[Python-modules-team] Bug#1021851: bullseye-pu: package python-dnslib/0.9.14-1

2022-10-15 Thread Scott Kitterman
debian/patches/0002-Validate-TXID-in-client.py.patch from upstream to +address CVE-2022-22846 + + -- Scott Kitterman Sat, 15 Oct 2022 20:23:24 -0400 + python-dnslib (0.9.14-1) unstable; urgency=medium * New upstream release diff -Nru python-dnslib-0.9.14/debian/patches/0002-Validate-TXID

[Python-modules-team] Bug#1003150: python3-wheel: Missing depends on python3-distutils

2022-01-04 Thread Scott Kitterman
Package: python3-wheel Version: 0.34.2-1 Severity: serious Justification: Policy 4.5 Attempted to unpack a wheel in a pretty minimal sid chroot and got this error: $ python3 -m wheel unpack setuptools-44.1.1-py2.py3-none-any.whl Traceback (most recent call last): File

Re: [Python-modules-team] CVE-2008-1447: python-dns fix version issue

2021-05-17 Thread Scott Kitterman
Security tracker is correct for python-dns. Scott K On May 14, 2021 6:22:12 AM UTC, Brian May wrote: >Forwarding this request to secur...@debian.org who deal with the >security infrastructure in Debian. > >Andrei Nikonov writes: > >> Dear Mr. Kitterman and Python Modules Team, >> >> I am

Re: [Python-modules-team] proposal: moving awscli and python-botocore to cloud-team ownership

2020-06-23 Thread Scott Kitterman
On June 24, 2020 12:18:39 AM UTC, Noah Meyerhans wrote: >On Tue, Jun 23, 2020 at 08:35:53PM -0300, Emmanuel Arias wrote: >> > Please don't. Please ask them to be moved properly by opening a >ticket >> > if you don't find another way. >> >> I agree with Bastian, This is not a fork itself, Is

[Python-modules-team] Bug#938027: Bug#938027: python-pip: Python2 removal in sid/bullseye - reopen 938027

2020-06-19 Thread Scott Kitterman
On June 20, 2020 2:40:58 AM UTC, Sandro Tosi wrote: >Control: reopen -1 > >This bug was closed, but the package has still some dependencies >towards >Python2 packages, in details: > >(source:python-pip)Build-Depends->python-pkg-resources >(source:python-pip)Build-Depends->python-setuptools >

[Python-modules-team] Bug#961629: Bug#961629: /usr/bin/virtualenv: Re: python3-virtualenv: Fails to create a Python 3.7 environment

2020-06-15 Thread Scott Kitterman
On Monday, June 15, 2020 6:06:53 PM EDT ottakar wrote: > Package: python3-virtualenv > Version: 20.0.21+ds-2 > Followup-For: Bug #961629 > > Dear Maintainer, > > Could someone confirm I encountered the same bug? > > I install a fresh `python3.7.7`, but `pip` fails inside virtual environments >

Re: [Python-modules-team] Bug#958848: Bug#937769: python-funcsigs build-dependencies now unsatisfiable in testing, removal of pypy-pytest

2020-06-04 Thread Scott Kitterman
On Thursday, June 4, 2020 6:12:29 PM EDT Thomas Goirand wrote: > On 6/4/20 10:33 PM, peter green wrote: > > A few days ago Sandro Tosi uploaded the python-unittest2 and > > python-funcsigs source packages. It seems that both of these were > > effectively "team uploads" though they were not marked

[Python-modules-team] Bug#960537: Bug#960537: Bug#960537: python3-html5lib: DeprecationWarning in collections import (will be failure with python3.9)

2020-05-13 Thread Scott Kitterman
On Wednesday, May 13, 2020 2:45:48 PM EDT Scott Kitterman wrote: > On Wednesday, May 13, 2020 1:14:54 PM EDT Scott Kitterman wrote: > > Package: python3-html5lib > > Version: 1.0.1-3 > > Severity: normal > > > > Currently with python3.7 or 3.8: > > Deprecat

[Python-modules-team] Bug#960548: python3-pyparsing: DeprecationWarning in collections import (will be failure with python3.9)

2020-05-13 Thread Scott Kitterman
Package: python3-pyparsing Version: 2.4.7-1 Severity: normal Currently there is just a warning, but once we switch to python3.9 the following line will fail: from collections import MutableMapping, Mapping This is already fixed upstream [1]. It's an easy enough fix (probably much easier

[Python-modules-team] Bug#930781: python3-socks: Deprecation warning emitted on import

2020-05-13 Thread Scott Kitterman
On Thu, 20 Jun 2019 09:53:06 -0400 Jamie Bliss wrote: > Package: python3-socks > Version: 1.6.8+dfsg-1 > Severity: normal > > Dear Maintainer, > > PySocks 1.6.8 has a deprecated import and a warning is emitted on import. This > is triggered by importing requests, an extremely common HTTP

[Python-modules-team] Bug#960537: Bug#960537: python3-html5lib: DeprecationWarning in collections import (will be failure with python3.9)

2020-05-13 Thread Scott Kitterman
On Wednesday, May 13, 2020 1:14:54 PM EDT Scott Kitterman wrote: > Package: python3-html5lib > Version: 1.0.1-3 > Severity: normal > > Currently with python3.7 or 3.8: > DeprecationWarning: Using or importing the ABCs from 'collections' instead > of from 'collectio

[Python-modules-team] Bug#960537: python3-html5lib: DeprecationWarning in collections import (will be failure with python3.9)

