Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #13924

Bug#1003567: Please make a separate package for mistune 2.x

Cross-posted to 2 groups.

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

On 2/6/22 12:20 AM, Julian Gilbey wrote:
> On Fri, Feb 04, 2022 at 09:27:59PM +0530, Nilesh Patra wrote:
>> On 2/4/22 9:18 PM, Julian Gilbey wrote:
>>> [...]
>>> _mistune.py within the Debian package,
>>> and have nbconvert do "import nbconvert.filters._mistune as mistune"
>>> (see /usr/lib/python3/dist-packages/nbconvert/filters/markdown_mistune.py).
>>> That seems like an eminently sensible solution to this problem.
>>
>> But that'd lead to a number of mistune's embedded copies in a huge number of packages; since majority of
>> the rev-deps (when I last checked) haven't adapted to this new version. When they do,
>> and it becomes a overhead to fix each one later.
>> Even worse, if we discover a security problem sometime later, then all such packages would be
>> effected, and that honestly does not look like a good idea to me.
> 
> I have just had another idea, which might solve all of the problems:
> create a new Debian package called mistune0 (or mistune1), which
> contains the legacy version of mistune, but with the Python module
> called "mistune0" instead of "mistune".  Then it will be
> co-installable with mistune 2.x, and the packages which still depend
> on mistune 0.8.4 could be patched to say "import mistune0 as mistune"
> until they are updated upstream.  This will also avoid having multiple
> copies of the legacy code in the archive, which addresses the security
> issue, and allow those packages which have migrated to mistune 2.x to
> still say "import mistune".

Ah, looks like we just had to think in the reverse direction from the initial proposal (mistune-{0,1} instead of mistune-{1,2}).
Indeed, that sounds like a much better plan.
I hope PEB agrees with this as well, would like to hear from them :)

Thanks for the discussion, Julian :)

Regards,
Nilesh

Back to linux.debian.maint.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1003567: Please make a separate package for mistune 2.x Pierre-Elliott Bécue <peb@debian.org> - 2022-02-03 23:40 +0100
  Bug#1003567: Please make a separate package for mistune 2.x Julian Gilbey <julian@d-and-j.net> - 2022-02-04 17:10 +0100
    Bug#1003567: Please make a separate package for mistune 2.x Nilesh Patra <nilesh@tchncs.de> - 2022-02-04 17:30 +0100
      Bug#1003567: Please make a separate package for mistune 2.x Jerome Charaoui <jerome@riseup.net> - 2022-02-04 18:40 +0100
  Bug#1003567: Please make a separate package for mistune 2.x Julian Gilbey <julian@d-and-j.net> - 2022-02-04 17:10 +0100
    Bug#1003567: Please make a separate package for mistune 2.x Nilesh Patra <nilesh@tchncs.de> - 2022-02-04 17:10 +0100
      Bug#1003567: Please make a separate package for mistune 2.x Pierre-Elliott Bécue <peb@debian.org> - 2022-02-04 17:40 +0100
      Bug#1003567: Please make a separate package for mistune 2.x Julian Gilbey <julian@d-and-j.net> - 2022-02-05 20:00 +0100
        Bug#1003567: Please make a separate package for mistune 2.x Nilesh Patra <nilesh@tchncs.de> - 2022-02-05 20:30 +0100
          Bug#1003567: Please make a separate package for mistune 2.x Pierre-Elliott Bécue <peb@debian.org> - 2022-02-05 23:00 +0100
            Bug#1003567: Please make a separate package for mistune 2.x Sandro Tosi <morph@debian.org> - 2022-02-05 23:00 +0100

csiph-web