[Bug 2155757] Re: [MIR] lua5.5

Mon Aug 17 17:54:53 UTC 2026

This is showing in mismatches now - updating state

** Changed in: lua5.5 (Ubuntu)
       Status: In Progress => Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to ceph in Ubuntu.
https://bugs.launchpad.net/bugs/2155757

Title:
  [MIR] lua5.5

Status in apache2 package in Ubuntu:
  In Progress
Status in ceph package in Ubuntu:
  New
Status in dovecot package in Ubuntu:
  In Progress
Status in frr package in Ubuntu:
  In Progress
Status in haproxy package in Ubuntu:
  In Progress
Status in ibus-libpinyin package in Ubuntu:
  In Progress
Status in lua-json package in Ubuntu:
  In Progress
Status in lua-lpeg package in Ubuntu:
  Fix Released
Status in lua5.5 package in Ubuntu:
  Fix Committed
Status in memcached package in Ubuntu:
  In Progress
Status in wireplumber package in Ubuntu:
  New

Bug description:
  This MIR will allow packages in main to migrate from depending on
  lua5.4 to lua5.5. I used the prior MIR for Lua 5.4 as a template for
  this MIR:
  https://bugs.launchpad.net/ubuntu/+source/lua5.4/+bug/2026608

  [Availability]
  The package lua5.5 is already in Ubuntu universe.
  The package lua5.5 build for the architectures it is designed to work on.
  It currently builds and works for architectures: amd64, arm64, armhf, ppc64el, riscv64, s390x
  Link to package https://launchpad.net/ubuntu/+source/lua5.5

  [Rationale]
  - The package lua5.5 is required in Ubuntu main for migrating our standard version of lua from 5.4 to 5.5
  - The package lua5.5 will generally be useful for a large part of our user base
  - Additionally multiple packages will no longer need forced compatibility with lua5.4
  - The package lua5.5 is required in Ubuntu main no later than Feature Freeze to make it our main supported version in 26.10

  [Security]
  The package has no Debian or Ubuntu-reported CVEs:
  https://ubuntu.com/security/cves?package=lua5.5
  https://security-tracker.debian.org/tracker/source-package/lua5.5

  - no `suid` or `sgid` binaries (checked with `find "$pkgdir" -xdev -type f -perm /6000 -printf '%M %u:%g %p\n'` on liblua5.5-0, liblua5.5-dev, lua5.5 debs)
  - no executables in `/sbin` and `/usr/sbin`
  - Package does not open privileged ports (grepped for socket/bind/listen/connect-style networking calls, found none)
  - Package does not contain extensions to security-sensitive software

  [Quality assurance - function/usage]
  - Package works as intended after install (tested `lua5.5 hello.lua`, where hello.lua is a hello world file)

  [Quality assurance - maintenance]
  - The package is well maintained in Debian, Ubuntu, and Upstream. In Ubuntu and Debian, it currently has no open bugs, and upstream, 4/7 bugs have been fixed. All closed bugs were fixed relatively quickly (within 2 weeks) after opening:
    + https://bugs.launchpad.net/ubuntu/+source/lua5.5/+bugs
    + https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=lua5.5
    + https://www.lua.org/bugs.html#5.5.0

  [Quality assurance - testing]
  - The package does not run a full test suite at build time as one is not provided upstream
  - The package has two autopackagetests, both of which are passing on all architectures in Stonking: https://autopkgtest.ubuntu.com/packages/lua5.5

  [Quality assurance - packaging]
  - debian/watch is present and works
  - debian/control defines a correct Maintainer field (Debian Lua Team <pkg-lua-devel at lists.alioth.debian.org>)