2020-05-13 Thread Scott Kitterman
Package: python3-html5lib Version: 1.0.1-3 Severity: normal Currently with python3.7 or 3.8: DeprecationWarning: Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated, and in 3.9 it will stop working from collections import Mapping When we get python3.9

[Python-modules-team] Bug#954907: Bug#954907: python3-dateparser: Warning with autopkgtest when python3.8 is default

2020-05-11 Thread Scott Kitterman
On Monday, May 11, 2020 4:18:45 PM EDT Emmanuel Arias wrote: > El lun., 11 de may. de 2020 a la(s) 17:10, Antoine Beaupré > > (anar...@debian.org) escribió: > > On 2020-05-11 14:53:29, Scott Kitterman wrote: > > > On Monday, May 11, 2020 2:39:30 PM EDT Antoine Beaupré wro

[Python-modules-team] Bug#954907: Bug#954907: python3-dateparser: Warning with autopkgtest when python3.8 is default

2020-05-11 Thread Scott Kitterman
On Monday, May 11, 2020 2:39:30 PM EDT Antoine Beaupré wrote: > On 2020-05-11 15:18:53, Emmanuel Arias wrote: > > Hi, > > > > The upstream and pristine-tar branches are not generated on salsa for > > any particular reason.? > > I'm not sure what question you are asking here. This package doesn't

[Python-modules-team] Bug#938756: Bug#938756: Bug#937769: getting python-linecache2/python-traceback2 fixes into testing (FAO traceback2, funcsigs nipype and numba maintainers).

2020-05-07 Thread Scott Kitterman
On Thursday, May 7, 2020 2:00:58 PM EDT peter green wrote: > I got a failure too when I cloned that branch and tried to build it, but > once I added in the changes from the previous NMU it built fine. I would > push that addition back to the branch but i'm not currently a member of the > python

[Python-modules-team] Bug#956332: Python2 Removal Is Intentional

2020-05-03 Thread Scott Kitterman
On Fri, 10 Apr 2020 02:40:07 + Scott Kitterman wrote: > This is not a bug. Python2 is no longer supported upstream and we are in the process of removing it. For anyone coming along looking for additional information, as of pip 20.1, which as I write this is about to be uploaded to Deb

[Python-modules-team] python-tz_2020.1-1_amd64.changes REJECTED

2020-04-30 Thread Scott Kitterman
Unfortunately I am going to have to reject your package. Despite the statement in debian/copyright: # Files-Excluded: pytz/zoneinfo/* # We don't ship these files as we use the system version from tzdata instead; # According to tzdata, these files are in the public domain Those files are, in

Re: [Python-modules-team] Another virtualenv question

2020-04-28 Thread Scott Kitterman
On Tuesday, April 28, 2020 5:48:04 PM EDT Rainer Dorsch wrote: > Hello, > > I have another basic virtualenv question: > > I install covidify in a virtualenv and if finds the dependency > > Requirement already satisfied: docopt in /usr/lib/python3/dist-packages > (from covidify) (0.6.2) > >

[Python-modules-team] Bug#958764: Bug#958764: closed by Scott Kitterman (re: python3-pip: debundled _vendor packaging approach breaks usage of pip in environments)

2020-04-25 Thread Scott Kitterman
I do have something that might address this, but I'm reluctant to promise anything until I test it. Scott K ___ Python-modules-team mailing list Python-modules-team@alioth-lists.debian.net

[Python-modules-team] Bug#938756: Bug#938756: Bug#937769: getting python-linecache2/python-traceback2 fixes into testing (FAO traceback2, funcsigs nipype and numba maintainers).

2020-04-20 Thread Scott Kitterman
On Monday, April 20, 2020 8:51:10 AM EDT peter green wrote: > On 20/04/2020 08:57, Thomas Goirand wrote: > >> Option 1: fix all four packages to be python 2 free. > >> > >> Option 2: Remove python2 stuff from traceback2, python-funcsigs and > >> numba. Break the dependencies of nipype in sid. >

[Python-modules-team] Bug#938756: Bug#938756: getting python-linecache2/python-traceback2 fixes into testing (FAO traceback2, funcsigs nipype and numba maintainers).

2020-04-19 Thread Scott Kitterman
On April 20, 2020 2:36:00 AM UTC, peter green wrote: >(using -quiet aliases where multiple involved packages have the same >maintainer listed. > >Hi > >I have just been running some self-contained buildability tests on >bullseye and these tests indicated that the python-linecache2 and

[Python-modules-team] Bug#954812: Bug#954812: pythonmagick: autopkgtest regression: cannot import name '_PythonMagick'

2020-04-18 Thread Scott Kitterman
On April 18, 2020 10:03:01 AM UTC, Adrian Bunk wrote: >On Mon, Mar 23, 2020 at 09:43:19PM +0100, Paul Gevers wrote: >> Source: pythonmagick >> Version: 0.9.19-6 >> X-Debbugs-CC: debian...@lists.debian.org >> Severity: serious >> User: debian...@lists.debian.org >> Usertags: regression >> >>

[Python-modules-team] Bug#515634: python-yaml: YAML loader complains about non-unique anchors

2020-04-15 Thread Scott Kitterman
The proposed change in https://github.com/yaml/pyyaml/pull/394 resolves this issue. Scott K signature.asc Description: This is a digitally signed message part. ___ Python-modules-team mailing list Python-modules-team@alioth-lists.debian.net

