[MIR] brotli

* you need to subscribe desktop-packages
* debian/copyright references a directory that doesn't exist:
Files: appveyor/*
* not a big fan of debian/rules either with the 2 build pass, but it seems there isn't any alternative

Otherwise, the rest looks good to me.

I'm deferring for a security review to the security team.

Ah, and bonus point for --fail-missing :)

Desktop Packages is subscribed now.

I forwarded the other 2 issues to Debian.
https://bugs.debian.org/888947
https://bugs.debian.org/888950

Those 2 issues are fixed now:

https://launchpad.net/ubuntu/+source/brotli/1.0.2-3

I reviewed brotli version 1.0.2-3 as checked into bionic. This should not
be considered a full security audit but rather a quick gauge of
maintainability.

- brotli is a compression tool, both a library and command line
  application

- There's two CVEs, perhaps only one fault, for use in Chrome and
  Firefox. This is both a benefit (loads of people hammer these two
  projects endlessly) and a risk (getting fixes for CVEs out of these
  projects is extremely difficult.)

- Build-Depends: cmake, debhelper, dh-python, python, python-dev,
  python-setuptools, python3, python3-dev, python3-setuptools

- Does not daemonize
- Does not itself do networking
- Automatically generated pre/post rm/inst scripts
- No init scripts
- No systemd files
- No DBus services
- No setuid files
- 'brotli' executable in PATH
- No sudo fragments
- No udev rules
- A large-feeling test suite is run during the build
- No cron jobs
- Clean build logs

- No subprocesses spawned
- Careful memory management
- Most file IO under control of callers; .bro file extension code looked
  careful
- Clean logging
- No environment variable use
- Very limited privileged operations use; chmod() followed by two chown()
  calls. Perhaps there's a weakness here as these repeatedly operate on
  filenames rather than using fchmod(), fchown() on a single file
  descriptor.
- No cryptography
- No networking
- No privileged portions of code
- No temporary files
- No webkit
- No policykit
- No javascript
- cppcheck is not as clean as it could be, but reflects common C idiom.

Brotli is very dense, highly domain-specific code. It may have algorithmic
flaws that are very difficult to spot on a cursory read; that said, calls
almost universally have error checking, and the comments are tasteful. We
will need to rely upon upstream for maintenance help but the software
itself looks professionally programmed.

Security team ACK for promoting brotli to main.

Thanks

K, since MIR and security team reviews acked it I'm setting the bug as fix commited

package ftbfs on armhf (alignment errors)

@doko, that's a new issue in the updated version is bionic-proposed which is being investigated upstream, the bionic version builds fine on armhf, does it make sense in that context to block the promotion? it looks like the bionic version can be promoted and that proposed does it job and is blocking the buggy update until that one is sorted out

The upstream report for the armhf build problem is
https://github.com/google/brotli/issues/649

patch at https://github.com/google/brotli/pull/656

patch merged into the bionic package

$ change-override -S -s cosmic -c main brotli
Override component to main
brotli 1.0.3-1ubuntu1 in cosmic: universe/misc -> main
brotli 1.0.3-1ubuntu1 in cosmic amd64: universe/python/optional/100% -> main
brotli 1.0.3-1ubuntu1 in cosmic arm64: universe/python/optional/100% -> main
brotli 1.0.3-1ubuntu1 in cosmic armhf: universe/python/optional/100% -> main
brotli 1.0.3-1ubuntu1 in cosmic i386: universe/python/optional/100% -> main
brotli 1.0.3-1ubuntu1 in cosmic ppc64el: universe/python/optional/100% -> main
brotli 1.0.3-1ubuntu1 in cosmic s390x: universe/python/optional/100% -> main
libbrotli-dev 1.0.3-1ubuntu1 in cosmic amd64: universe/libdevel/optional/100% -> main
libbrotli-dev 1.0.3-1ubuntu1 in cosmic arm64: universe/libdevel/optional/100% -> main
libbrotli-dev 1.0.3-1ubuntu1 in cosmic armhf: universe/libdevel/optional/100% -> main
libbrotli-dev 1.0.3-1ubuntu1 in cosmic i386: universe/libdevel/optional/100% -> main
libbrotli-dev 1.0.3-1ubuntu1 in cosmic ppc64el: universe/libdevel/optional/100% -> main
libbrotli-dev 1.0.3-1ubuntu1 in cosmic s390x: universe/libdevel/optional/100% -> main
libbrotli1 1.0.3-1ubuntu1 in cosmic amd64: universe/libs/optional/100% -> main
libbrotli1 1.0.3-1ubuntu1 in cosmic arm64: universe/libs/optional/100% -> main
libbrotli1 1.0.3-1ubuntu1 in cosmic armhf: universe/libs/optional/100% -> main ...