[MIR] nvme-cli

Dimitri, you had expressed some concerns about destructive operations of the nvme-cli tools. Do you consider these blockers for Foundations supporting the package?

nah, it's fine, we will deal with that if and when that happens.

foundations-bugs subscribed.

Status changed to 'Confirmed' because the bug affects multiple users.

[Summary]
ACK from MIR team based on review below.

This does need a security review, so I'll assign ubuntu-security

[Duplication]
OK:
There is no other package in main providing the same functionality.

[Dependencies]
OK:
no other Dependencies to MIR due to this
no -dev/-debug/-doc packages that need exclusion

[Embedded sources and static linking]
OK:
no embedded source present
no static linking

[Security]
OK:
history of CVEs does not look concerning (no CVEs found)
does not run a daemon as root
does not use webkit1,2
does not use lib*v8 directly
does not parse data formats
  - note: it does interact with nvme devices using the NVMe specification api
does not open a port
does not process arbitrary web content
does not use centralized online accounts
does not integrate arbitrary javascript into the desktop
does not deal with system authentication (eg, pam), etc)

[Common blockers]
OK:
does not FTBFS currently
The package has a team bug subscriber (ubuntu foundations)
no translation present, but only minimal user interaction; is mostly a pure technical interface
not a python/go package, no extra constraints to consider int hat regard
no new python2 dependency
not go package

Problems:
does have a test suite, but not run at build time
does not have a test suite that runs as autopkgtest
*however*, above 2 problems are due to tests requiring system with nvme drive

[Packaging red flags]
OK:
Ubuntu does not carry a delta
symbols tracking not applicable for this kind of code (no shared lib)
d/watch is present and looks ok
Upstream update history is good
Debian/Ubuntu update history is good
the current release is packaged
promoting this does not seem to cause issues for MOTUs (no ubuntu delta)
d/rules is rather clean
Does not have Built-Using
not Go Package

Problems:
no massive Lintian warnings, but groovy package does use debhelper compat 9

[Upstream red flags]
OK:
no significant errors/warnings during the build
no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
no use of user nobody
no use of setuid
no important open bugs (crashers, etc) in Debian or Ubuntu
no dependency on webkit, qtwebkit, seed or libgoa-*
no embedded source copies
not part of the UI for extra checks

Problems:
use of malloc/sprintf:
  - there are many uses of malloc and sprintf, which mostly seems "ok"
  - however, since the use is only by the nvme stand-alone program,
    any failure would only affect use of that specific program;
    there is no library or daemon provided by the package
  - the security team may want to review malloc/sprintf use in more detail

I reviewed nvme-cli 1.12-1ubuntu1 as checked into groovy. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.

nvme-cli is a set of command line tools for managing NVMe devices.

- No history of CVEs.
- No init scripts
- Four systemd units, that are used to trigger nvme discovery
- No dbus services.
- No setuid binaries.
- Only binary is /usr/sbin/nvme
- No sudo fragments.
- No polkit files.
- Two udev files, for supporting nvme over fiber channel.
- Unit tests are not run at buld time, due to needing an nvme
  device. No autopkgtests.
- No cron jobs.
- No build errors or warnings.

- Processes spawned?
  The micron and wdc plugins unfortunately both use system(), when
  collecting log information, but are likely okay as the nvme tool is
  not setuid.
- Memory management in the core looks reasonable, with lots of uses of
  asprint(); the plugins tend to do more strcpy() and sprintf()
  operations.
- For file I/O, most of the file operations are performed on the nvme
  devices, and some abstraction is provided for that.
- Most logging is done through stderr, via perror or using strerror()m
  and loks okay.
- Only one use of environment variabbles, ok.
- Only privileged function used is ioctl(), and given the purpose of the
  software, expected.
- No apparent use of cryptography.
- No apparent use of tmpfiles.
- Use of networking is for fabric discovery, looks ok.
- No use of WebKit
- No use of PolicyKit

Coverity did find several issues, including some resource leaks
(file descriptors and unfreed memory in some situations); however,
a number of issues that Coverity raised were false positives due to
it's lack of understanding of asprintf(3) semantics, and really, seeing
widespread use of asprint() I consider a positive indicator of quality.

Security team ACK for promoting nvme-cli to main.

This seems to be ready now, thank Steve!

I didn't see it in component mismatches yet, so the state [1] is "In Progress" until a seed or dependency change was made.

[1]: https://wiki.ubuntu.com/MainInclusionProcess?action=show&redirect=MIRTeam#Process_states

There is no specific need for this to be included in a seed. It's required for the GKE images, and we maintain cloud specific install lists, separate from the general seeds. Server or cloud-images would be too inclusive (we'd need to script uninstalling it in the other images).

Is this where the "Supported" seed is used?

On Wed, Nov 11, 2020 at 1:11 AM John Chittum <email address hidden>
wrote:

> ...
> Is this where the "Supported" seed is used?
>

Yes, that allows to seed it into main without pushing it onto any image/iso
build.

Thanks! I also just learned about:

platform.$SUITE/supported-cloud

Based on the format, I'd say this package should be in that seed, in the = Per-cloud-image packages = section with a comment:

# For GKE

Override component to main
nvme-cli 1.12-5 in hirsute: universe/misc -> main
nvme-cli 1.12-5 in hirsute amd64: universe/admin/optional/100% -> main
nvme-cli 1.12-5 in hirsute arm64: universe/admin/optional/100% -> main
nvme-cli 1.12-5 in hirsute armhf: universe/admin/optional/100% -> main
nvme-cli 1.12-5 in hirsute ppc64el: universe/admin/optional/100% -> main
nvme-cli 1.12-5 in hirsute riscv64: universe/admin/optional/100% -> main
nvme-cli 1.12-5 in hirsute s390x: universe/admin/optional/100% -> main
7 publications overridden.