[Python-modules-team] Bug#515634: Unable to replicate Debian Bug report

2020-04-15 Thread Scott Kitterman
Still a problem: File "/usr/lib/python3/dist-packages/yaml/__init__.py", line 114, in load return loader.get_single_data() File "/usr/lib/python3/dist-packages/yaml/constructor.py", line 49, in get_single_data node = self.get_single_node() File

[Python-modules-team] Comments regarding validators_0.14.2-1_amd64.changes

2020-04-11 Thread Scott Kitterman
Historically I would have rejected this package due to incomplete debian/copyright. Please see validators/email.py. :copyright: (c) Django Software Foundation and individual contributors. :license: BSD Since email.py isn't compiled, the license statement is actually present in the

[Python-modules-team] Bug#955650: python-tablib: FTBFS: E NotImplementedError: DataFrame Format requires `pandas` to be installed. Try `pip install tablib[pandas]`.

2020-04-04 Thread Scott Kitterman
On Fri, 3 Apr 2020 21:55:04 +0200 Lucas Nussbaum wrote: > Source: python-tablib > Version: 0.13.0-1 > Severity: serious > Justification: FTBFS on amd64 > Tags: bullseye sid ftbfs > Usertags: ftbfs-20200402 ftbfs-bullseye > > Hi, > > During a rebuild of all packages in sid, your package failed

[Python-modules-team] Bug#892744: python3-pip: breaks with venv --system-site-packages

2020-04-03 Thread Scott Kitterman
On Mon, 12 Mar 2018 14:53:11 +0100 Bernhard Reiter wrote: > Package: python3-pip > Version: 9.0.1-2 > Severity: normal > > Hi Maintainers, > > according to `pip help install`:: > > --user > [..] > On Debian systems, this is the default when running outside of a > virtual environment and

[Python-modules-team] Bug#928767: pip regression

2020-04-03 Thread Scott Kitterman
On Fri, 10 May 2019 19:30:58 +0200 =?UTF-8?Q?Josu=c3=a9_Tille?= wrote: > Package: python-pip > > Hello, > > > > Debian version : 9.9 > > probable package : python-pip 9.0.1-2+deb9u1 > > > I detected that since some days the install of package with pip fail > randomly with this stacktrace:

[Python-modules-team] Bug#955624: Bug#955624: python3-pip: depend on python3.8 instead of python3.7

2020-04-03 Thread Scott Kitterman
On Friday, April 3, 2020 10:57:10 AM EDT Jörg-Volker Peetz wrote: > Package: python3-pip > Version: 20.0.2-3 > Severity: wishlist > > Dear Debian Python Modules Team, > > this package is one of two on my system which still depends on > python3.7. When is the shift to dependency on python3.8

[Python-modules-team] Comments regarding requests_2.23.0+dfsg-1_amd64.changes

2020-04-01 Thread Scott Kitterman
This is just a minor issue, but I think it would make sense that both python-requests and python3-requests would Suggest: python-requests-doc. Please consider for your next upload. Scott K ___ Python-modules-team mailing list

[Python-modules-team] Bug#954256: python-pip-whl: Editable installs broken: can't find __main__ module

2020-03-31 Thread Scott Kitterman
On Tue, 31 Mar 2020 15:03:30 -0400 Scott Kitterman wrote: > On Fri, 27 Mar 2020 08:50:28 -0400 Scott Kitterman > wrote: > > On Fri, 27 Mar 2020 01:39:04 -0400 Scott Kitterman > > wrote: > > > On Fri, 27 Mar 2020 01:25:28 -0400 Scott Kitterman > >

[Python-modules-team] Bug#912379: Bug #912379: /usr/bin/pip3: TypeError on "list --outdated": uses different Version implementations

2020-03-31 Thread Scott Kitterman
On Tue, 30 Oct 2018 21:50:36 +0100 Ben Wiederhake wrote: > Package: python3-pip > Version: 9.0.1-2.3 > Severity: normal > File: /usr/bin/pip3 > > Dear Maintainer, > > I'm having trouble running this command: > > pip3 list --outdated > > Expected behavior: A list of outdated, local

[Python-modules-team] Bug#912379: Please update the pip package

2020-03-31 Thread Scott Kitterman
On Tue, 17 Mar 2020 10:38:23 -0400 Scott Kitterman wrote: > On Fri, 10 Jan 2020 00:02:12 -0800 Nye Liu wrote: > > this bug is now more than a year old. > > > > Please update python3-pip and python-pip packages to >19.1 > > The same problem still exists with

[Python-modules-team] Bug#955414: python3-pip: pip fails to install packages with pyproject.toml

2020-03-31 Thread Scott Kitterman
On Tue, 31 Mar 2020 14:31:40 +0200 Christoph Reiter wrote: > Package: python3-pip > Version: 20.0.2-2 > Severity: important > > Dear Maintainer, > > (Note: This doesn't affect upstream pip, only the Debian/Ubuntu version) > > pip in Debian (and Ubuntu focal) fails to install Python packages

[Python-modules-team] Bug#955388: src:python-bleach: Regular expression denial of service (CVE-2020-6817)

2020-03-30 Thread Scott Kitterman
Package: src:python-bleach Version: 3.1.2-0+deb10u1 Severity: important Tags: security Once again with a python-bleach security issue... https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm Title regular expression denial-of-service (ReDoS) in

[Python-modules-team] Comments regarding python-libais_0.17+git.20190917.master.e464cf8-1_amd64.changes

