Path: csiph.com!aioe.org!bofh.it!news.nic.it!robomod From: Scott Kitterman Newsgroups: linux.debian.maint.python Subject: Re: pyyaml 6 Date: Wed, 02 Nov 2022 10:30:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Wed Nov 2 09:26:58 2022 Old-Return-Path: X-Amavis-Spam-Status: No, score=-7.18 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FVGT_m_MULTI_ODD=0.02, LDO_WHITELIST=-5] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -5.5 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Mailing-List: archive/latest/20448 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/171F609C-C52A-44AF-90A5-EEB028F31860@kitterman.com Approved: robomod@news.nic.it Lines: 114 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Wed, 02 Nov 2022 09:26:35 +0000 X-Original-Message-ID: <171F609C-C52A-44AF-90A5-EEB028F31860@kitterman.com> X-Original-References: <20221006231301.hmps267mjdxp4slc@mail.gaussglocke.de> <444b9757-3d10-4753-de05-eb20a0c84a79@chronitis.net> Xref: csiph.com linux.debian.maint.python:14596 On November 2, 2022 8:35:35 AM UTC, Gordon Ball w= rote: >On 19/10/2022 22:30, Gordon Ball wrote: >> On 09/10/2022 21:39, Gordon Ball wrote: >>> On 07/10/2022 01:13, Timo R=C3=B6hling wrote: >>>> Hi Gordon, >>>>=20 >>>> * Gordon Ball [2022-10-07 00:10]: >>>>> * Upload to unstable and see what breaks? >>>>> * Request an archive rebuild with this version and see what breaks? >>>>> * File bugs against all likely affected packages with a fixed date f= or >>>>> an upload? >>>>> * Wait until after the freeze? >>>> Considering that PyYAML has been issuing a YAMLLoadWarning since >>>> version 5=2E1 (i=2Ee=2E September 2019), I would expect that many (mo= st?) >>>> reverse dependencies have been fixed, and anything that still breaks >>>> is probably in dire need of maintenance anyway=2E >>>=20 >>> Yes, that's a good point=2E >>>=20 >>> I've done some more investigation of reverse-depends and looking for >>> likely bad patterns with codesearch=2Ed=2En, and the set of packages w= hich >>> A) appear to contain plain `yaml=2Eload(f)` or equivalent, where `yaml= ` is >>> pyyaml and B) actually depend or build-depend on `python3-yaml` is >>> smaller than I feared=2E This is what I came up with: >>>=20 >>> ``` >>> ansible # confirm - in ansible_collections/community/general/plugins >>> buildbot # confirm - in porttostable >>> ceph # confirm, in civetweb/third_party/duktape, src/test/crimson >>> docker-compose # confirm, in tests >>> dose3 # confirm, in scripts >>> elasticsearch-curator # confirm, in test/unit >>> etm # confirm, in etmTk/data >>> ganeti # confirm, in qa, test/py >>> gnocchi # confirm, in gnocchi/gendoc >>> gr-dab # confirm, in python/app >>> jeepyb # confirm, in cmd/notify_impact >>> knitpy # confirm, in knitpy >>> labgrid # confirm, in remote/coordinator >>> lecm # confirm, in lecm/configuration >>> lirc # confirm, in lirc/database >>> lqa # confirm, in lqa_api/job >>> open-adventure # confirm, in tests >>> owslib # confirm, in ogcapi >>> policyd-rate-limit # confirm, in config, tests >>> python-aptly # confirm, in publisher >>> python-canmatrix # confirm, in canmatrix/formats/yaml >>> python-multipart # confirm, in multipart/tests >>> python-pybedtools # confirm, in test, contrib >>> python-seqcluster # confirm, in install >>> python-tempestconf # confirm, in config_tempest/profile >>> qcat # confirm, in adapters >>> qcengine # confirm, in config >>> refstack-client # confirm, in refstack_client >>> relatorio # confirm, in templates/chart >>> ripe-atlas-tools # confirm, in tools/settings >>> ros-genpy # confirm, in test >>> ros-rosinstall # confirm, in test, src/rosinstall >>> ros-rosinstall-generator # confirm, in test, src/rosinstall_generator >>> spades # confirm, in assembler/src/test/teamcity, >>> assembler/src/projects/mts, assembler/src/spades_pipeline >>> xrstools # confirm, in WIZARD >>> zlmdb # confirm, in _database >>> ``` >>>=20 >>> I don't know if all these codepaths are actually ever reached, or test= s >>> ever run, so the packages won't necessarily break (or the breakage is >>> very minor, such as a single community plugin in ansible)=2E I don't >>> guarantee there are no omissions from the list though=2E >>>=20 >>> There is a significantly longer list of packages which appear to conta= in >>> a use of yaml=2Eload _somewhere_, but it is usually in some >>> maintainer/release script, or an optional path somewhere, and the >>> package itself doesn't [build-]depend on python3-yaml=2E >>>=20 >>=20 >> I've filed bugs for (most) of the packages listed above (some were drop= ped on review because they weren't in main, or the affected file appeared t= o be unused at build time and not installed)=2E I've had a couple of acknow= ledgements/fixes already=2E >>=20 >> A number of affected package look very sparsely used and/or maintained,= and I doubt are likely to be fixed=2E However, of the packages above, only= two have autopkgtests which fail on experimental migration, so I wouldn't = be surprised if some are not already broken by other past changes=2E >>=20 >> I propose to wait ~2 weeks until the beginning of November and upload p= yyaml 6 to unstable then=2E >>=20 > >pyyaml 6 has now landed in unstable=2E About half the bugs I filed have b= een resolved, and there is only one package (ganeti) with autopkgtests bloc= king migration=2E > There were two more, but I retried the migration reference jobs and they f= ailed (which makes them no longer block since they are no longer a regressi= on)=2E =20 Ganeti can't currently be fixed since it's unbuildable=2E It's only due t= o an archive hiccup that it's even in Testing=2E I was planning on asking = the Release Team to ignore it, so pyyaml can transition (worst case it's st= uck until ganeti gets removed from Testing in a week and a half)=2E Scott K