Main Inclusion Report for Asio

Requirements

1. Availability: http://packages.ubuntu.com/source/hardy/asio; Available for all architectures as is only C header files as a build time dependency.

2. Rationale:

   • Build dependency of AbiWord version 2.6's collaboration feature. This allows Abiword to do collaborative editing with other AbiWord users (on Windows, SuSE Linux, and Fedora Linux) and OLPC laptops using Write (a port of AbiWord).

   • Recently has been accepted into upcoming versions of Boost, so it will be included as part of boost updates shortly.

3. Security:

   • CVE entries: None.

   • Secunia history: Returns 10 entries. They all seem to be false positives with the short string 'asio'. Searches on libasio and asio-dev turn up empty.

   • Any binaries running as root or suid/sgid ? No Any daemons ? No

   • Network activity: does it open any port ? Does it handle incoming network data ? This package provide a network interface for other applications to use. It provides a cleaner wrapper for dealing with network interfaces; reducing bugs in the network interfaces of the calling applications.
   • Does it directly (not through a library) process binary (video, audio, etc) or structured (PDF, etc) data ? The library pulls the data off of the network and gives it to the calling application. It does some caching of data in order to give the calling application async access to the network stack. It doesn't interpret the data in any way.
   • Any source code review performed ? (The approver will do a quick and shallow check.) Not by Ubuntu. The library has recently been accepted into Boost, which involves a significant review process.

4. Quality assurance:

   • In what situations does the package not work out of the box without configuration ? It's a library, it does absolutely nothing without configuration and calling code

   • Does the package ask any debconf questions higher than priority 'medium' ? No.

   • Debian bugs: 2 bugs, one packaging update one bug with an IPv6 address parsing function that doesn't seem critical.

   • Maintenance in Debian is frenetic/vigorous/calm/dead ? calm/dead, 190 days and several releases without update. It is expected that this will improve as the library gets merged into libboost and part of their update cycle. There a no bugs in the release notes which are known to effect the usage in AbiWord (release notes and release notes). (NB: I am willing to update the package as I do for Windows AbiWord. Such additional packaging would no longer be needed in Boost - see below. --RP)

   • Upstream is frenetic/vigorous/calm/dead ? vigorous, but might decline slightly as 1.0 was recently released.

   • Upstream bug tracker: No outstanding bugs.

   • Is there a test suite in the upstream source or packaging ? Is it enabled to run in the build ? Yes.

5. Standards compliance:

   • FHS, Debian Policy compliance ? No known problems.

   • Debian library packaging guide standards compliance ? No known problems.

   • Packaging system (debhelper/cdbs/dbs) ? Patch system ? Any packaging oddities ? None, very simple packaging.

6. Dependencies:

   • debhelper (main), autoconf (main), automake (main), doxygen (main), graphviz (main), libboost-dev (main), libboost-date-time-dev (universe), libboost-regex-dev (universe), libboost-test-dev (universe) (NB: I have used this library without those Universe packages, it may be that they are more like "recommended" than dependencies, given that it is just a collection of headers. To me, it is reasonable to assume that if you don't depend on the boost-regex package, you wouldn't expect to use the part of libasio that would interact with that, for instance. I am seeking more information on these dependencies. --RP)
   • Are these all in main ? No.

7. Background information:

   • The general purpose and context of the package should be clear from the package's debian/control file. If it isn't then please explain. It is: cross-platform C++ library for network programming asio is a cross-platform C++ library for network programming that provides developers with a consistent asynchronous I/O model using a modern C++ approach. It has recently been accepted into Boost.
   • What do upstream call this software ? Has it had different names in the past ? Not in the past, but in the future it is likely to change to libboost-asio.

Reviewers

MIR bug: https://bugs.launchpad.net/ubuntu/+source/asio/+bug/213688

TedGould RyanPavlik2