2020-03-29 Thread Scott Kitterman
I am going to accept this package. I did notice that there are copyright attributions missing. Since this is for an Apache-2.0 project they are not required for license compliance, but they are required by Debian policy. Please add them in your next upload. src/libais/decode_body.cpp://

[Python-modules-team] Comments regarding python-fluent-logger_0.9.6-1_amd64.changes

2020-03-29 Thread Scott Kitterman
I am going to accept this package, however I noted two issues that should be addressed in a future upload: 1. Please change py3versions -i to py3versions -s in your autopkgtest. testing against whatever python3 versions that happen to be installed is unreliable (this was a huge issue in the

[Python-modules-team] Comments regarding python-django-libsass_0.8-1_amd64.changes

2020-03-29 Thread Scott Kitterman
I am going to accept this, but I suggest you reconider having the binary not depend on python3-django. It's true that there is an indirect depends as stated in the lintian override comment, but the standard Debian practice is not to depend on indirect dependencies to pull things in. This package

[Python-modules-team] Comments regarding python-mpv_0.4.5-1_amd64.changes

2020-03-29 Thread Scott Kitterman
Please do not add lintian overrides like this: # I have not been able to run the testsuite successfully, and I'm not sure it's # possible to run it on a headless machine. # See https://github.com/jaseg/python-mpv/issues/108 for more details. source: testsuite-autopkgtest-missing # There is an

[Python-modules-team] Comments regarding sphinxcontrib-devhelp_1.0.2-1_amd64.changes

2020-03-28 Thread Scott Kitterman
Same comment about the .tx directory for this package as I just sent for the qthelp one. Scott K ___ Python-modules-team mailing list Python-modules-team@alioth-lists.debian.net

[Python-modules-team] Comments regarding sphinxcontrib-qthelp_1.0.3-1_amd64.changes

2020-03-28 Thread Scott Kitterman
This is not a major issue in the package, but the .tx directory with the Transifex config file in it doesn't need to be shipped in the binary. You might want to look at how mitya57 dealt with it in sphinxcontrib- serializinghtml. It seems clean enough. Scott K

[Python-modules-team] Bug#954256: python-pip-whl: Editable installs broken: can't find __main__ module

2020-03-27 Thread Scott Kitterman
On Fri, 27 Mar 2020 01:39:04 -0400 Scott Kitterman wrote: > On Fri, 27 Mar 2020 01:25:28 -0400 Scott Kitterman > wrote: > > I can replicate this with the current pip in unstable (which is the current > > upstream release). We kept pep517 at version 0.7.0 because tha

[Python-modules-team] Bug#954256: Bug

2020-03-26 Thread Scott Kitterman
On Thu, 19 Mar 2020 12:20:05 + Scott Kitterman wrote: > Thanks. The virtualenv package needs updating following the recent pip update. I'm working on it. I can still replicate this with the new virtualenv. Here's the verbose version for posterity: Installing collected packa

[Python-modules-team] Bug#955000: azure-cli: Autopkgtest failure in unstable

2020-03-26 Thread Scott Kitterman
Package: azure-cli Version: 2.0.81+ds-3 Severity: serious Tags: ftbfs Justification: fails to build from source (but built successfully in the past) Note: Using the FTBFS tag because it is the closest one we have. Now that humanfriendly is fixed to provide the missing files, azure-cli has what

[Python-modules-team] Bug#954910: dateparser: Incomplete test coverage due to missing requirements

2020-03-25 Thread Scott Kitterman
Source: dateparser Version: 0.7.2-1 Severity: normal The current pip based install for the test includes two module not in Debian: jdatetime==3.1.0 umalqurra==0.2 As a result, 7 tests are skipped. Presumably this means that related functionality isn't available to users of the Debian package.

[Python-modules-team] Bug#954909: python3-dateparser: Missing Recommends on python3-convertdate

2020-03-25 Thread Scott Kitterman
Package: python3-dateparser Version: 0.7.2-1 Severity: important While investigating what the minimal package set that python3-dateparser needs to run its tests, I learned that adding python3-convertdate to the test environment causes 107 additional test cases to run. This seems like it's an

[Python-modules-team] Bug#954907: python3-dateparser: Warning with autopkgtest when python3.8 is default

2020-03-25 Thread Scott Kitterman
Package: python3-dateparser Version: 0.7.2-1 Severity: normal While investigatin a resolution for #954147, I noticed the following warning being emitted. Presumably this will turn to an error in the future and should, at some point, be addressed:

[Python-modules-team] Bug#954812: Bug#954812: pythonmagick: autopkgtest regression: cannot import name '_PythonMagick'

2020-03-23 Thread Scott Kitterman
The problem here is that py3versions -r falls back to supported versions when no X-Python3-Versions header field is present in debian/control and pythonmagic is only built for the current version: https://packages.debian.org/sid/amd64/python3-pythonmagick/filelist (shows only python3.8

Re: [Python-modules-team] python-xlib_0.26-1_source.changes ACCEPTED into unstable

2020-03-21 Thread Scott Kitterman
On Saturday, March 21, 2020 3:14:20 PM EDT Scott Kitterman wrote: > On Saturday, March 21, 2020 3:02:27 PM EDT Andrej Shadura wrote: > > Hi, > > > > On Sat, 21 Mar 2020 at 19:39, Sandro Tosi wrote: > > > > On Sat, 21 Mar 2020 at 18:01, Sandro Tosi wrote

[Python-modules-team] Bug#954481: src:python3-proselint: Autopkgtest failure due to use of py3versions -i

