Anyone interested in python-pgpy?

Anyone interested in python-pgpy?

[Sean Whitton]

[-- Attachment #1.1: Type: text/plain, Size: 691 bytes --]

Hello,

python-pgpy is undermaintained and has long been so.  This has meant
that its reverse dependency mailscripts (which I maintain) is added to
the autoremovals list each time python-pgpy breaks.

The script in mailscripts that depends on python-pgpy,
email-print-mime-structure, is a nice, well-documented piece of
software, and it would be a great shame to lose it.

However, I can't really let the whole of mailscripts miss trixie as a
result of keeping it.  So, I'll have to drop email-print-mime-structure
from the mailscripts package if this situation persists.

Would anyone be interested in taking over maintainance of python-pgpy?

Thanks.

-- 
Sean Whitton

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 869 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Xiyue Deng]

[-- Attachment #1.1: Type: text/plain, Size: 1228 bytes --]

Hi Sean,

Sean Whitton <spwhitton@spwhitton.name> writes:

> Hello,
>
> python-pgpy is undermaintained and has long been so.  This has meant
> that its reverse dependency mailscripts (which I maintain) is added to
> the autoremovals list each time python-pgpy breaks.
>
> The script in mailscripts that depends on python-pgpy,
> email-print-mime-structure, is a nice, well-documented piece of
> software, and it would be a great shame to lose it.
>
> However, I can't really let the whole of mailscripts miss trixie as a
> result of keeping it.  So, I'll have to drop email-print-mime-structure
> from the mailscripts package if this situation persists.
>
> Would anyone be interested in taking over maintainance of python-pgpy?
>
> Thanks.
>
> -- 
> Sean Whitton
> _______________________________________________
> notmuch mailing list -- notmuch@notmuchmail.org
> To unsubscribe send an email to notmuch-leave@notmuchmail.org

I have made a MR[1] including a few quick fixes for the RC bugs, in hope
that they are acceptable for another NMU to unblock this package and its
dependencies.  PTAL.  Thanks!

[1] https://salsa.debian.org/debian/pgpy/-/merge_requests/2

-- 
Regards,
Xiyue Deng

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Sean Whitton]

Hello Xiyue,

On Mon 02 Dec 2024 at 01:28pm -08, Xiyue Deng wrote:

> I have made a MR[1] including a few quick fixes for the RC bugs, in hope
> that they are acceptable for another NMU to unblock this package and its
> dependencies.  PTAL.  Thanks!
>
> [1] https://salsa.debian.org/debian/pgpy/-/merge_requests/2

Thank you very much for taking a look at this one.

I'm a bit queasy about just disabling the failing tests.  Do we have
reason to believe that pgpy is not actually broken with Python 3.13?
In other words, what makes you think that it's just the tests that are
broken, not the program?

Thanks.

-- 
Sean Whitton

Re: Anyone interested in python-pgpy?

[Xiyue Deng]

[-- Attachment #1.1: Type: text/plain, Size: 1149 bytes --]

Hi Sean,

Sean Whitton <spwhitton@spwhitton.name> writes:

> Hello Xiyue,
>
> On Mon 02 Dec 2024 at 01:28pm -08, Xiyue Deng wrote:
>
>> I have made a MR[1] including a few quick fixes for the RC bugs, in hope
>> that they are acceptable for another NMU to unblock this package and its
>> dependencies.  PTAL.  Thanks!
>>
>> [1] https://salsa.debian.org/debian/pgpy/-/merge_requests/2
>
> Thank you very much for taking a look at this one.
>
> I'm a bit queasy about just disabling the failing tests.  Do we have
> reason to believe that pgpy is not actually broken with Python 3.13?
> In other words, what makes you think that it's just the tests that are
> broken, not the program?
>

I don't have an answer yet.  I have tested 0.6.0-1.3 in a bookworm
sbuild chroot which has Python 3.11 and the tests passed.  The build log
in Bug#1086378 shows it was using Python 3.12, so I would assume
something changed in Python 3.12 was the cause.  I would do some further
checks to be sure.  Though I do hope people familiar with the matters
can beat me to it.

> Thanks.
>
> -- 
> Sean Whitton

-- 
Regards,
Xiyue Deng

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Xiyue Deng]

[-- Attachment #1.1: Type: text/plain, Size: 1811 bytes --]

Xiyue Deng <manphiz@gmail.com> writes:

> Hi Sean,
>
> Sean Whitton <spwhitton@spwhitton.name> writes:
>
>> Hello Xiyue,
>>
>> On Mon 02 Dec 2024 at 01:28pm -08, Xiyue Deng wrote:
>>
>>> I have made a MR[1] including a few quick fixes for the RC bugs, in hope
>>> that they are acceptable for another NMU to unblock this package and its
>>> dependencies.  PTAL.  Thanks!
>>>
>>> [1] https://salsa.debian.org/debian/pgpy/-/merge_requests/2
>>
>> Thank you very much for taking a look at this one.
>>
>> I'm a bit queasy about just disabling the failing tests.  Do we have
>> reason to believe that pgpy is not actually broken with Python 3.13?
>> In other words, what makes you think that it's just the tests that are
>> broken, not the program?
>>
>
> I don't have an answer yet.  I have tested 0.6.0-1.3 in a bookworm
> sbuild chroot which has Python 3.11 and the tests passed.  The build log
> in Bug#1086378 shows it was using Python 3.12, so I would assume
> something changed in Python 3.12 was the cause.  I would do some further
> checks to be sure.  Though I do hope people familiar with the matters
> can beat me to it.
>

Looks like this has nothing to do with Python version but gpgme: I have
tested with a snapshot of gpgme1.0 version 1.18.0-6+b1 and everything
works; upgrading to version 1.23.2-5 and the tests start to show the
same errors.  I have been trying to see what has changed from gpgme side
but so far nothing conclusive yet.

On the other hand, python-pgpy may be working fine as all failures in
the tests are caused by using the gpgme python binding, which somehow
doesn't like the PGP signed message generated by python-pgpy anymore.

>> Thanks.
>>
>> -- 
>> Sean Whitton
>
> -- 
> Regards,
> Xiyue Deng

-- 
Regards,
Xiyue Deng

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Sean Whitton]

Hello,

On Wed 04 Dec 2024 at 01:18am -08, Xiyue Deng wrote:

> Looks like this has nothing to do with Python version but gpgme: I have
> tested with a snapshot of gpgme1.0 version 1.18.0-6+b1 and everything
> works; upgrading to version 1.23.2-5 and the tests start to show the
> same errors.  I have been trying to see what has changed from gpgme side
> but so far nothing conclusive yet.
>
> On the other hand, python-pgpy may be working fine as all failures in
> the tests are caused by using the gpgme python binding, which somehow
> doesn't like the PGP signed message generated by python-pgpy anymore.

So the bug has nothing to do with the python 3.13 transition, in fact?

I think that means its severity should be changed.

I guess you're not sure yet whether or not it should be reassigned to
pgpme?

-- 
Sean Whitton

Re: Anyone interested in python-pgpy?

[Xiyue Deng]

[-- Attachment #1.1: Type: text/plain, Size: 1398 bytes --]

Sean Whitton <spwhitton@spwhitton.name> writes:

> Hello,
>
> On Wed 04 Dec 2024 at 01:18am -08, Xiyue Deng wrote:
>
>> Looks like this has nothing to do with Python version but gpgme: I have
>> tested with a snapshot of gpgme1.0 version 1.18.0-6+b1 and everything
>> works; upgrading to version 1.23.2-5 and the tests start to show the
>> same errors.  I have been trying to see what has changed from gpgme side
>> but so far nothing conclusive yet.
>>
>> On the other hand, python-pgpy may be working fine as all failures in
>> the tests are caused by using the gpgme python binding, which somehow
>> doesn't like the PGP signed message generated by python-pgpy anymore.
>
> So the bug has nothing to do with the python 3.13 transition, in fact?
>

No.  To be clear, python 3.13 + gpgme1.0 1.18.0-6+b1 works.  It should
be the change in gpgme that caused this.

> I think that means its severity should be changed.
>
> I guess you're not sure yet whether or not it should be reassigned to
> pgpme?
>

As the gpgme unit tests are passing, I'm not quite sure whether gpgme
should be in the blame, yet.  It could be that the pgpy use should be
adjusted.  I still need more time to figure this out as it's been a busy
week.  Still hope that someone more familiar with the matter can take a
look sooner than me :)

> -- 
> Sean Whitton

-- 
Regards,
Xiyue Deng

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Sean Whitton]

Hello,

Thank you very much for the update and help thus far.

-- 
Sean Whitton

Re: Anyone interested in python-pgpy?

[Xiyue Deng]

[-- Attachment #1.1: Type: text/plain, Size: 817 bytes --]

Hi Sean,

Sean Whitton <spwhitton@spwhitton.name> writes:

> Hello,
>
> Thank you very much for the update and help thus far.
>

Sure thing!

