Main Inclusion Report for sendmail

The purpose of promoting sendmail is to get libmilter-dev (and libmilter since it's needed for libmilter-dev) into Main so that packages that build milters can be in Main. No other binaries need to be promoted. It may, at some point, be prudent to have milters in Main (now that Postfix supports milters). Promotion of the rest of sendmail is not contemplated.

Requirements

1. Availability: http://archive.ubuntu.com/ubuntu/pool/universe/s/sendmail; available for all architectures.

2. Rationale:

   • Build dependency of clamav and will also be a build-dep of amavisd-new once amavisd-new milter is unsplit. This will support this approved Intrepid spec:

     • https://blueprints.launchpad.net/ubuntu/+spec/clamav-spamassassin-in-main

3. Security:

   • CVE entries: Up through 8.12, the Sendmail security history is not pleasant. The last two releases, 8.13 and 8.14 have fared much better. 8.13 has a few (all minor and none that affect libmilter) and 8.14 is CVE free so far:

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0058

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1173

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4434

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7175

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7176

   • Secunia history: Similar to the CVE history.

   • Any binaries running as root or suid/sgid ? No Any daemons ? No
   • Network activity: does it open any port ? No Does it handle incoming network data ? No
   • Does it directly (not through a library) process binary (video, audio, etc) or structured (PDF, etc) data ? No
   • Any source code review performed ? (The approver will do a quick and shallow check.) No

4. Quality assurance:

   • In what situations does the package not work out of the box without configuration ? None for libmilter. If a milter is built against it properly, libmilter doesn't need any changes.
   • Does the package ask any debconf questions higher than priority 'medium' ? Not for libmilter

   • Debian bugs: None related to libmilter

   • Maintenance in Debian is vigorous ?

   • Upstream is calm ?

   • Upstream bug tracker: No public bug tracker that I could find.

   • Hardware: Does this package deal with hardware and if so how exotic is it ? No and not.
   • Is there a test suite in the upstream source or packaging ? Yes. Is it enabled to run in the build ? I think so.

5. Standards compliance:

   • FHS, Debian Policy compliance ? Yes.

   • Debian library packaging guide standards compliance ? Yes.

   • Packaging system (debhelper/cdbs/dbs) ? cdbs Patch system ? simple-patchsys, currently not used Any packaging oddities ? This is a very complex build system using CDBS. Tarball in tarball just starts to pick at the complexity. Fortunately it works.

6. Dependencies:

   • Build-Depends-Indep: groff, bsdmainutils

   • Build-Depends: make (>> 3.79.1-14), m4, cdbs, patchutils, dh-buildinfo, debhelper (>= 5), linux-libc-dev (>= 2.6.21-3) [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], groff, bsdmainutils , libdb4.6-dev, libldap2-dev, libwrap0-dev, liblockfile-dev, libsasl2-dev, libssl-dev

   • libmilter-dev
     • Depends: libmilter1.0.1
     • Suggests: sendmail-doc
   • libmilter1.0.1
     • Depends: libc6
   • Are these all in main ? Yes

7. Background information:

   • The general purpose and context of the package should be clear from the package's debian/control file. It's clear. The main thing is all we want out of this for Main is libmilter.
   • What do upstream call this software ? Sendmail Has it had different names in the past ? No

Reviewers

MIR bug: https://bugs.launchpad.net/ubuntu/+source/sendmail/+bug/243128

Author: ScottKitterman