Bug#1002645: RFS: pass-audit/1.1-1 [ITP] -- Pass extension for auditing your password repository (Python library)
Hi Antoine,
First, thanks for reviewing this package. Second, thanks for the code audit,
I've clearly not enough security knowledge to be able to spot potential
security issues like this, so thanks for that.
(and btw the
[0] reference seems to be missing)
Hum, I forgot to put it and now to be honest, I don't remember what link
I wanted to put. You can check the packages I maintain in my QA page:
https://qa.debian.org/developer.php?email=thomas.perret@phyx.fr
These are mainly the paperwork[0] software and its dependencies with the
exception of gfsecret[1] a package that could take advantage of your
sharp eyes.
Le 13/01/2022 à 19:47, Antoine Beaupré a écrit :
On 2022-01-13 13:37:47, Antoine Beaupré wrote:
Any reason why you split the package in two binary packages? I don't see
why the python3-* package would really be useful outside of the
extension...
I wasn't sure about that, I can undo the split if you think it's unnecessary.
It was also because from what I understood from the section 5.3 of the
Debian Python Policy[2], it would become a private module and would require
to be installed in /usr/share/pass-audit. So out of laziness, I split
the package. But I'm not sure now, while I read the policy again, that I'm
understanding it the same.
Another thing is that I can't build the package here, it seems to fail
on some weird gnupg error in the test suite. Log attached.
other than that, things look somewhat sane. i'm a little worried about
the security of the code, details in private (and sent to upstream on
twitter).
Hum, yes indeed. I only tried to build it using pbuilder which built fine
but I can reproduce it locally with sbuild (and was present also on salsa[3]).
Though, I'm not sure where the problem comes from. I'll need to investigate.
I'm not able to spend as much time as I would like for Debian currently so
it will surely take me some time to fix that. But I guess, I should wait for
the next upstream release before uploading to Debian.
Thomas
[0]: https://openpaper.work
[1]: https://incenp.org/dvlpt/gfsecret.html
[2]: https://www.debian.org/doc/packaging-manuals/python-policy/index.html#programs-shipping-private-modules
[3]: https://salsa.debian.org/debian/pass-audit/-/jobs/2322260
Reply to: