Main Inclusion Report for xsp

Requirements

1. Availability: http://archive.ubuntu.com/ubuntu/pool/universe/x/xsp/ available for all supported arches

2. Rationale: new build-dependency of monodoc (mono-xsp-base contains dh_installxsp which was in mono-utils before). it is also a runtime dependency for monodoc-http (which is moved to universe). I would propose to have the xsp sourcepackage and the mono-xsp-base binary package in main, everything else in universe.
3. Security:
   • Recent cross-site scripting vuln (CVE-2005-0509)
   • Contains a full webserver, opens port, etc.
   • Relatively young and unaudited code
4. Quality assurance:
   • The package contains a simple webserver and apache{1,2} mod_mono backends to run ASP.NET programs.

   • Maintained by the Debian Mono Group http://pkg-mono.alioth.debian.org

   • Some outstanding bugs in Debian BTS http://bugs.debian.org/cgi-bin/pkgreport.cgi?src=xsp. Most of them are fixed with our version in universe and will be fixed soon in Debian.

   • Almost no open upstream bugs here

5. Standards compliance:
   • The package meets the FHS, Debian Policy and CLIPolicy
6. Dependencies:
   • Depends only on main stuff (mono, cli-common)

Reviewers

MartinPitt: I'd rather avoid bringing all of this webserver stuff into main, especially for Dapper. It sounds ok in six months, when the code matured a bit and we only have 18 monts of support. Can the debhelper script be moved back into mono-utils, or can mono-xsp-base get its own source package with only safe stuff?