I have further identified that this was caused by GPGME adding
"--verify" when invoking "gpg" command.  I have updated Bug#1086378[1]
with more details and forwarded it[2] in hope to have a proper fix from
upstream.

Meanwhile, I have updated my MR[3] to disable the failed checks due to
GPGME upstream change only to fix the build and tests so that we still
have test coverage on the rest, hoping this would be acceptable for an
NMU.  PTAL.

> -- 
> Sean Whitton

[1] https://bugs.debian.org/1086378
[2] https://github.com/SecurityInnovation/PGPy/issues/471
[3] https://salsa.debian.org/debian/pgpy/-/merge_requests/2

-- 
Regards,
Xiyue Deng

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Sean Whitton]

[-- Attachment #1.1: Type: text/plain, Size: 189 bytes --]

Hello,

Many thanks, and nice documentation of the changes.

If you'd like to send an MR or patch with a d/changelog entry, I can
upload the NMU credited to you.

-- 
Sean Whitton

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 869 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Xiyue Deng]

[-- Attachment #1.1: Type: text/plain, Size: 572 bytes --]

Sean Whitton <spwhitton@spwhitton.name> writes:

> Hello,
>
> Many thanks, and nice documentation of the changes.
>
> If you'd like to send an MR or patch with a d/changelog entry, I can
> upload the NMU credited to you.
>

Sounds good.  I have the MR for updating d/changelog at [1].  I have a
separate commit to finalize in case there are any comments to address.
Please let me know if I should leave out the finalization instead.
Thanks!

> -- 
> Sean Whitton

[1] https://salsa.debian.org/debian/pgpy/-/merge_requests/3

-- 
Regards,
Xiyue Deng

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Sean Whitton]

[-- Attachment #1.1: Type: text/plain, Size: 681 bytes --]

Hello,

On Sat 07 Dec 2024 at 02:27am -08, Xiyue Deng wrote:

> Sean Whitton <spwhitton@spwhitton.name> writes:
>
>> Hello,
>>
>> Many thanks, and nice documentation of the changes.
>>
>> If you'd like to send an MR or patch with a d/changelog entry, I can
>> upload the NMU credited to you.
>>
>
> Sounds good.  I have the MR for updating d/changelog at [1].  I have a
> separate commit to finalize in case there are any comments to address.
> Please let me know if I should leave out the finalization instead.
> Thanks!

No, don't leave it out, and also, I think you should close #1086378,
else this doesn't help with the autoremoval :)

-- 
Sean Whitton

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 869 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Xiyue Deng]

[-- Attachment #1.1: Type: text/plain, Size: 1068 bytes --]

Hi Sean,

Sean Whitton <spwhitton@spwhitton.name> writes:

> Hello,
>
> On Sat 07 Dec 2024 at 02:27am -08, Xiyue Deng wrote:
>
>> Sean Whitton <spwhitton@spwhitton.name> writes:
>>
>>> Hello,
>>>
>>> Many thanks, and nice documentation of the changes.
>>>
>>> If you'd like to send an MR or patch with a d/changelog entry, I can
>>> upload the NMU credited to you.
>>>
>>
>> Sounds good.  I have the MR for updating d/changelog at [1].  I have a
>> separate commit to finalize in case there are any comments to address.
>> Please let me know if I should leave out the finalization instead.
>> Thanks!
>
> No, don't leave it out,

Ack.

> and also, I think you should close #1086378, else this doesn't help
> with the autoremoval :)
>

I was thinking about keeping the bug open and downgrade to important so
that we keep tracking it.  But as I have forwarded it upstream we can
monitor the upstream bug directly.

I have updated the MR with changelog to close all 3 bugs.  PTAL.

> -- 
> Sean Whitton

-- 
Regards,
Xiyue Deng

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Anyone interested in python-pgpy?

[Sean Whitton]

[-- Attachment #1.1: Type: text/plain, Size: 652 bytes --]

Hello,

On Sat 07 Dec 2024 at 06:56pm -08, Xiyue Deng wrote:

> I was thinking about keeping the bug open and downgrade to important so
> that we keep tracking it.  But as I have forwarded it upstream we can
> monitor the upstream bug directly.

I think that downgrading it like that would make sense were you the
maintainer.  But given that we're doing an NMU to deal with RC bugs,
just closing is a simpler documentation of your intent.  The maintainer
might reopen it and downgrade its importance later.

Great work figuring out and then documenting these fixes.
mailscripts' dependency on python3-pgpy lives on!

-- 
Sean Whitton

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 869 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]