Path: csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Nilesh Patra Newsgroups: linux.debian.bugs.dist,linux.debian.maint.python Subject: Bug#1003567: Please make a separate package for mistune 2.x Date: Sat, 05 Feb 2022 20:30:05 +0100 Message-ID: References: X-Mailbox-Line: From debian-bugs-dist-request@lists.debian.org Sat Feb 5 19:27:10 2022 Old-Return-Path: X-Spam-Flag: NO X-Spam-Score: -5.651 Reply-To: Nilesh Patra , 1003567@bugs.debian.org Resent-To: debian-bugs-dist@lists.debian.org Resent-Cc: Debian Python Team X-Debian-Pr-Message: followup 1003567 X-Debian-Pr-Package: python3-schema-salad X-Debian-Pr-Source: python-schema-salad MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="OMFliJOGY414iyisAwefzScolchIeyEZY" X-Debian-Message: from BTS X-Mailing-List: archive/latest/1703675 List-ID: List-URL: Approved: robomod@news.nic.it Lines: 88 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: Pierre-Elliott =?UTF-8?Q?B=C3=A9cue?= , "Michael R. Crusoe" , 1003567@bugs.debian.org, debian-python@lists.debian.org X-Original-Date: Sun, 6 Feb 2022 00:53:44 +0530 X-Original-Message-ID: X-Original-References: <20220111213844.BE33D2C006E@pimeys.fr> <878rurbmr3.fsf@jaatynyt> <20220111213844.BE33D2C006E@pimeys.fr> Xref: csiph.com linux.debian.bugs.dist:1092161 linux.debian.maint.python:13924 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --OMFliJOGY414iyisAwefzScolchIeyEZY Content-Type: multipart/mixed; boundary="VyMgqIjViPlCTX3gTzbylSqS33EG8ITlj"; protected-headers="v1" From: Nilesh Patra To: Julian Gilbey Cc: =?UTF-8?Q?Pierre-Elliott_B=c3=a9cue?= , "Michael R. Crusoe" , 1003567@bugs.debian.org, debian-python@lists.debian.org Message-ID: Subject: Re: Please make a separate package for mistune 2.x References: <20220111213844.BE33D2C006E@pimeys.fr> <878rurbmr3.fsf@jaatynyt> In-Reply-To: --VyMgqIjViPlCTX3gTzbylSqS33EG8ITlj Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 2/6/22 12:20 AM, Julian Gilbey wrote: > On Fri, Feb 04, 2022 at 09:27:59PM +0530, Nilesh Patra wrote: >> On 2/4/22 9:18 PM, Julian Gilbey wrote: >>> [...] >>> _mistune.py within the Debian package, >>> and have nbconvert do "import nbconvert.filters._mistune as mistune" >>> (see /usr/lib/python3/dist-packages/nbconvert/filters/markdown_mistun= e.py). >>> That seems like an eminently sensible solution to this problem. >> >> But that'd lead to a number of mistune's embedded copies in a huge num= ber of packages; since majority of >> the rev-deps (when I last checked) haven't adapted to this new version= =2E When they do, >> and it becomes a overhead to fix each one later. >> Even worse, if we discover a security problem sometime later, then all= such packages would be >> effected, and that honestly does not look like a good idea to me. >=20 > I have just had another idea, which might solve all of the problems: > create a new Debian package called mistune0 (or mistune1), which > contains the legacy version of mistune, but with the Python module > called "mistune0" instead of "mistune". Then it will be > co-installable with mistune 2.x, and the packages which still depend > on mistune 0.8.4 could be patched to say "import mistune0 as mistune" > until they are updated upstream. This will also avoid having multiple > copies of the legacy code in the archive, which addresses the security > issue, and allow those packages which have migrated to mistune 2.x to > still say "import mistune". Ah, looks like we just had to think in the reverse direction from the ini= tial proposal (mistune-{0,1} instead of mistune-{1,2}). Indeed, that sounds like a much better plan. I hope PEB agrees with this as well, would like to hear from them :) Thanks for the discussion, Julian :) Regards, Nilesh --VyMgqIjViPlCTX3gTzbylSqS33EG8ITlj-- --OMFliJOGY414iyisAwefzScolchIeyEZY Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsF4BAABCAAjFiEEPpmlJvXcwMu/HO6mALrnSzQzafEFAmH+zsAFAwAAAAAACgkQALrnSzQzafEq aQ/4gNUekF604B9GNbJZqju3uaj8qKTMY2xFu6oJWunJpPwFHRc0tMKkIczDBMBmoFbHbdQkKQL7 4AnF5eBePrNu5t878MGrzjzaATN80zyxfEEZr3z65btBIcjkfEopDLDFqgvizBiNSY3BNph99zlm +Kdj15hPEc4MGFDYxFGme6LntiyDCuVnIdsc+XqKT+Sugg6zdlHy5MLOzzjw1PS0tF6P28zup0yJ Qkz9wY096RePRsBWMMakIPQ44ke/bAAtMIxg8PwJgSSd/ZGnIb6HGZhuS7uLH6VLinJdqyx+Tx13 OfwD4AhFHZ9yhGxL8Mwz1hax5moWQrOTnnnu0O5tMJRHctzvW2flYw6w8KHEnnoXqf1cu5KJExn1 WNyp0BsR9U0Qkv/wUIyVFelgRRD7pHoRyWxr7xQjvYKVyIx9jMQrJl2HDXL5nb45Ur1CvwH8bCCM pByQGryEbOmk6hTaMoSTB9wLZYVmZAK6E7h90TITXHQC3vuehZOru9sujdPNPvH0NtHnyLJkF7J/ x87NmGyVlCwC/cicVGWwimnklY3bYk4Sh1eopSmhK8odQHnEaLuJpJa6uAJwkc2wFXVT1BJBVLgY /D7TEArxfhOLO81GWbZACa1YywCjPqYJFat3OsKcaVzuZKGJTVMig613SSHHJ6FYZBsUPF88T93+ aQ== =q2zf -----END PGP SIGNATURE----- --OMFliJOGY414iyisAwefzScolchIeyEZY--