[MIR] new dependencies of lintian

Status changed to 'Confirmed' because the bug affects multiple users.

Doko wanted to look into these lintian-triggered dependencies from the MIR team (per last few meetings we had) so I'm assigning him here for clarity.

looks ok for the perl packages.

for discount, please

 - add the missing copyright holder(s) (required)

 - forward the Ubuntu delta to Debian (recommended).

Assigning the security team for a review for discount.

@doko, thanks for the review.

I've forwarded the delta by pushing it to the packaging repo on Salsa but the package is not team maintained and I don't think that NMU-ing it just with that fix would be reasonable.

I've taken a look again at d/copyrights and checked the source with decopy and grep, also looking at some of the files but I haven't found copyright holders that were missed. Could you please give some more hint on what is missing?

my bad, clrified on irc, the copyright is complete

I reviewed discount 2.2.6-1ubuntu1 as checked into hirsute. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.

discount is an implementation of John Gruber's Markdown markup language.

- CVE History:
  - All CVEs bellow are open
    CVE-2018-11468 - medium (affects only xenial and bionic)
    CVE-2018-11503 - medium (affects only xenial and bionic)
    CVE-2018-11504 - medium (affects only xenial and bionic)
    CVE-2018-12495 - low (affects only xenial and bionic)

- Build-Depends?
  - libmarkdown2, libmarkdown2-dev
- pre/post inst/rm scripts?
  - there are two .install scripts:
    - libmarkdown2-dev.install does:
      - echo mkdio.h usr/include/$DEB_HOST_MULTIARCH
      - echo libmarkdown.so usr/lib/$DEB_HOST_MULTIARCH
      - echo libmarkdown.pc usr/lib/$DEB_HOST_MULTIARCH/pkgconfig/
    - libmarkdown2.install does:
      - echo libmarkdown.so.* usr/lib/$DEB_HOST_MULTIARCH
- init scripts?
  None
- systemd units?
  None
- dbus services?
  None
- setuid binaries?
  None
- binaries in PATH?
  -rwxr-xr-x root/root 20000 2020-10-10 16:43 ./usr/bin/makepage
  -rwxr-xr-x root/root 24672 2020-10-10 16:43 ./usr/bin/markdown
  -rwxr-xr-x root/root 24160 2020-10-10 16:43 ./usr/bin/mkd2html
  -rwxr-xr-x root/root 32624 2020-10-10 16:43 ./usr/bin/theme
- sudo fragments?
  None
- polkit files?
  None
- udev rules?
  None
- unit tests / autopkgtests?
  - there are tests but I'm not 100% sure they run on build time.
- cron jobs?
  - none
- Build logs:
  None

- Processes spawned?
  one, but run only if it HAS_GIT flag. These are build utilities exec files only.

- Memory management?
  - In a first glance, it is ok.
  - it uses some strcpy with some argv/argc, but the memory
    buffers are set size using the argv/argc. In any case, probably need further looks
- File IO?
 - Sounds ok
- Logging?
 - Some logs using perror
- Environment variable usage?
  - it uses MARKDOWN_FLAGS amd AMALLOC_STATISTICS env variables. But not seems weird.
- Use of privileged functions?
   - None
- Use of cryptography / random number sources etc?
 - None
- Use of temp files?
 - None
- Use of networking?
  - None
- Use of WebKit?
 - None
- Use of PolicyKit?
 - None
- Any significant cppcheck results?
  - lots of Expression errors as in:
sio.c:14:5: error: Expression '((*iot).size++)[((*iot).size<(*iot).alloc)?((*iot).text):((*iot).text=(*iot).text?realloc((*iot).text,sizeof(*iot).text[0]*((*iot).alloc+=100)):malloc(sizeof(*iot).text[0]*((*iot).alloc+=100)))]' depends on order of evaluation of side effects [unknownEvaluationOrder]
    EXPAND(*iot) = c;
- Any significant Coverity results?
   - Some possible NULL dereference in markdown.c 958 as p is passed without be checked.
   - same in line 996 markdown.c
- Any significant shellcheck results?
  - not that relevant.
- Any significant bandit results?
   - None

There are few things that I believe should be address first to ACK it, as re-check the possible NULL dereferences were it was pointed.
But in general, from me it's ACK.

