Main Inclusion Report for ec2-init

Requirements

1. Availability: ec2-init is available for amd64, i386 (python)

2. Rationale:

   • ec2-init is being developed by the ubuntu team to provide hooks during boot up to do ec2 (and UEC) specific things. One such example is to re-generate ssh keys on each new instance. Another piece of functionality is running/consuming 'user data' input that is provided to the instance via the user who started it. This package is a core piece of functionality of the ec2 and UEC images that we produce. The upstream is https://launchpad.net/ec2-init.

3. Security:

   • CVE entries: None

   • Secunia history: None

   • Any binaries running as root or suid/sgid ? The ec2-init init script runs as root during the boot process. Additionally, the user who started the instance can optionally pass scripts (via --user-data) that are run at this time (as root). There are no daemons in the package.

   • Network activity: does it open any port ? No ports are listened on. It does do http requests to the ec2 metadata service (http://169.254.169.254). Does it handle incoming network data ? No.

   • Does it directly (not through a library) process binary (video, audio, etc) or structured (PDF, etc) data ? ec2-init parses user data via the python libraries. It handles multi-part input via python email library and xml input via python xml.dom.minidom

   • Any source code review performed ? I (ScottMoser) have been working with the ec2-init code some. Soren is the Primary developer. No explicit source code review has taken place.

4. Quality assurance:

   • In what situations does the package not work out of the box without configuration ? If the package is installed on non-ec2 or uec, it will cause long timeouts on boot.

   • Does the package ask any debconf questions higher than priority 'medium' ? No.

   • Debian bugs: Not packaged

   • Maintenance in Debian Not packaged

   • Upstream is frenetic/vigorous/calm/dead ? Upstream is not terribly active. The package is reasonably mature.

   • Upstream bug tracker: bug 431255 is intended to be addressed shortly.

   • Hardware: Does this package deal with hardware and if so how exotic is it ? It runs on ec2 or UEC guests. No direct interaction with hardware.

   • Is there a test suite in the upstream source or packaging ? No. Is it enabled to run in the build ? Not Applicable

5. UI standards:

   • User-visible strings are internationalized using standard gettext system ?. No internationalized text is used. However, the only user-visible strings are during boot (init output).

   • Package with translatable strings builds a PO template during package build ? Not Applicable

   • End-user applications ship a desktop file ? Not Applicable

6. Standards compliance:

   • FHS, Debian Policy compliance ? Yes.

   • Packaging system (debhelper/cdbs/dbs) ? cdbs. Patch system ? quilt (currently no patches). Any packaging oddities ? No.

7. Dependencies:

   • python-configobj (Universe: MIR)

   • python-cheetah (Universe: MIR)

   • python-boto (Universe: MIR)

   • python

   • procps

   • update-motd

   • python-central

8. Maintenance:

   • How much maintenance is this package likely to need ? The ubuntu package maintainence needs of ec2-init are not significant. However, the upstream is Ubuntu, and that will/does require resources.

   • Who is responsible for monitoring the quality of this package and fixing its bugs ? SorenHanson and ScottMoser, and the ec2-on-ubuntu team. Are they Ubuntu or Debian developers ? Ubuntu.

   • Who is the package bug contact in Ubuntu? Scott Moser, Soren Hanson, Eric Hammond

9. Background information:

   • The general purpose and context of the package should be clear from the package's debian/control file.

   • What do upstream call this software ? ec2-init. Has it had different names in the past ? No

10. Internationalization:

    • Are graphical applications translatable? Do they support gettext? Not Applicable

Reviewers

MIR bug: https://launchpad.net/bugs/434693

The author of this report should put their name here; reviewers will add comments etc. too