Path: csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Pierre-Elliott =?UTF-8?Q?B=C3=A9cue?= Newsgroups: linux.debian.bugs.dist,linux.debian.maint.python Subject: Bug#1003567: Please make a separate package for mistune 2.x Date: Sat, 05 Feb 2022 23:00:09 +0100 Message-ID: References: X-Original-To: Nilesh Patra X-Mailbox-Line: From debian-bugs-dist-request@lists.debian.org Sat Feb 5 21:51:08 2022 Old-Return-Path: X-Spam-Flag: NO X-Spam-Score: -6.9 Reply-To: Pierre-Elliott =?UTF-8?Q?B=C3=A9cue?= , 1003567@bugs.debian.org Resent-To: debian-bugs-dist@lists.debian.org Resent-Cc: Debian Python Team X-Debian-Pr-Message: followup 1003567 X-Debian-Pr-Package: python3-schema-salad X-Debian-Pr-Source: python-schema-salad User-Agent: mu4e 1.6.10; emacs 27.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Debian-Message: from BTS X-Mailing-List: archive/latest/1703703 List-ID: List-URL: Approved: robomod@news.nic.it Lines: 76 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: Julian Gilbey , "Michael R. Crusoe" , 1003567@bugs.debian.org, debian-python@lists.debian.org X-Original-Date: Sat, 05 Feb 2022 22:45:24 +0100 X-Original-Message-ID: <87sfsxc7ga.fsf@jaatynyt> X-Original-References: <20220111213844.BE33D2C006E@pimeys.fr> <878rurbmr3.fsf@jaatynyt> <20220111213844.BE33D2C006E@pimeys.fr> Xref: csiph.com linux.debian.bugs.dist:1092185 linux.debian.maint.python:13926 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Nilesh Patra wrote on 05/02/2022 at 20:23:44+0100: > [[PGP Signed Part:No public key for 00BAE74B343369F1 created at 2022-02-0= 5T20:23:44+0100 using RSA]] > On 2/6/22 12:20 AM, Julian Gilbey wrote: >> On Fri, Feb 04, 2022 at 09:27:59PM +0530, Nilesh Patra wrote: >>> On 2/4/22 9:18 PM, Julian Gilbey wrote: >>>> [...] >>>> _mistune.py within the Debian package, >>>> and have nbconvert do "import nbconvert.filters._mistune as mistune" >>>> (see /usr/lib/python3/dist-packages/nbconvert/filters/markdown_mistune= .py). >>>> That seems like an eminently sensible solution to this problem. >>> >>> But that'd lead to a number of mistune's embedded copies in a huge numb= er of packages; since majority of >>> the rev-deps (when I last checked) haven't adapted to this new version.= When they do, >>> and it becomes a overhead to fix each one later. >>> Even worse, if we discover a security problem sometime later, then all = such packages would be >>> effected, and that honestly does not look like a good idea to me. >> I have just had another idea, which might solve all of the problems: >> create a new Debian package called mistune0 (or mistune1), which >> contains the legacy version of mistune, but with the Python module >> called "mistune0" instead of "mistune". Then it will be >> co-installable with mistune 2.x, and the packages which still depend >> on mistune 0.8.4 could be patched to say "import mistune0 as mistune" >> until they are updated upstream. This will also avoid having multiple >> copies of the legacy code in the archive, which addresses the security >> issue, and allow those packages which have migrated to mistune 2.x to >> still say "import mistune". > > Ah, looks like we just had to think in the reverse direction from the ini= tial proposal (mistune-{0,1} instead of mistune-{1,2}). > Indeed, that sounds like a much better plan. > I hope PEB agrees with this as well, would like to hear from them :) > > Thanks for the discussion, Julian :) > > Regards, > Nilesh I'd like other python team member's opinion on this, and I'm not eager to maintain that legacy package, as I tend to not want to maintain obsolete software. Still, I can do the initial work of creating it. =2D-=20 PEB --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQJDBAEBCgAtFiEESYqTBWsFJgT6y8ijKb+g0HkpCsoFAmH+8EUPHHBlYkBkZWJp YW4ub3JnAAoJECm/oNB5KQrKMp0P/1rMoxSYmWsSVy4zkfPXHwJWCrpaPqgXfuUn XGnC+q7BPWRx8Homy5uq2wrm+hxK/Kyv9qkAnYjWXkQ41YaYQDAhdLsHs1YK3HjQ UwEDgJ0eV4DBjBYWt4KGlp/fbKjMFSvOp8uKa+gXGzP4zMqdVobQUtk9v6inwPHf DHz1/kMSzt87DnqGZUTz0m4nfFz9Yt8l/EZh+yMMQ+2BxU5ebQ7/+15Znw8fOjrQ 1iIrZ8/O4b63cHmakkzfT87o31a5Wru+wYqNR2aX4XUDfCiUIdpKv99aqDH0AbGT wpbm1LSWbcQ/n+Y8nK/DqqMT4dJTpq7YYNG1PV1GBeo0IgELHt1BeREoahy+wstV q9k0xkPtf8vsqw8t/C6+jDvnaspo8qcORccqv6NqwJZloPf1eTFMdmdmJydvJsQy b7QfONq5GPSTxa4qEpNP43abhHtnfyxeaQ9izTPG/+74/3Xww2KGrhHG23LhE+Lg 57xr70b5mGoMEEx+F7XIAeDlYBQLCp1Ywdw2eD8KeeuqobwZq9I6wccIiH5W2YNj v5cwCKUk9i6+7Sh9HXklzGMwHA1Oij+urU0gwPWMk+Di6U6A6yEkNoLOTVbKJUud zbYDggakk0dBOrGDY5XJ2/wnOYJNKDofrf2EVcASs9VSmV87F5ocXpt/Jsx2vvmi Ilg6a/hK =NTe4 -----END PGP SIGNATURE----- --=-=-=--