  No lintian warnings or errors, only some informational messages with EvIL/pedantic:
  - Full output from lintian -EvIL +pedantic:
  ❯ lintian -EvIL +pedantic ../*lua*.deb
  I: liblua5.5-0: hardening-no-bindnow [usr/lib/x86_64-linux-gnu/liblua5.5-c++.so.0.0.0]
  I: liblua5.5-0: hardening-no-bindnow [usr/lib/x86_64-linux-gnu/liblua5.5.so.0.0.0]
  X: liblua5.5-0: exit-in-shared-library [usr/lib/x86_64-linux-gnu/liblua5.5-c++.so.0.0.0]
  X: liblua5.5-0: exit-in-shared-library [usr/lib/x86_64-linux-gnu/liblua5.5.so.0.0.0]
  ❯ lintian -EvIL +pedantic ../lua*.deb
  ❯ ls ../*.deb
  ../liblua5.5-0_5.5.0-3_amd64.deb  ../liblua5.5-dev_5.5.0-3_amd64.deb  ../lua5.5_5.5.0-3_amd64.deb
  ❯ lintian -EvIL +pedantic ../lua5.5_5.5.0-3_amd64.changes
  I: liblua5.5-0: hardening-no-bindnow [usr/lib/x86_64-linux-gnu/liblua5.5-c++.so.0.0.0]
  I: liblua5.5-0: hardening-no-bindnow [usr/lib/x86_64-linux-gnu/liblua5.5.so.0.0.0]
  I: lua5.5 source: older-debian-watch-file-standard 4 [debian/watch]
  I: lua5.5 source: patch-not-forwarded-upstream [debian/patches/0001-build-system.patch]
  I: lua5.5 source: patch-not-forwarded-upstream [debian/patches/0002-lua-modules-paths.patch]
  P: lua5.5 source: redundant-rules-requires-root-no-field [debian/control:11]
  X: lua5.5 source: debian-watch-does-not-check-openpgp-signature [debian/watch]
  X: liblua5.5-0: exit-in-shared-library [usr/lib/x86_64-linux-gnu/liblua5.5-c++.so.0.0.0]
  X: liblua5.5-0: exit-in-shared-library [usr/lib/x86_64-linux-gnu/liblua5.5.so.0.0.0]
  X: lua5.5 source: upstream-metadata-file-is-missing

  - No Lintian overrides
  - No dependencies on obsolete packages
  - Not installed by default

  - Packaging and build is easy, although there are a large number of
  commands in override_dh_auto_install, link to debian/rules
  https://git.launchpad.net/ubuntu/+source/lua5.5/tree/debian/rules
  (comparable to lua5.4 MIR -
  https://bugs.launchpad.net/ubuntu/+source/lua5.4/+bug/2026608)

  [UI standards]
  - Application is not end-user facing (does not need translation) (other than lua shell, but this has limited text)

  [Dependencies]
  - No further depends or recommends dependencies that are not yet in main

  [Migration Plan from Lua 5.4->Lua 5.5 in main]
  Reverse Dependencies in main:
  - The prior version of Lua in main, 5.4, has the following reverse dependencies in main that we intend to transition to lua5.5 once the MIR is complete: apache2, ceph,dovecot,frr,haproxy,ibus-libpinyin,wireplumber,memcached

  dovecot, haproxy, memcached currently FTBFS when switch to depend on
  lua5.5 - this is being investigated and will need to be resolved
  before 5.4 can be demoted.

  dovecot: Requires an update of lua-json to 1.3.5 - opened here:
  https://salsa.debian.org/lua-team/lua-json/-/merge_requests/1, as well
  as some additional symlinks to have it properly generate the 5.5
  install directories. lua-json also requires an update to lua-lpeg with
  essentially the same symlinks. Builds successfully in my PPA below
  after taking these steps (but still needs functional testing)

  haproxy: Builds successfully after specifying
  `LUA_INC=/usr/include/lua5.5 LUA_LIB_NAME=lua5.5` as MAKEARGS

  memcached: Builds successfully after adding the newly introduced third parameter to lua_newstate in 2 instances:
  -        L = lua_newstate(mcp_profile_alloc, prof);
  +        L = lua_newstate(mcp_profile_alloc, prof, luaL_makeseed(NULL));

  Other packages built successfully in
  https://launchpad.net/~mitchellaugustin/+archive/ubuntu/quick-publish-
  dev-ppa-10-10-25/+packages

  [Standards compliance]
  - This package correctly follows FHS and Debian Policy

  [Maintenance/Owner]
  - Owning Team will be Ubuntu Server
  - Team is not yet, but will subscribe to the package before promotion

  - This does not use static builds

  - This does not use vendored code

  - This package is not rust based

  - The package successfully built during the most recent test rebuild

  [Background information]
  The Package description explains the package well
  Upstream Name is lua
  https://www.lua.org/source/5.5/

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/2155757/+subscriptions