Path: csiph.com!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod From: Scott Kitterman Newsgroups: linux.debian.maint.python Subject: Re: pyyaml 6 Date: Sun, 13 Nov 2022 03:30:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Sun Nov 13 02:29:53 2022 Old-Return-Path: X-Amavis-Spam-Status: No, score=-12.18 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FVGT_m_MULTI_ODD=0.02, LDO_WHITELIST=-5, PGPSIGNATURE=-5] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -5.5 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart5314975.pHMvOt90FF"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Mailing-List: archive/latest/20473 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/4937715.daNZhnzhiL@localhost Approved: robomod@news.nic.it Lines: 149 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Sat, 12 Nov 2022 21:29:24 -0500 X-Original-Message-ID: <4937715.daNZhnzhiL@localhost> X-Original-References: <444b9757-3d10-4753-de05-eb20a0c84a79@chronitis.net> <171F609C-C52A-44AF-90A5-EEB028F31860@kitterman.com> Xref: csiph.com linux.debian.maint.python:14619 --nextPart5314975.pHMvOt90FF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="iso-8859-1"; protected-headers="v1" From: Scott Kitterman To: debian-python@lists.debian.org Subject: Re: pyyaml 6 Date: Sat, 12 Nov 2022 21:29:24 -0500 Message-ID: <4937715.daNZhnzhiL@localhost> In-Reply-To: <171F609C-C52A-44AF-90A5-EEB028F31860@kitterman.com> References: <444b9757-3d10-4753-de05-eb20a0c84a79@chronitis.net> <171F609C-C52A-44AF-90A5-EEB028F31860@kitterman.com> On Wednesday, November 2, 2022 5:26:35 AM EST Scott Kitterman wrote: > On November 2, 2022 8:35:35 AM UTC, Gordon Ball =20 wrote: > >On 19/10/2022 22:30, Gordon Ball wrote: > >> On 09/10/2022 21:39, Gordon Ball wrote: > >>> On 07/10/2022 01:13, Timo R=F6hling wrote: > >>>> Hi Gordon, > >>>>=20 > >>>> * Gordon Ball [2022-10-07 00:10]: > >>>>> * Upload to unstable and see what breaks? > >>>>> * Request an archive rebuild with this version and see what breaks? > >>>>> * File bugs against all likely affected packages with a fixed date = for > >>>>> an upload? > >>>>> * Wait until after the freeze? > >>>>=20 > >>>> Considering that PyYAML has been issuing a YAMLLoadWarning since > >>>> version 5.1 (i.e. September 2019), I would expect that many (most?) > >>>> reverse dependencies have been fixed, and anything that still breaks > >>>> is probably in dire need of maintenance anyway. > >>>=20 > >>> Yes, that's a good point. > >>>=20 > >>> I've done some more investigation of reverse-depends and looking for > >>> likely bad patterns with codesearch.d.n, and the set of packages which > >>> A) appear to contain plain `yaml.load(f)` or equivalent, where `yaml`= is > >>> pyyaml and B) actually depend or build-depend on `python3-yaml` is > >>> smaller than I feared. This is what I came up with: > >>>=20 > >>> ``` > >>> ansible # confirm - in ansible_collections/community/general/plugins > >>> buildbot # confirm - in porttostable > >>> ceph # confirm, in civetweb/third_party/duktape, src/test/crimson > >>> docker-compose # confirm, in tests > >>> dose3 # confirm, in scripts > >>> elasticsearch-curator # confirm, in test/unit > >>> etm # confirm, in etmTk/data > >>> ganeti # confirm, in qa, test/py > >>> gnocchi # confirm, in gnocchi/gendoc > >>> gr-dab # confirm, in python/app > >>> jeepyb # confirm, in cmd/notify_impact > >>> knitpy # confirm, in knitpy > >>> labgrid # confirm, in remote/coordinator > >>> lecm # confirm, in lecm/configuration > >>> lirc # confirm, in lirc/database > >>> lqa # confirm, in lqa_api/job > >>> open-adventure # confirm, in tests > >>> owslib # confirm, in ogcapi > >>> policyd-rate-limit # confirm, in config, tests > >>> python-aptly # confirm, in publisher > >>> python-canmatrix # confirm, in canmatrix/formats/yaml > >>> python-multipart # confirm, in multipart/tests > >>> python-pybedtools # confirm, in test, contrib > >>> python-seqcluster # confirm, in install > >>> python-tempestconf # confirm, in config_tempest/profile > >>> qcat # confirm, in adapters > >>> qcengine # confirm, in config > >>> refstack-client # confirm, in refstack_client > >>> relatorio # confirm, in templates/chart > >>> ripe-atlas-tools # confirm, in tools/settings > >>> ros-genpy # confirm, in test > >>> ros-rosinstall # confirm, in test, src/rosinstall > >>> ros-rosinstall-generator # confirm, in test, src/rosinstall_generator > >>> spades # confirm, in assembler/src/test/teamcity, > >>> assembler/src/projects/mts, assembler/src/spades_pipeline > >>> xrstools # confirm, in WIZARD > >>> zlmdb # confirm, in _database > >>> ``` > >>>=20 > >>> I don't know if all these codepaths are actually ever reached, or tes= ts > >>> ever run, so the packages won't necessarily break (or the breakage is > >>> very minor, such as a single community plugin in ansible). I don't > >>> guarantee there are no omissions from the list though. > >>>=20 > >>> There is a significantly longer list of packages which appear to cont= ain > >>> a use of yaml.load _somewhere_, but it is usually in some > >>> maintainer/release script, or an optional path somewhere, and the > >>> package itself doesn't [build-]depend on python3-yaml. > >>=20 > >> I've filed bugs for (most) of the packages listed above (some were > >> dropped on review because they weren't in main, or the affected file > >> appeared to be unused at build time and not installed). I've had a > >> couple of acknowledgements/fixes already. > >>=20 > >> A number of affected package look very sparsely used and/or maintained, > >> and I doubt are likely to be fixed. However, of the packages above, on= ly > >> two have autopkgtests which fail on experimental migration, so I > >> wouldn't be surprised if some are not already broken by other past > >> changes. > >>=20 > >> I propose to wait ~2 weeks until the beginning of November and upload > >> pyyaml 6 to unstable then.> > >pyyaml 6 has now landed in unstable. About half the bugs I filed have be= en > >resolved, and there is only one package (ganeti) with autopkgtests > >blocking migration. > There were two more, but I retried the migration reference jobs and they > failed (which makes them no longer block since they are no longer a > regression). >=20 > Ganeti can't currently be fixed since it's unbuildable. It's only due to= an > archive hiccup that it's even in Testing. I was planning on asking the > Release Team to ignore it, so pyyaml can transition (worst case it's stuck > until ganeti gets removed from Testing in a week and a half). Ganeti's removal got delays, but the Release Team hinted pyyaml to transiti= on,=20 so it should go to Testing now. Scott K --nextPart5314975.pHMvOt90FF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE53Kb/76FQA/u7iOxeNfe+5rVmvEFAmNwVoQACgkQeNfe+5rV mvG2Ig//cYxDyMl746MlhSnF6rjF6wOy8E2+mbImbraMrOiS/eS9BUEpMHT24885 vWpnV0KWxa9/WW50TDKTRN1N54Mfp5kfW6K/Kr0sheViloV/t8M2foDxP4nFrL6L MzqelKrVVSfeZGPsbNKAHDDpdEYmLgP1mgdPq4ncKReJZxVTM9u52j4YHsXfizJ1 59cwGnOenb1X5A9keTPWjHn07ueDPbIeoJ6YtK5oy2hM31hY0kiNjuJzk4bYJCTe qD8Zzb31HAuRhV+g2ZyyvITZVesgbmSVSqlFD8g2k2KFjEyXfyMFN8ttsLXT9xZe KcDML08DVsjQNvx4sPiWztGMUksJ94hm4mTuG/BMum6ixOzrOEi+GZAAHblOinrq /ZW02rcrUdC6TA/05+HguHysyFb6vDnOEvW9Ng0/sHhBXNDi94SYGx1XsyNcqp0v 5WuAO/eMyLV6KPX8ji4S+pnNWwIoIqNYQ4qp0vCTTp39Ge+tzA1utm8Ht7IedgFH JJIEIep/CgDxnKi7HaoglQOQl+Y4xPeTmbdMrI0SL3OeQPFWf2EVMxRth/O0hwpB E7e1fD1KGzLR9j3p+RP8QPETTLC5cHJmgiOoAvBv5Gfu4mhpIeJvOZMo1HwLvtBG qTOsHKMDaWtutnVIK9wJMQQAByW9iY2i6XdI2rSeECsCd7Sz53w= =IvK7 -----END PGP SIGNATURE----- --nextPart5314975.pHMvOt90FF--