Groups > linux.debian.maint.python > #14522

pyyaml 6

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Gordon Ball <gordon@chronitis.net>
Newsgroups	linux.debian.maint.python
Subject	pyyaml 6
Date	Fri, 07 Oct 2022 00:30:01 +0200
Message-ID	<FdHxn-cwMm-1@gated-at.bofh.it> (permalink)
X-Mailbox-Line	From debian-python-request@lists.debian.org Thu Oct 6 22:22:06 2022
Old-Return-Path	<gordon@chronitis.net>
X-Amavis-Spam-Status	No, score=-9.48 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FVGT_m_MULTI_ODD=0.02, LDO_WHITELIST=-5, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no
X-Policyd-Weight	using cached result; rate: -4.6
X-Greylist	delayed 665 seconds by postgrey-1.36 at bendel; Thu, 06 Oct 2022 22:21:35 UTC
MIME-Version	1.0
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.11.0
Content-Language	en-US
Content-Type	text/plain; charset=UTF-8
Content-Transfer-Encoding	7bit
X-Mailing-List	<debian-python@lists.debian.org> archive/latest/20371
List-ID	<debian-python.lists.debian.org>
List-URL	<https://lists.debian.org/debian-python/>
List-Archive	https://lists.debian.org/msgid-search/ea4e5630-2f43-55a3-7126-296cc554ebad@chronitis.net
Approved	robomod@news.nic.it
Lines	40
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Fri, 7 Oct 2022 00:10:21 +0200
X-Original-Message-ID	<ea4e5630-2f43-55a3-7126-296cc554ebad@chronitis.net>
Xref	csiph.com linux.debian.maint.python:14522

Show key headers only | View raw

pyyaml (aka python3-yaml) is an rdepend for >300 packages. We currently
have 5.4.1, but version 6 was released late last year, which does quite
a lot of cleanup (eg, dropping python 2 support) and disables unsafe
loading (arbitrary python code execution) unless explicitly opted into.

Unfortunately this is a breaking change for any code which uses the
simple `yaml.load(fileobj)` idiom - it now needs to be
`yaml.safe_load(fileobj)` or `yaml.load(fileobj, Loader=yaml.SafeLoader)`.

I uploaded 6.0 to experimental late last year, but time constraints
meant it never got pushed forward. I've recently refreshed the version
in experimental (experimental doesn't get binnmus so it was still only
built for 3.9), and there are relatively few autopkgtest regressions:
https://qa.debian.org/excuses.php?experimental=1&package=pyyaml

However, using codesearch suggests there are quite a few places which
are likely to break:
http://codesearch.debian.net/search?q=yaml%5B.%5Dload%5B%28%5D%5B%5E%2C%5D%2B%5B%29%5D+filetype%3Apython&literal=0&perpkg=1

Some of these are false positives, such as invocations of ruamel.yaml,
that string appearing in documentation, or things regex can't catch -
but that still looks like it leaves a significant number of packages
being potentially broken - and presumably lacking autopkgtest coverage).


So, I'd seek some input on how to move forward.

* Upload to unstable and see what breaks?
* Request an archive rebuild with this version and see what breaks?
* File bugs against all likely affected packages with a fixed date for
an upload?
* Wait until after the freeze?

The only bug requesting it actually be upgraded is
https://bugs.debian.org/1008262 (for openstack). I don't know if that
has proved a hard blocker - I _think_ anything designed to work with 6.x
should also work with 5.4.


Gordon

Back to linux.debian.maint.python | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

pyyaml 6 Gordon Ball <gordon@chronitis.net> - 2022-10-07 00:30 +0200
  Re: pyyaml 6 Timo Röhling <roehling@debian.org> - 2022-10-07 01:20 +0200
    Re: pyyaml 6 Gordon Ball <gordon@chronitis.net> - 2022-10-09 21:50 +0200
      Re: pyyaml 6 Jeremy Stanley <fungi@yuggoth.org> - 2022-10-09 22:00 +0200
      Re: pyyaml 6 Gordon Ball <gordon@chronitis.net> - 2022-10-19 22:40 +0200
        Re: pyyaml 6 Gordon Ball <gordon@chronitis.net> - 2022-11-02 09:50 +0100
          Re: pyyaml 6 Scott Kitterman <debian@kitterman.com> - 2022-11-02 10:30 +0100
            Re: pyyaml 6 Scott Kitterman <debian@kitterman.com> - 2022-11-13 03:30 +0100
  Re: pyyaml 6 Paul Wise <pabs@debian.org> - 2022-10-07 03:50 +0200
    Re: pyyaml 6 Louis-Philippe Véronneau <pollo@debian.org> - 2022-10-10 17:50 +0200
  Re: pyyaml 6 Jeremy Stanley <fungi@yuggoth.org> - 2022-10-07 16:50 +0200

csiph-web