2020-03-21 Thread Scott Kitterman
Package: src:python3-proselint Version: 0.10.2-1 Severity: serious Tags: ftbfs Justification: fails to build from source (but built successfully in the past) Note: Using the FTBFS tag because it's the closest we have. This package failed a recent autopkgtest and this is one of the blockers for

[Python-modules-team] Bug#954479: src:python-pynvim: Autopkgtest failure due to use of py3versions -i

2020-03-21 Thread Scott Kitterman
Package: src:python-pynvim Version: 0.4.1-1 Severity: serious Tags: ftbfs Justification: fails to build from source (but built successfully in the past) Note: Using the FTBFS tag because it's the closest we have. This package failed a recent autopkgtest and this is one of the blockers for

[Python-modules-team] Bug#954474: src:python-h2: Autopkgtest failure due to use of py3versions -i

2020-03-21 Thread Scott Kitterman
Package: src:python-h2 Version: 3.2.0-1 Severity: serious Tags: ftbfs Justification: fails to build from source (but built successfully in the past) Note: Using the FTBFS tag because it's the closest we have. This package failed a recent autopkgtest and this is one of the blockers for

[Python-modules-team] Bug#954471: src:pystemd: Autopkgtest failure due to use of py3versions -iwq

2020-03-21 Thread Scott Kitterman
Package: src:pystemd Version: 0.7.0-2 Severity: serious Tags: ftbfs Justification: fails to build from source (but built successfully in the past) Note: Using the FTBFS tag because it's the closest we have. This package failed a recent autopkgtest and this is one of the blockers for

[Python-modules-team] Bug#954467: src:pydbus: Autopkgtest failure due to use of py3versions -i

2020-03-21 Thread Scott Kitterman
Package: src:pydbus Version: 0.6.0-2 Severity: serious Tags: ftbfs Justification: fails to build from source (but built successfully in the past) Note: Using the FTBFS tag because it's the closest one we have. This package failed a recent autopkgtest and this is one of the blockers for

Re: [Python-modules-team] python-xlib_0.26-1_source.changes ACCEPTED into unstable

2020-03-21 Thread Scott Kitterman
On Saturday, March 21, 2020 3:02:27 PM EDT Andrej Shadura wrote: > Hi, > > On Sat, 21 Mar 2020 at 19:39, Sandro Tosi wrote: > > > On Sat, 21 Mar 2020 at 18:01, Sandro Tosi wrote: > > > > Andrej, > > > > why the pristine-tar information are now in a `pristine-lfs` branch? > > > > where did the

[Python-modules-team] Bug#954236: Proposed Buster Fix (pyhon3-bleach: New secuirty issue: mutation XSS (again))

2020-03-20 Thread Scott Kitterman
On Thursday, March 19, 2020 6:24:22 PM EDT Salvatore Bonaccorso wrote: > Hi Scott, > > On Thu, Mar 19, 2020 at 12:20:25AM -0400, Scott Kitterman wrote: > > Upstream's 3.1.2 release had just the security fix in it. I propose > > updating buster with it (I put 3.1.3 in uns

[Python-modules-team] Bug#938249: python-virtualenv: Python2 removal in sid/bullseye

2020-03-20 Thread Scott Kitterman
I know this is marked py2keep, but I don't think we can. Our virtualenv is 5 years old and really needs updated. The brings in a requirement for pip in the base virtualenv which then needs a wheel for ipaddr (which is already out of testing) and python-pip, which has already been dropped. I

[Python-modules-team] Bug#954256: Bug#954256: python-pip-whl: Editable installs broken: can't find __main__ module

2020-03-19 Thread Scott Kitterman
Thanks. The virtualenv package needs updating following the recent pip update. I'm working on it. Scott K ___ Python-modules-team mailing list Python-modules-team@alioth-lists.debian.net

[Python-modules-team] Bug#954236: Proposed Buster Fix (pyhon3-bleach: New secuirty issue: mutation XSS (again))

2020-03-18 Thread Scott Kitterman
-- diff -Nru python-bleach-3.1.1/debian/changelog python-bleach-3.1.2/debian/changelog --- python-bleach-3.1.1/debian/changelog 2020-02-27 05:53:52.0 -0500 +++ python-bleach-3.1.2/debian/changelog 2020-03-19 00:14:11.0 -0400 @@ -1,3 +1,9 @@ +python-bleach (3.1.2-0+

[Python-modules-team] Bug#954236: python3-bleach: New secuirty issue: mutation XSS (again)

2020-03-18 Thread Scott Kitterman
Package: python3-bleach Version: 3.1.1-0+deb10u1 Severity: serious Tags: security upstream From the upstream CHANGES for 3.1.2, which I just noticed: **Security fixes** * ``bleach.clean`` behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and

[Python-modules-team] Bug#912379: Please update the pip package

2020-03-17 Thread Scott Kitterman
On Fri, 10 Jan 2020 00:02:12 -0800 Nye Liu wrote: > this bug is now more than a year old. > > Please update python3-pip and python-pip packages to >19.1 The same problem still exists with 20.2 in unstable. It appears that the fundamental problem is that pip uses a modified pkg_resources copy

[Python-modules-team] Bug#954153: src:python-virtualenv: Please drop python-virtualenv tests

2020-03-17 Thread Scott Kitterman
Package: src:python-virtualenv Version: 15.1.0+ds-3 Severity: serious Tags: ftbfs Justification: fails to build from source (but built successfully in the past) This is really an autopkgtest failure bug, but I think ftbfs is the closest tag we have. Please drop the autopkgtests for

