Main Inclusion Report for dnspython

Requirements

1. Availability: http://archive.ubuntu.com/ubuntu/pool/universe/d/dnspython; architecture: all package

2. Rationale:

   • Recommends: of python-xmpp

3. Security:

   • CVE entries: none

   • Secunia history: no entries found

   • Package includes no suid binaries and no daemons, only a python library for use by applications.
   • Network activity: no ports opened. Library does process network traffic in the form of responses to DNS requests.
   • Binary or structured data: DNS packets are processed directly by this package, without recourse to a standard C DNS library. However, because the implementation is entirely in python, the risk of exploitability here is minimal.
   • A Debian bug report indicates that the package is vulnerable to cache poisoning (CVE-2008-1447).
   • No source code review has been done.

4. Quality assurance:

   • Package is believed to work out-of-the-box in all cases.
   • No debconf questions asked.

   • Debian bugs: no other bugs reported.

   • Maintenance in Debian is calm

   • [[http://dnspython.org] is calm

   • No public upstream bug tracker
   • Hardware: package is not hardware-sensitive
   • Upstream build includes a test suite (13 unit tests), but the testsuite is currently not run as part of the package build.

5. UI standards:

   • This is a non-user-facing library; there should be no l10n concerns.

6. Standards compliance:

   • FHS, Debian Policy compliance: yes

   • Packaging system: debhelper
   • Patch system: none

7. Dependencies:

   • python
   • python-central

8. Maintenance:

   • Package is not expected to require significant ongoing maintenance.
   • The package will not be actively monitored by Ubuntu developers, and will rely primarily on the Debian maintainer to provide bugfixes. The package is currently in sync with Debian.

Reviewers

MIR bug: https://launchpad.net/bugs/358051

SteveLangasek