In order to any further check against coverity results. check this file.

filed LP: #1912503 for the discount improvements

Override component to main
discount 2.2.6-1ubuntu1 in hirsute: universe/text -> main
discount 2.2.6-1ubuntu1 in hirsute amd64: universe/text/optional/100% -> main
discount 2.2.6-1ubuntu1 in hirsute arm64: universe/text/optional/100% -> main
discount 2.2.6-1ubuntu1 in hirsute armhf: universe/text/optional/100% -> main
discount 2.2.6-1ubuntu1 in hirsute i386: universe/text/optional/100% -> main
discount 2.2.6-1ubuntu1 in hirsute ppc64el: universe/text/optional/100% -> main
discount 2.2.6-1ubuntu1 in hirsute riscv64: universe/text/optional/100% -> main
discount 2.2.6-1ubuntu1 in hirsute s390x: universe/text/optional/100% -> main
libmarkdown2 2.2.6-1ubuntu1 in hirsute amd64: universe/libs/optional/100% -> main
libmarkdown2 2.2.6-1ubuntu1 in hirsute arm64: universe/libs/optional/100% -> main
libmarkdown2 2.2.6-1ubuntu1 in hirsute armhf: universe/libs/optional/100% -> main
libmarkdown2 2.2.6-1ubuntu1 in hirsute i386: universe/libs/optional/100% -> main
libmarkdown2 2.2.6-1ubuntu1 in hirsute ppc64el: universe/libs/optional/100% -> main
libmarkdown2 2.2.6-1ubuntu1 in hirsute riscv64: universe/libs/optional/100% -> main
libmarkdown2 2.2.6-1ubuntu1 in hirsute s390x: universe/libs/optional/100% -> main
libmarkdown2-dev 2.2.6-1ubuntu1 in hirsute amd64: universe/libdevel/optional/100% -> main
libmarkdown2-dev 2.2.6-1ubuntu1 in hirsute arm64: universe/libdevel/optional/100% -> main
libmarkdown2-dev 2.2.6-1ubuntu1 in hirsute armhf: universe/libdevel/optional/100% -> main
libmarkdown2-dev 2.2.6-1ubuntu1 in hirsute i386: universe/libdevel/optional/100% -> main
libmarkdown2-dev 2.2.6-1ubuntu1 in hirsute ppc64el: universe/libdevel/optional/100% -> main
libmarkdown2-dev 2.2.6-1ubuntu1 in hirsute riscv64: universe/libdevel/optional/100% -> main
libmarkdown2-dev 2.2.6-1ubuntu1 in hirsute s390x: universe/libdevel/optional/100% -> main
22 publications overridden.

Override component to main
libtext-markdown-discount-perl 0.12-1build1 in hirsute: universe/perl -> main
libtext-markdown-discount-perl 0.12-1build1 in hirsute amd64: universe/perl/optional/100% -> main
libtext-markdown-discount-perl 0.12-1build1 in hirsute arm64: universe/perl/optional/100% -> main
libtext-markdown-discount-perl 0.12-1build1 in hirsute armhf: universe/perl/optional/100% -> main
libtext-markdown-discount-perl 0.12-1build1 in hirsute i386: universe/perl/optional/100% -> main
libtext-markdown-discount-perl 0.12-1build1 in hirsute ppc64el: universe/perl/optional/100% -> main
libtext-markdown-discount-perl 0.12-1build1 in hirsute riscv64: universe/perl/optional/100% -> main
libtext-markdown-discount-perl 0.12-1build1 in hirsute s390x: universe/perl/optional/100% -> main
8 publications overridden.