[Bug 1242726] Re: php5-common is missing dependency on php5-json

Tue Oct 22 23:38:50 UTC 2013

This needs:

For Trusty:

An MIR approved for php-json.
An upload for php5-common to depend on php-json in Trusty.
Move php-json to main in Trusty.

For Saucy:

Agreement from the SRU team to move php-json to main in Saucy. 
An upload for php5-common to depend on php-json in Saucy.
Move php-json to main in Saucy.

** Description changed:

+ [Availability]
+ 
+ Available in universe; successfully built on all architectures.
+ 
+ [Rationale]
+ 
+ Useful functionality for a large proportion of php users; JSON support is
+ pretty essential for many web services nowadays.
+ 
+ New dependency of php5 (see background information below)
+ 
+ [Security]
+ 
+ JSON parsing is security sensitive; particular in web applications for which
+ PHP is often used. This package is a wrapper around json-c which is in main
+ already. We do need to make sure that the wrapper is not vulnerable, but the
+ JSON parsing itself is already covered by json-c in main.
+ 
+ No other relevant security history. CVE-2009-1271 appears to refer to the JSON
+ module bundled with PHP and not this alternative implementation.
+ 
+ No suid or sgid binaries. No executables in /sbin or /usr/sbin. No daemons. No
+ use of privileged ports.
+ 
+ This is an add-on to PHP and an expected use (parsing untrusted input) is
+ security sensitive.
+ 
+ [QA]
+ 
+ Works with no further configuration or documentation.
+ 
+ No debconf questions.
+ 
+ No long-term outstanding bugs upstream. The only bug in Debian appears to
+ relate to a edge case difference in error handling behaviour, which I'm not
+ sure is a bug at all. No relevant bugs in Ubuntu.
+ 
+ Outstanding Lintian bugs all refer to PHP packaging issues; this package is
+ maintained by the PHP maintainer in Debian.
+ 
+ No exotic hardware.
+ 
+ Test suite is run during package build using dh_auto_test which fails on test
+ suite failure.
+ 
+ No watch file.
+ 
+ [Dependencies]
+ 
+ All in main, including libjson-c-dev.
+ 
+ [Standards compliance]
+ 
+ Packaging uses debhelper 9, standard phpize and dh-php5.
+ 
+ [Maintenance]
+ 
+ This is a straightforward wrapper around json-c. Except to trivially keep
+ synced with Debian.
+ 
+ The Ubuntu Server team will subscribe to the package.
+ 
+ [Background Information]
+ 
+ The JSON module bundled by PHP upstream is not DFSG compliant due to a problem
+ with a licence term. See
+ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692613 for details. So Debian
+ does not ship with the embedded JSON module, but instead ships php-json
+ (binary: phphp5-json) which is an independent implementation, and php depends
+ on it.
+ 
+ For parity with Debian and common use of PHP, we should have php-json in main.
+ Otherwise we cannot depend on php5-json, and so JSON functionality in PHP will
+ be broken by default.
+ 
+ [Original Description]
+ 
  After the upgrade to saucy the function json_encode is missing from the
  current version of php5.

  It should be always there on PHP versions >= 5.2.0 (not a pecl module
  anymore) [1]

  to reproduce:
  ---
  user at vm:~$ echo '<?php json_encode(true);' | php
  PHP Fatal error:  Call to undefined function json_encode() in - on line 1
  PHP Stack trace:
  PHP   1. {main}() -:0
  user at vm:~$ php -v
- PHP 5.5.3-1ubuntu2 (cli) (built: Oct  9 2013 14:49:12) 
+ PHP 5.5.3-1ubuntu2 (cli) (built: Oct  9 2013 14:49:12)
  Copyright (c) 1997-2013 The PHP Group
  Zend Engine v2.5.0, Copyright (c) 1998-2013 Zend Technologies
-     with Zend OPcache v7.0.3-dev, Copyright (c) 1999-2013, by Zend Technologies
-     with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Rethans
+     with Zend OPcache v7.0.3-dev, Copyright (c) 1999-2013, by Zend Technologies
+     with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Rethans
  ---

  [1] http://php.net/manual/en/function.json-encode.php

  ProblemType: Bug
  DistroRelease: Ubuntu 13.10
  Package: php5 (not installed)
  ProcVersionSignature: Ubuntu 3.11.0-12.19-generic 3.11.3
  Uname: Linux 3.11.0-12-generic x86_64
  ApportVersion: 2.12.5-0ubuntu2
  Architecture: amd64
  Date: Mon Oct 21 16:30:04 2013
  InstallationDate: Installed on 2013-06-03 (140 days ago)
  InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release amd64 (20130424)
  MarkForUpload: True
  SourcePackage: php5
  UpgradeStatus: Upgraded to saucy on 2013-10-21 (0 days ago)

** Summary changed:

- php5-common is missing dependency on php5-json
+ [MIR] php5-common is missing dependency on php5-json

** Also affects: php-json (Ubuntu)
   Importance: Undecided
       Status: New

** Description changed:

+ MIR for php-json:
+ 
  [Availability]

  Available in universe; successfully built on all architectures.

