstraps Juju. This package uses sudo, although this use is
scheduled to be removed. See bug 1282630.

Quality assurance:

Upstream ships a thorough test suite which includes 100% SLOC coverage.
By design, this tool makes it possible to use juju with as minimal
configuration as possible and with no documentation reading, by
deploying the GUI for the user and presenting its interface.

No debconf questions. No long-term outstanding bugs.

No relevant packaging bugs. There are a number of active bugs open
upstream; these are being actively worked on by upstream. This package
does not deal with exotic hardware. The upstream test suite is run as
part of the package build, and a failing test suite fails the package
build. A debian/watch file exists and is functional.

UI standards:

This is an end-user console application and is not internationalized
(not translatable). This is tracked in bug 1292026.

The package does not ship a desktop file. As a console application
designed for developer use, a desktop file has minimal relevance for
developers.

Dependencies:

urwid, python-jujuclient and websocket-client are dependencies in
universe. MIR reports follow in this bug.

Standards compliance: standard and minimal dh sequencer based packaging.
FHS compliant and the packaging is up to current Debian policy.

Maintenance:

Actively maintained upstream, by the Juju GUI team. ~ubuntu-server
commits to maintaining this package in Ubuntu and is subscribed to
package bugs.

[urwid]

Availability: in universe and built on all architecture.

Rationale: dependency of juju-quickstart.

Security: no security history. No CVEs found. No suid or sgid
executables. No executables in /sbin or /usr/sbin. No daemons. No
privileged port use is apparent. urwid is a UI library, so may be used
as a UI in security sensitive software, although this isn't the case
with juju-quickstart.

Quality assurance:

As a library, this package is functional on installation. No debconf
questions. No major long-term outstanding bugs. Upstream is active. No
use of exotic hardware.

Test-related packaging bugs in Debian are all fixed in Debian svn. The
only other bug in Debian is believed fixed already. Upstream has more
bugs, but none of them appear to be major issues for general urwid use.

No use of exotic hardware. Test suite is run as part of the package
build, and fails the build if tests fail. debian/watch file is out of
date, but fixed in current Debian svn.

UI standards: N/A

Dependencies: all in main.

Standards compliance: minimal cdbs+debhelper based packaging. Ideally
this would use the dh sequencer now, and I get the impression that DPMT
would be happy to switch it. But urwid is a relatively slow moving
project, and the rules file is simple and minimal enough that it doesn't
seem worth switching just for the sake of it. If there is a problem that
requires a change, then it could be switched to dh at that time easily
enough. FHS compliant and the packaging is up to current Debian policy.

urwid is a long-lived relatively stable package, with minimal
maintenance requirements. Upstream is active though, and all bugs in
Debian BTS are fixed in Debian svn. ~ubuntu-server commits to
maintaining this package in Ubuntu and is subscribed to package bugs.

[python-jujuclient]

Availability: in universe, arch: all.

Rationale: dependency of juju-quickstart.

Security: no security history. No CVEs found. No suid or sgid
executables. No executables in /sbin or /usr/sbin. No daemons. No
privileged ports. python-jujuclient is used by juju-quickstart to manage
deployments; the deployments themselves are security-sensitive.

Quality assurance:

As a library, this package is functional on installation. No debconf
questions. No long-term outstanding bugs. Upstream is active. No use of
exotic hardware.

No relevant upstream test suite; tracked in bug 1293467.

debian/watch file is present and working.

UI standards: N/A

Dependencies: websocket-client is in universe (also see bug 1292502
regarding the package naming of this dependency). MIR report follows.

Standards compliance: standard and minimal dh sequencer based packaging.
FHS compliant and the packaging is up to current Debian policy.

Maintenance: actively maintained upstream, by Kapil Thangavelu.
~ubuntu-server commits to maintaining this package in Ubuntu and is
subscribed to package bugs. The upstream code says: "Seriously Alpha.
Works now, but API *will* change". Upstream responds: "yeah.. i should
take that out, it was commentary from the first release against the api,
but in truth it has been pretty stable to date".

[websocket-client]

Availability: in universe, arch: all.

Rationale: dependency of python-jujuclient.

Security: no security history. No CVEs found. No suid or sgid
executables. No executables in /sbin or /usr/sbin. No daemons. This
library is a client for the WebSocket protocol, and as such will
generally handle untrusted input, although this isn't the case with
juju-quickstart.

Quality assurance:

As a library, this package is functional on installation. No debconf
questions. No major long-term outstanding bugs. Upstream is active. No
use of exotic hardware. Test suite is run as part of the package build,
and fails the build if tests fail. debian/watch file is present and
working.

There was an issue with a conflict between Debian and Ubuntu packaging
and tracked in bug 1292502, but this is now resolved. The upstream test
suite had to be imported using a distribution patch in order to run it
as part of the package build (bug 1292511); this was reported to
upstream, so hopefully will be fixed upstream soon so that the
distribution patch can be removed.

UI standards: N/A

Dependencies: all in main.

Standards compliance: standard and minimal dh sequencer based packaging.
FHS compliant and the packaging is up to current Debian policy.

Maintenance: upstream is active. ~ubuntu-server commits to maintaining
this package in Ubuntu and is subscribed to package bugs.