Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 735396 - media-tv/plex-media-server: need py3 port
Summary: media-tv/plex-media-server: need py3 port
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal with 2 votes (vote)
Deadline: 2020-10-20
Assignee: Stephen Shkardoon
Keywords: PMASKED
Depends on:
Blocks: py3-tracker, python-3-incompatible
  Show dependency tree
Reported: 2020-08-02 14:34 UTC by Michał Górny
Modified: 2021-02-09 18:46 UTC (History)
7 users (show)

See Also:
Package list:
Runtime testing required: ---

Updated ebuild (plex-media-server-1.20.1.ebuild,4.04 KB, text/plain)
2020-09-22 22:17 UTC, Jordan Patterson
Updated start_pms (start_pms,1.61 KB, application/x-shellscript)
2020-09-22 22:17 UTC, Jordan Patterson

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2020-08-02 14:34:39 UTC
Please port to py3.
Comment 1 Stephen Shkardoon 2020-08-03 01:39:24 UTC
Upstream has signaled an intention to rewrite security relevant parts of the package in compiled languages rather than Python, but expects some parts to remain Python 2 for some time:
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2020-09-01 10:04:27 UTC
Comment 3 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2020-09-19 10:38:30 UTC
Ping.  Do we really want to keep it with all the bundled stuff, given it's a security nightmare?
Comment 4 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2020-09-20 13:35:15 UTC
Ok, this one's a major blocker right now, so I'm going to lastrite it.  If you can update the ebuild to 1) stop bundling python, and use system python2.7 instead, and 2) use virtualenv from python3 (i.e. call it with '--py 2.7'), it can stay for a while more.
Comment 5 Larry the Git Cow gentoo-dev 2020-09-20 13:37:10 UTC
The bug has been referenced in the following commit(s):

commit 857156073762108cd2ad224ee9d2d48a613ca1db
Author:     Michał Górny <>
AuthorDate: 2020-09-20 13:36:48 +0000
Commit:     Michał Górny <>
CommitDate: 2020-09-20 13:37:06 +0000

    package.mask: Last rite media-tv/plex-media-server
    Signed-off-by: Michał Górny <>

 profiles/package.mask | 7 +++++++
 1 file changed, 7 insertions(+)
Comment 6 Bernhard Kühnel 2020-09-22 19:36:44 UTC
Upstream has responded ( that
- their bundled is subject to modifications including security patches by Plex staff (
- by only bundling and not the interpreter, they don't see as big of a security impact
- a patch removing python2.7 entirely can currently not be expected before 2020-10-20
- removal of existing python2.7 functionality is actively worked on (as stated before), however no timeline has been given

On a side note, I've tried replacing the bundled from PMS with the one from dev-lang/python-2.7.18-r2 just to see if that would be an intermediate workaround.
The result was mixed: the service would start and some core functions (movie playback) work, but some settings/admin pages would not load (unexpectedly) and some file scanners wouldn't work (as mentioned by upstream).
Comment 7 Jordan Patterson 2020-09-22 22:17:26 UTC
Created attachment 662038 [details]
Updated ebuild
Comment 8 Jordan Patterson 2020-09-22 22:17:47 UTC
Created attachment 662041 [details]
Updated start_pms
Comment 9 Jordan Patterson 2020-09-22 22:54:58 UTC
Hi Michał:

I've attached an ebuild and start script that uses the system python 2.7.  I've added lxml and simplejson as dependencies and removed virtualenv.  As far as I can tell, they were the only additional libraries used by the virtualenv.

There are two binaries that set the env variable PYTHONHOME before running scripts, which needs to prevented.  I used sed on the binaries so that it sets an env variable called PYTHONZZZZ instead, which won't be used.  Is there a better way to do that?

With these changes, things are all working as far as I can tell.  Server settings, adding new media, and streaming are working.
Comment 10 Anthony Ryan 2020-09-23 02:45:45 UTC
I just noticed this while updating my HTPC today.

I would welcome any suggestions and collaboration. It's not perfect yet, but I think we're going in the right direction.

No matter what we do, Plex isn't going to be friendly to package:
- It's commercial software
- They bundle *all* of their dependencies
- They patch some of those dependencies
- They don't release those patches
- Failing to use their patched dependencies will cause instability

I believe the only way forward is to treat Plex like a black box. Let it do it's own thing and stop fighting it. Wash our hands of responsibility for the safety of Plex's dependencies (and Plex itself).
Comment 11 Anthony Ryan 2020-09-23 02:52:37 UTC
To clarify one point before there's any more confusion. I don't actually have any issue with the lastrites on this.

The problems still exist and they're valid, even with a new ebuild. It won't be to the same standards as the rest of the tree.

With that said, I think this is popular and useful enough (disappointingly, with no open source alternative) that we ought to at least have a overlay package for this in good shape.
Comment 12 Stephen Shkardoon 2020-09-28 07:49:33 UTC
Upstream has indicated strongly against removing the bundled libraries, so even if we could get it working properly, I don't think it would be appropriate for us to continue down such a path. Every new version is a chance for more changes that we can support, along with more testing that would need to be done to ensure they haven't broken anything.

There is a third party repo (comio's) which lets users install it if they wish to take on the security and maintenance burden.
Comment 13 Larry the Git Cow gentoo-dev 2020-10-20 15:52:38 UTC
The bug has been closed via the following commit(s):

commit cfd7cc6044812d7b3b2efb1495247b72787dc6f5
Author:     Michał Górny <>
AuthorDate: 2020-10-20 15:47:57 +0000
Commit:     Michał Górny <>
CommitDate: 2020-10-20 15:52:25 +0000

    media-tv/plex-media-server: Remove last-rited pkg
    Signed-off-by: Michał Górny <>

 media-tv/plex-media-server/Manifest                |  10 --
 .../add_gentoo_profile_as_platform_version.patch   |  12 --
 .../files/conf.d/plex-media-server                 |   7 --
 .../plex-media-server/files/etc-plexmediaserver    |  23 ----
 .../files/init.d/plex-media-server                 |  20 ---
 .../files/       |   8 --
 .../files/plexmediaserver.service.patch            |  12 --
 media-tv/plex-media-server/files/start_pms         |  50 --------
 .../files/systemd/plex-media-server.service        |  11 --
 .../files/virtualenv_start_pms_2019.patch          |  12 --
 media-tv/plex-media-server/metadata.xml            |  12 --
 .../plex-media-server-1.18.3.ebuild                | 138 --------------------
 .../plex-media-server-1.18.4-r1.ebuild             | 137 --------------------
 .../plex-media-server-1.19.1.ebuild                | 140 ---------------------
 .../plex-media-server-1.19.2.ebuild                | 140 ---------------------
 .../plex-media-server-1.19.5.ebuild                | 140 ---------------------
 profiles/package.mask                              |   7 --
 17 files changed, 879 deletions(-)
Comment 14 turtle 2021-01-02 19:30:09 UTC
Package was removed in error, please reopen this bug.
As P this package does not block or depend on py3-tracker, python-3-incompatible
Plex does not depend on any system Python and has no documented specific security CVE. 

1.) There is no Gentoo policy to ban packages that use any specific version of a language that is fully contained within its internal libraries.

2.) There are no currently documented security 'nightmares' for the average Gentoo user running Plex.

Plex has many active devs and responds to even the slightest security holes quickly:

All other linux distros still support Plex.