Bug#699651: RFS: mosquitto/1.1.2-1

[Jakub Wilk <jwilk@debian.org>]

I don't indent to sponsor this package, but here's a quick review:

* Roger Light <roger@atchoo.org>, 2013-02-02, 22:52:
>  * Bumped standards release to 3.9.3. No changes needed.

Lintian says:
W: mosquitto source: out-of-date-standards-version 3.9.3 (current is 3.9.4)

>  * Debhelper bumped to version 9 to help fix hardening-no-fortify-functions.

Well, it didn't fix it. Lintian emits:
W: libmosquitto1: hardening-no-relro usr/lib/libmosquitto.so.1
W: libmosquitto1: hardening-no-fortify-functions usr/lib/libmosquitto.so.1
W: mosquitto: hardening-no-fortify-functions usr/bin/mosquitto_passwd
W: mosquitto: hardening-no-fortify-functions usr/sbin/mosquitto

blhc confirms that at least some binaries were built without hardening.

>  * Added upstart init script.
>  * Modified normal init script to work if upstart is used.

Lintian says:
I: mosquitto: output-of-updaterc.d-not-redirected-to-dev-null mosquitto postinst
E: mosquitto: duplicate-updaterc.d-calls-in-postinst mosquitto
I: mosquitto: output-of-updaterc.d-not-redirected-to-dev-null mosquitto postrm
E: mosquitto: duplicate-updaterc.d-calls-in-postrm mosquitto


What is the build-dependency on python-setuptools for? AFAICS this 
package doesn't use setuptools.

Both debian/rules and the top-level Makefile don't trap errors. See 
Policy §4.6 for details.

Why do you need two for loops in debian/rules? They do exactly the same 
thing.

You iterate over all supported Python 3 versions, but you build-depend 
only on the default one.

Similarly, the "python (>= 2.6.6-3~), python2.7" build-dependency is not 
sufficient. You want: "python-all (>= 2.7)".

Why "X-Python-Version: >= 2.7"? Upstream's setup.py says:
'Programming Language :: Python :: 2.6'

What happened to python-mosquitto's Depends?

Unless you have very good reasons, the -dev packages should be 
unversioned.

License and copyright information for uthash.h is not included in 
debian/copyright.

uthash is packaged separately in Debian. You should build 
mosquitto against the uthash-dev package instead of the embedded copy.

mosquitto_passwd creates temporary files in current working directory in 
a non-atomic way. This is insecure if cwd if world-writable (e.g. /tmp). 
Moreover, rename() will fail if the password file is on a different 
partition than cwd. (And it'll fail silently, since the return value is 
ignored...)

--
Jakub Wilk