Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 675824 - dev-python/pysaml2-4.6.3 misreports saml2.__version__ as "file-VERSION"
Summary: dev-python/pysaml2-4.6.3 misreports saml2.__version__ as "file-VERSION"
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Matthew Thode ( prometheanfire )
URL:
Whiteboard:
Keywords: PATCH
Depends on:
Blocks:
 
Reported: 2019-01-19 05:29 UTC by Anton
Modified: 2019-01-21 08:49 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info (emerge-info,5.19 KB, text/plain)
2019-01-19 05:29 UTC, Anton
Details
Workaround: patch setup.cfg with actual package version (version.patch,300 bytes, patch)
2019-01-19 05:38 UTC, Anton
Details | Diff
Work-around for incorrect saml2.__version__ (pysaml2.ebuild.patch,898 bytes, patch)
2019-01-20 05:55 UTC, Anton
Details | Diff
Work-around for incorrect saml2.__version__ (pysaml2-r2.ebuild.patch,836 bytes, patch)
2019-01-21 04:41 UTC, Anton
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Anton 2019-01-19 05:29:17 UTC
Created attachment 562110 [details]
emerge --info

With pysaml2 installed, observed behavior:

# python
Python 3.6.5 (default, Jan 17 2019, 23:34:59)
[GCC 7.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import saml2
>>> saml2.__version__
'file-VERSION'
>>>

whereas expected behavior

# python
Python 3.6.5 (default, Jan 17 2019, 23:34:59)
[GCC 7.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import saml2
>>> saml2.__version__
'4.6.3'
>>>

This affects custom-installed packages which are trying to check their dependencies and conclude that pysaml2 of the appropriate version is not present.
Comment 1 Anton 2019-01-19 05:38:27 UTC
Created attachment 562112 [details, diff]
Workaround: patch setup.cfg with actual package version

It is possible to change the setup.cfg that comes with the package source so that it specifies the actual version of the package. Attached is a patch file you can drop into /etc/portage/patches/dev-python/pysaml2-4.6.3/ as a workaround. However:
 * This is not scalable: you need a new patch for every new version
 * It does not get to the root cause of the problem: the package author's intent was, apparently, that the version number is read from the file VERSION, but for some reason it does not happen
Comment 2 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2019-01-19 15:27:25 UTC
I think it'd be better to do a sed in the ebuild, we can then use the $VERSION info and not have to carry a patch for each version.  Not sure if you want to do this (via pull request or patch) or if you wanted me to do this.  I'd also update to 4.6.5 at the same time.
Comment 3 Anton 2019-01-20 05:55:08 UTC
Created attachment 562232 [details, diff]
Work-around for incorrect saml2.__version__

(In reply to Matthew Thode ( prometheanfire ) from comment #2)
> I think it'd be better to do a sed in the ebuild, we can then use the
> $VERSION info and not have to carry a patch for each version.  Not sure if
> you want to do this (via pull request or patch) or if you wanted me to do
> this.  I'd also update to 4.6.5 at the same time.

Yes, I want to do it, here's the patch.

Before running sed it checks that our assumption still holds (the line "version = file:VERSION" is present in setup.cfg) If the assumption fails, something needs to be done: either the bug reopened, or the work-around removed from the ebuild.
Comment 4 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2019-01-20 06:27:51 UTC
if [[ grep -q if '^version = file:VERSION$' setup.cfg ]]; then
  sed --in-place -e "s/^version = file:VERSION\$/version = ${PV}/" setup.cfg
else
  ewarn 'BLAH'
fi

The above would be better I think (not sure about the double brackets, it's late), grep -q is preferred for things like just checking for exit codes and (from what I've been taught) it's better to have the common use case for an if statement go first.  I'm not sure if sed -e is needed or not, it'd be preferred to not use it if possible.

The basic logic looks good.  I do like the ewarn because just a simple sed would not notify us to the content changing (resulting in silent failures).
Comment 5 Anton 2019-01-21 04:41:20 UTC
Created attachment 562360 [details, diff]
Work-around for incorrect saml2.__version__

(In reply to Matthew Thode ( prometheanfire ) from comment #4)
> if [[ grep -q if '^version = file:VERSION$' setup.cfg ]]; then
>   sed --in-place -e "s/^version = file:VERSION\$/version = ${PV}/" setup.cfg
> else
>   ewarn 'BLAH'
> fi
> 
> The above would be better I think (not sure about the double brackets, it's
> late), grep -q is preferred for things like just checking for exit codes and
> (from what I've been taught) it's better to have the common use case for an
> if statement go first.  I'm not sure if sed -e is needed or not, it'd be
> preferred to not use it if possible.
> 
> The basic logic looks good.  I do like the ewarn because just a simple sed
> would not notify us to the content changing (resulting in silent failures).

Good points! Thanks for reviewing it.

It seems I have dug to the root cause, though: the upstream expects setuptools-39.2.0 or later. The new patch only runs sed if setuptools is older than that. It will replace any occurence of "version = file:..." with "version = ${PV}" 

There is no ewarn, because I think now we understand what's happening, and the work-around will deprecate itself as soon as setuptools gets upgraded to a newer version.

Here is a link which explains what that "file:VERSION" stands for:
https://setuptools.readthedocs.io/en/latest/setuptools.html#specifying-values

Specifically see Note 1 after:
https://setuptools.readthedocs.io/en/latest/setuptools.html#metadata
Comment 6 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2019-01-21 08:45:56 UTC
Looks good, will commit
Comment 7 Larry the Git Cow gentoo-dev 2019-01-21 08:49:06 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5753e2cddfd46760faa3ae5d93aaa450824dd6bc

commit 5753e2cddfd46760faa3ae5d93aaa450824dd6bc
Author:     Matthew Thode <prometheanfire@gentoo.org>
AuthorDate: 2019-01-21 08:48:51 +0000
Commit:     Matthew Thode <prometheanfire@gentoo.org>
CommitDate: 2019-01-21 08:48:51 +0000

    dev-python/pysaml2: fix setup.config metadata
    
    Fixes: https://bugs.gentoo.org/675824
    Package-Manager: Portage-2.3.51, Repoman-2.3.12
    Signed-off-by: Matthew Thode <prometheanfire@gentoo.org>

 dev-python/pysaml2/pysaml2-4.6.3-r1.ebuild | 40 ++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)