[Python-modules-team] Bug#954147: src:dateparser: Requires a package outside of Main

2020-03-17 Thread Scott Kitterman
Package: src:dateparser Version: 0.7.2-1 Severity: serious Justification: Policy 2.2.1 This package uses python pip to download and install packages from outside the Debian archive to run autopkgtests. Main is required to be self-contained, including for tests. See the FTP Master's reject FAQ

[Python-modules-team] Bug#947069: pip does not handle manylinux2010 tag (PEP571)

2020-03-14 Thread Scott Kitterman
On Fri, 20 Dec 2019 13:27:54 +0100 Gabriel Corona wrote: > Package: python3-pip > Version: 18.1-5 > Severity: normal > > Dear Maintainer, > > The pip package as installed by python3-pip refuses to install > manylinux2010 wheels (see PEP 571). This needs a newer pip version to properly support.

[Python-modules-team] Bug#938027: Bug#938027: Bug#938027: python-pip: Python2 removal in sid/bullseye

2020-03-13 Thread Scott Kitterman
On Friday, March 13, 2020 6:36:59 PM EDT Sandro Tosi wrote: > On Fri, Mar 13, 2020 at 3:51 PM Scott Kitterman wrote: > > I don't know of a reason not to go ahead, but if you do, please be careful > > of what's already in git. Update to the new version is staged there. It

[Python-modules-team] Bug#938027: Bug#938027: python-pip: Python2 removal in sid/bullseye

2020-03-13 Thread Scott Kitterman
I don't know of a reason not to go ahead, but if you do, please be careful of what's already in git. Update to the new version is staged there. It is blocked on updates for some of the packages it builds wheels from. Scott K On March 13, 2020 7:32:35 PM UTC, Sandro Tosi wrote: >On Fri, 30

[Python-modules-team] Comments regarding sip5_5.1.1+dfsg-1_amd64.changes

2020-03-07 Thread Scott Kitterman
There are a few minor issues that I'm going to point out right before I accept this: The earliest Riverbank copyright claim in the package is 2015, not 2019. Please update that in your next upload. Also, some man pages would be nice: W: sip5-tools: binary-without-manpage usr/bin/sip-build W:

[Python-modules-team] Bug#953013: Bug#953013: pyyaml: CVE-2020-1747: arbitrary command execution through python/object/new when FullLoader is used

2020-03-06 Thread Scott Kitterman
On Tuesday, March 3, 2020 11:41:26 AM EST Salvatore Bonaccorso wrote: > Hi Scott, > > On Tue, Mar 03, 2020 at 09:19:06AM -0500, Scott Kitterman wrote: > > On Tuesday, March 3, 2020 2:29:51 AM EST Salvatore Bonaccorso wrote: > > > Source: pyyaml > > > Version

[Python-modules-team] Bug#953139: Bug#953139: BUG #953139 Info on other distros

2020-03-06 Thread Scott Kitterman
On March 6, 2020 3:05:17 PM UTC, Ron Lovell wrote: >I checked a couple of other distros I run. In Arch Linux >distutils/util.py >is provided by the base "python" pkg. In openSUSE Tumbleweed it is >provided >by python3-base. So among my installations, Debian Buster and Sid are >the >odd ducks in

[Python-modules-team] Bug#953013: Bug#953013: pyyaml: CVE-2020-1747: arbitrary command execution through python/object/new when FullLoader is used

2020-03-03 Thread Scott Kitterman
On Tuesday, March 3, 2020 11:41:26 AM EST Salvatore Bonaccorso wrote: > Hi Scott, > > On Tue, Mar 03, 2020 at 09:19:06AM -0500, Scott Kitterman wrote: > > On Tuesday, March 3, 2020 2:29:51 AM EST Salvatore Bonaccorso wrote: > > > Source: pyyaml > > > Version

[Python-modules-team] Bug#952782: python-dnspython: Python 2 binary should not be released with bullseye

2020-02-28 Thread Scott Kitterman
Package: python-dnspython Version: 1.16.0-1 Severity: serious As the primary maintianer of dnspython, I don't think it is suitable to leave with a python2 binary for the bullseye release. Scott K ___ Python-modules-team mailing list

[Python-modules-team] Bug#951907: Suggested Stable Fix

2020-02-28 Thread Scott Kitterman
On Thursday, February 27, 2020 8:11:32 AM EST Salvatore Bonaccorso wrote: > Hi Scott, > > On Thu, Feb 27, 2020 at 01:41:44PM +0100, Salvatore Bonaccorso wrote: > > Hi, > > > > On Thu, Feb 27, 2020 at 01:18:55PM +0100, Salvatore Bonaccorso wrote: > > > I think though we mgiht need to revisit the

[Python-modules-team] Bug#951907: Suggested Stable Fix

2020-02-27 Thread Scott Kitterman
On February 27, 2020 12:18:53 PM UTC, Salvatore Bonaccorso wrote: >Hi Scott, > >On Thu, Feb 27, 2020 at 06:24:09AM -0500, Scott Kitterman wrote: >> On Thursday, February 27, 2020 2:44:48 AM EST Salvatore Bonaccorso >wrote: >> > Hi Scott, >> > >>

[Python-modules-team] Bug#951907: Suggested Stable Fix

2020-02-27 Thread Scott Kitterman
On Thursday, February 27, 2020 2:44:48 AM EST Salvatore Bonaccorso wrote: > Hi Scott, > > On Sat, Feb 22, 2020 at 07:20:34PM -0500, Scott Kitterman wrote: > > Debdiff for proposed stable security update attached. > > > > The first hunk of the patch has the actual

