Public bug reported: On Ubuntu 24.04 and following the security patch made to pyjwt, python3-jwt is now missing the RECORD file. This is required for proper functionality of pip, in particular in situations such as containerised workloads where --break-system-packages is more common. There is a workaround by simply deleting /usr/lib/python3/dist- packages/PyJWT-2.7.0.dist-info and reinstalling the package via pip, but this is clearly far from ideal.
I verified the issue exists on (at least) arm64 and amd64. There is no obvious difference between the unpatched and patched packages, either in source or control files, beyond that necessary for the patch. Therefore, this looks like a build system issue. The build logs at https://launchpadlibrarian.net/853574300/buildlog_ubuntu-noble- amd64.pyjwt_2.7.0-1ubuntu0.1_BUILDING.txt.gz show the RECORD file being created but it is not present in the final file listing. Demonstration of the problem from a clean install: # apt install -y python3-jwt=2.7.0-1 ... # ls -al /usr/lib/python3/dist-packages/PyJWT-2.7.0.dist-info total 36 drwxr-xr-x 2 root root 4096 Apr 7 14:46 . drwxr-xr-x 9 root root 4096 Apr 7 14:46 .. -rw-r--r-- 1 root root 322 Jun 15 2023 AUTHORS.rst -rw-r--r-- 1 root root 7 Jun 15 2023 INSTALLER -rw-r--r-- 1 root root 4160 Jun 15 2023 METADATA -rw-r--r-- 1 root root 1305 Jun 15 2023 RECORD -rw-r--r-- 1 root root 92 Jun 15 2023 WHEEL -rw-r--r-- 1 root root 4 Jun 15 2023 top_level.txt # apt install -y python3-jwt=2.7.0-1ubuntu0.1 ... # ls -al /usr/lib/python3/dist-packages/PyJWT-2.7.0.dist-info total 36 drwxr-xr-x 1 root root 4096 Apr 7 14:46 . drwxr-xr-x 1 root root 4096 Apr 7 14:46 .. -rw-r--r-- 1 root root 7 Mar 26 13:14 INSTALLER -rw-r--r-- 1 root root 4144 Mar 26 13:14 METADATA -rw-r--r-- 1 root root 92 Mar 26 13:14 WHEEL -rw-r--r-- 1 root root 4 Mar 26 13:14 top_level.txt # pip install --break-system-packages PyJWT==2.12.0 Collecting PyJWT==2.12.0 Downloading pyjwt-2.12.0-py3-none-any.whl.metadata (4.0 kB) Downloading pyjwt-2.12.0-py3-none-any.whl (29 kB) Installing collected packages: PyJWT Attempting uninstall: PyJWT Found existing installation: PyJWT 2.7.0 ERROR: Cannot uninstall PyJWT 2.7.0, RECORD file not found. Hint: The package was installed by debian. ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: python3-jwt 2.7.0-1ubuntu0.1 Uname: Linux 6.12.54-linuxkit aarch64 ApportVersion: 2.28.1-0ubuntu3.8 Architecture: arm64 CasperMD5CheckResult: unknown CloudBuildName: ubuntu-oci:minimized CloudSerial: 20260324 Date: Tue Apr 7 14:03:27 2026 PackageArchitecture: all ProcEnviron: LANG=C.UTF-8 PATH=(custom, no user) TERM=xterm SourcePackage: pyjwt UpgradeStatus: No upgrade log present (probably fresh install) ** Affects: pyjwt (Ubuntu) Importance: Undecided Status: New ** Tags: apport-bug noble -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2147459 Title: python3-jwt missing RECORD file post-security-patch To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pyjwt/+bug/2147459/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