  [Rationale]

  Useful functionality for a large proportion of php users; JSON support is
  pretty essential for many web services nowadays.

  New dependency of php5 (see background information below)

  [Security]

  JSON parsing is security sensitive; particular in web applications for which
  PHP is often used. This package is a wrapper around json-c which is in main
  already. We do need to make sure that the wrapper is not vulnerable, but the
  JSON parsing itself is already covered by json-c in main.

  No other relevant security history. CVE-2009-1271 appears to refer to the JSON
  module bundled with PHP and not this alternative implementation.

  No suid or sgid binaries. No executables in /sbin or /usr/sbin. No daemons. No
  use of privileged ports.

  This is an add-on to PHP and an expected use (parsing untrusted input) is
  security sensitive.

  [QA]

  Works with no further configuration or documentation.

  No debconf questions.

  No long-term outstanding bugs upstream. The only bug in Debian appears to
  relate to a edge case difference in error handling behaviour, which I'm not
  sure is a bug at all. No relevant bugs in Ubuntu.

  Outstanding Lintian bugs all refer to PHP packaging issues; this package is
  maintained by the PHP maintainer in Debian.

  No exotic hardware.

  Test suite is run during package build using dh_auto_test which fails on test
  suite failure.

  No watch file.

  [Dependencies]

  All in main, including libjson-c-dev.

  [Standards compliance]

  Packaging uses debhelper 9, standard phpize and dh-php5.

  [Maintenance]

  This is a straightforward wrapper around json-c. Except to trivially keep
  synced with Debian.

  The Ubuntu Server team will subscribe to the package.

  [Background Information]

  The JSON module bundled by PHP upstream is not DFSG compliant due to a problem
  with a licence term. See
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692613 for details. So Debian
  does not ship with the embedded JSON module, but instead ships php-json
  (binary: phphp5-json) which is an independent implementation, and php depends
  on it.

  For parity with Debian and common use of PHP, we should have php-json in main.
  Otherwise we cannot depend on php5-json, and so JSON functionality in PHP will
  be broken by default.

  [Original Description]

  After the upgrade to saucy the function json_encode is missing from the
  current version of php5.

  It should be always there on PHP versions >= 5.2.0 (not a pecl module
  anymore) [1]

  to reproduce:
  ---
  user at vm:~$ echo '<?php json_encode(true);' | php
  PHP Fatal error:  Call to undefined function json_encode() in - on line 1
  PHP Stack trace:
  PHP   1. {main}() -:0
  user at vm:~$ php -v
  PHP 5.5.3-1ubuntu2 (cli) (built: Oct  9 2013 14:49:12)
  Copyright (c) 1997-2013 The PHP Group
  Zend Engine v2.5.0, Copyright (c) 1998-2013 Zend Technologies
      with Zend OPcache v7.0.3-dev, Copyright (c) 1999-2013, by Zend Technologies
      with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Rethans
  ---

  [1] http://php.net/manual/en/function.json-encode.php

  ProblemType: Bug
  DistroRelease: Ubuntu 13.10
  Package: php5 (not installed)
  ProcVersionSignature: Ubuntu 3.11.0-12.19-generic 3.11.3
  Uname: Linux 3.11.0-12-generic x86_64
  ApportVersion: 2.12.5-0ubuntu2
  Architecture: amd64
  Date: Mon Oct 21 16:30:04 2013
  InstallationDate: Installed on 2013-06-03 (140 days ago)
  InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release amd64 (20130424)
  MarkForUpload: True
  SourcePackage: php5
  UpgradeStatus: Upgraded to saucy on 2013-10-21 (0 days ago)

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to php5 in Ubuntu.
https://bugs.launchpad.net/bugs/1242726

Title:
  [MIR] php5-common is missing dependency on php5-json

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/php-json/+bug/1242726/+subscriptions