[Python-modules-team] Bug#951907: Suggested Stable Fix

2020-02-22 Thread Scott Kitterman
1.0/debian/changelog 2019-01-15 00:46:11.0 -0500 +++ python-bleach-3.1.1/debian/changelog 2020-02-22 19:08:53.0 -0500 @@ -1,3 +1,9 @@ +python-bleach (3.1.1-0+deb10u1) buster-security; urgency=medium + + * New upstream security release (Closes: #951907) + + -- Scott Kitterman Sat,

[Python-modules-team] Bug#951907: Acknowledgement (src:python-bleach: Security issue: mutation XSS vulnerability)

2020-02-22 Thread Scott Kitterman
I checked and I can find no evidence that the version in oldstable is affected. Scott K signature.asc Description: This is a digitally signed message part. ___ Python-modules-team mailing list Python-modules-team@alioth-lists.debian.net

[Python-modules-team] Bug#951907: src:python-bleach: Security issue: mutation XSS vulnerability

2020-02-22 Thread Scott Kitterman
Package: src:python-bleach Version: 3.1.0-1 Severity: serious Tags: security upstream From the upstream change log: **Security fixes** * ``bleach.clean`` behavior parsing ``noscript`` tags did not match browser behavior. Calls to ``bleach.clean`` allowing ``noscript`` and one or more of

[Python-modules-team] Bug#949029: Processed: reassign 949029 to python3.8

2020-02-18 Thread Scott Kitterman
Revert is being done upstream for python 3.8.2: https://bugs.python.org/msg361815 Since it appears this is going to be solved in python3.8, I'm going to reassign again. Please don't reassign back, there's no point. There's another open bug against ptyhon-bleach for this. Scott K

[Python-modules-team] Bug#949029: python-bleach is failing the autopkg tests with Python 3.8

2020-01-25 Thread Scott Kitterman
This is due to a breaking change that was inappropriately included in python3.8 3.8.1. See: https://bugs.python.org/issue27657 https://github.com/mozilla/bleach/issues/503 Rather than "Fixed" in python-bleach, the breaking change in python3.8 should be reverted. Python3 can break

[Python-modules-team] Bug#938157: Bug#938157: Bug#938157: python-scipy: Python2 removal in sid/bullseye

2020-01-12 Thread Scott Kitterman
On January 13, 2020 5:00:24 AM UTC, Drew Parsons wrote: >On 2020-01-13 12:47, Sandro Tosi wrote: >>> Thanks Sandro. There is RC bug#946624 affecting python-scipy, with >a >>> counterpart in #946625 for python3-scipy. Something subtle has >>> changed >>> in the syntax for skipping tests, I

[Python-modules-team] Bug#938157: Bug#938157: python-scipy: Python2 removal in sid/bullseye

2020-01-12 Thread Scott Kitterman
On Sunday, January 12, 2020 11:28:55 PM EST Drew Parsons wrote: > On 2020-01-13 09:52, Sandro Tosi wrote: > > we finally reach the point were src:python-scipy produces only leaf > > binary packages (excluding packages that are not in testing because RC > > already), so i think it's time to file

[Python-modules-team] Bug#948492: Processed: your mail

2020-01-09 Thread Scott Kitterman
Please wait for 5.3--1 to migrate to testing before uploading the change. This should really be a wishlist bug. There's no Debian policy violation here. Scott K On January 9, 2020 2:45:06 PM UTC, Debian Bug Tracking System wrote: >Processing commands for cont...@bugs.debian.org: > >> tags

[Python-modules-team] Bug#918893: Bug#918893: pyyaml: some build-time test failures are ignored

2020-01-07 Thread Scott Kitterman
> These failures are because we're using libyaml and it supports a newer yaml > version than the pure python implementation that the tests were made for. > > I've verified this by rebuilding pyyaml without libyaml. Then all the tests > pass. > > Before making the failures fatal, these tests

[Python-modules-team] Bug#946934: src:django-background-tasks: Should this package be removed

2019-12-17 Thread Scott Kitterman
Package: src:django-background-tasks Severity: important Upstream has vanished (github repo in the homepage field is 404) and this is blocking removal of django-compat. It's already removed from testing due to django-compat. If it's going to stay, someone would need to take on the changes

[Python-modules-team] Bug#937552: Bug#937552: re: pysvn: Python2 removal in sid/bullseye

2019-11-26 Thread Scott Kitterman
No need to defer this. Please reschedule it to delay 0. Scott K ___ Python-modules-team mailing list Python-modules-team@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/python-modules-team

[Python-modules-team] Bug#936745: re: ipywidgets: Python2 removal in sid/bullseye

2019-11-23 Thread Scott Kitterman
On Tue, 19 Nov 2019 06:59:36 + peter green wrote: > unblock 936745 by 936995 > severity 936745 serious > thanks > > matplotlib2 no longer has any dependencies or build-dependencies on packages built from the ipywidgets source. > > According to

[Python-modules-team] Bug#936745: Bug#936745: reducing matplotlib2 build-depends.

