Main Inclusion Report for libarchive

Requirements

1. Availability: http://archive.ubuntu.com/ubuntu/pool/universe/liba/libarchive, https://launchpad.net/ubuntu/+source/libarchive/; available for all supported architectures (lpia isn't at a.u.c but was built for the last version according to launchpad)

2. Rationale: We need it for the new gvfs archive backend. http://mail.gnome.org/archives/nautilus-list/2008-March/msg00034.html

   • Build dependency of gvfs if promoted.

3. Security:

   • CVE entries: all fixed in 2.2.4

   • Secunia history:

   • No binaries running as root or suid/sgid, no daemons.
   • Network activity: doesn't open ports, doesn't handle incoming network data.
   • No source code review performed (The approver will do a quick and shallow check.)

4. Quality assurance:

   • In what situations does the package not work out of the box without configuration ?
   • No debconf questions.

   • Debian bugs: 465061 is a serious bug but doesn't affect the package in Hardy and will be fixed in the next upstream release. Anyway it only affects some uncommon architectures, and of them only PowerPC is (unofficially) ported in Ubuntu.

   • Maintenance in Debian is calm.

   • Upstream is quite active.

   • Upstream bug tracker: From the upstream homepage: "Comments, questions, patches: kientzle@freebsd.org", and Debian bug 465061 is "Forwarded to kientzle@freebsd.org"

5. Standards compliance:

   • FHS, Debian Policy compliance.

   • Debian library packaging guide standards compliance.

   • Packaging system: debhelper, no patch system.

6. Dependencies:

   • libarchive1 as of 2.2.4-1 depends on libacl1 libattr1 libbz2-1.0 libc6 zlib1g, all of them are in main

Reviewers

MIR bug: https://bugs.launchpad.net/208310