On Mon, Nov 13, 2023 at 11:51 AM Neal Gompa <ngompa13(a)gmail.com> wrote:
On Sun, Nov 12, 2023 at 12:35 PM Fabio Valentini <decathorpe(a)gmail.com> wrote:
>
> On Tue, Aug 1, 2023 at 5:43 PM Fabio Valentini <decathorpe(a)gmail.com> wrote:
> >
> > There are applications in Fedora that still rely on *ancient* versions
> > of PyO3, potentially affected by this:
> >
> > - cpython: mercurial
> > - pyo3 v0.15: fapolicy-analyzer, python-bcrypt, python-cryptography
> > - pyo3 v0.16: python-y-py
> > - pyo3 v0.17: unused compat packages, will be retired
> > - pyo3 v0.18: matrix-synapse
>
> Hello again.
>
> It is now three months later, and three packages have moved to the
> latest available version of pyo3:
>
> - python-cryptography
> - python-y-py
> - matrix-synapse
>
> That leaves two packages that are stuck on pyo3 v0.15:
>
> - fapolicy-analyzer
> - python-bcrypt
>
> I have now filed bugs against both packages that they need to move to
> pyo3 v0.19.2+ ASAP on both Fedora 39 and Rawhide.
> Due to ABI changes in Python 3.12, they are not guaranteed to even
> work correctly on Python 3.12.
>
> -
https://bugzilla.redhat.com/show_bug.cgi?id=2249378
> -
https://bugzilla.redhat.com/show_bug.cgi?id=2249381
>
The mainline git version of python-bcrypt has already been adapted for
python 3.12, they just haven't made a release yet, it seems?
https://github.com/pyca/bcrypt
That said, it doesn't look like it needed code changes to make that
work, so it should be possible to just bump things?
Yup, I've mentioned that in the bug I filed for python-bcrypt -
It might be as simple as bumping the dependency on pyo3 from v0.15 to v0.19.
It's not that easy for fapolicy-analyzer as far as I can tell, since
it was affected by API changes between v0.15 and v0.19, last I
checked.
But there is now also an upstream PR for bumping the pyo3 version.
Fabio