2019-11-12 Thread Scott Kitterman
On November 13, 2019 2:10:49 AM UTC, Sandro Tosi wrote: >On Tue, Nov 12, 2019 at 9:24 AM peter green >wrote: >> I am guessing that many of these are to get testsuite coverage for >optional features and are not strictly needed for the build, while >testing stuff is nice I don't think it's vital

[Python-modules-team] Bug#936180: backports.ssl-match-hostname: Python2 removal in sid/bullseye

2019-11-05 Thread Scott Kitterman
On Fri, 30 Aug 2019 07:11:11 + Matthias Klose wrote: > Package: src:backports.ssl-match-hostname > - If the package is dead upstream, cannot be converted or maintained > in Debian, it should be removed from the distribution. If the > package still has reverse dependencies, raise the

[Python-modules-team] Bug#942235: Bug#942235: dask: autopkgtest needs update for new version of pytest

2019-11-04 Thread Scott Kitterman
On November 4, 2019 10:00:27 PM UTC, Diane Trout wrote: >On Tue, 2019-10-29 at 09:15 +0800, Drew Parsons wrote: >> On 2019-10-29 03:01, Rebecca N. Palmer wrote: >> > Assuming we're talking about >> > >> >

Re: [Python-modules-team] prompt-toolkit_2.0.10-1_source.changes ACCEPTED into experimental

2019-11-01 Thread Scott Kitterman
ttps protocol >>* d/control: Remove ancient X-Python-Version field >>* d/control: Remove ancient X-Python3-Version field >> * Bump Standards-Version to 4.4.1. >> . >>[ Lennart Weller ] >>* New upstream release (Closes: #914698) >>* New debian Standard

[Python-modules-team] python-sphinx-issues_1.2.0-1_amd64.changes REJECTED

2019-10-27 Thread Scott Kitterman
Unfortunately I am going to have to reject your package. While we can accept some errors in debian/copyright, a missing license needs to be fixed before the package enters the archive. The following note from one of the FTP Team trainees explains: NOTICE mentions that some source comes from

[Python-modules-team] Bug#942161: src:impacket: Substantial issues with debian/copyright

2019-10-10 Thread Scott Kitterman
Package: src:impacket Version: 0.9.15-5 Severity: serious Justification: Policy 2.5 This is at least in part a problem in the existing package, so I am not going to reject the package for this, but it should definitely be fixed. The following significant issues need review/update in

[Python-modules-team] Bug#875190: Bug#875190: [shiboken] Future Qt4 removal from Buster

2019-09-30 Thread Scott Kitterman
On Monday, September 30, 2019 4:04:05 PM EDT Moritz Mühlenhoff wrote: > On Sat, Sep 09, 2017 at 11:09:45PM +0200, Lisandro Damián Nicanor Pérez Meyer wrote: > > Source: shiboken > > Version: 1.2.2-5 > > Severity: wishlist > > User: debian-qt-...@lists.debian.org > > Usertags: qt4-removal > > > >

Re: [Python-modules-team] pycxx_7.0.3-3_source.changes ACCEPTED into unstable

2019-09-16 Thread Scott Kitterman
gt;> >> >> Accepted: >> >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA256 >> >> Format: 1.8 >> Date: Sat, 31 Aug 2019 11:35:45 -0400 >> Source: pycxx >> Architecture: source >> Version: 7.0.3-3 >> Distribution: unstable >&g

[Python-modules-team] pyutilib_5.7.0-1_amd64.changes REJECTED

2019-09-15 Thread Scott Kitterman
Same rationale as other version. Scott K === Please feel free to respond to this email if you don't understand why your files were rejected, or if you upload new files which address our concerns. ___ Python-modules-team mailing list

[Python-modules-team] pyutilib_5.7.1-1_amd64.changes REJECTED

2019-09-15 Thread Scott Kitterman
Unfortunately I am going to have to reject your package due to debian/ copyright issues. The immeidately fatal issue is missing license information for pyutilib/component/loader/plugin_eggLoader.py. It contains the statement: # Copyright (C) 2005-2008 Edgewall Software # Copyright (C)

[Python-modules-team] Comments regarding python-pybadges_2.0.2-1_amd64.changes

2019-09-15 Thread Scott Kitterman
I am going to accept your package, but please note: The `License: Apache-2` stanza is said to apply to debian/, but the content of that stanza includes the line "Copyright 2019 The pybadge Authors". The copyright years for Pybadge authors should include 2019 (see twine_upload.sh). Scott K

[Python-modules-team] Bug#937797: Bug#937797: python-gnutls: Python2 removal in sid/bullseye

2019-09-03 Thread Scott Kitterman
On Tuesday, September 3, 2019 6:43:24 AM EDT Andrey Rahmatullin wrote: > This can be RMed but has popcon 491. Since it's a module, not an app (so no one should be installing it just because), I think it can still go. Scott K ___ Python-modules-team

Re: [Python-modules-team] python-mechanize_0.4.3-1_amd64.changes REJECTED

2019-09-02 Thread Scott Kitterman
Thanks. That'll do. On a side note, your 'python-all-dev, python3-all-dev' build-depends should be changed to 'python-all, python3-all' since there's no arch:any content in the package. No point in pulling in more build-depends than needed and during transitions, the -dev build-dep is a key

Re: [Python-modules-team] python-mechanize_0.4.3-1_amd64.changes REJECTED

2019-09-02 Thread Scott Kitterman
think there was anything GPL before). Scott K On September 2, 2019 9:45:11 AM UTC, Norbert Preining wrote: >Hi Scott, > >once again. > >On Mon, 02 Sep 2019, Scott Kitterman wrote: >> I'm only rejecting because of the first: >> >> mechanize/polyglot.py:# Lice

  1   2   >