Bug 1320683
| Summary: | RPM fails to enforce dependencies declared in python package | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | John Dennis <jdennis> | |
| Component: | python-requests-oauthlib | Assignee: | Fedora Infrastructure SIG <infra-sig> | |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 25 | CC: | kevin, rbean | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1320686 (view as bug list) | Environment: | ||
| Last Closed: | 2017-02-26 00:51:15 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1320686 | |||
This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component. While the underlying issue here (dependencies are not constrained the same way upstream specifies them)... we do have python-oauthlib > 0.6.2 in F24 and rawhide now. This message is a reminder that Fedora 23 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 23. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '23'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 23 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. I've fixed this in rawhide and also updated it to 0.8.0. Let me know if you need a f25 build. |
With Python packages the distutils setup.py acts much like an RPM spec file, it contains all sorts of metadata about the package. One critical piece of information is the required dependencies, including required versions of those dependencies. For example in the requests.oauthlib setup.py file we have: install_requires=['oauthlib>=0.6.2', 'requests>=2.0.0'] But the RPM spec file does not enforce the same dependencies. The dependencies in the spec files are this: For Py2: Requires: python-oauthlib Requires: python-requests For Py3: Requires: python3-oauthlib Requires: python3-requests The dependencies in the RPM *must* match those declared in the upstream metadata otherwise an install may not produce runnable code. This is the problem we're seeing with some distributions. oauthlib 0.6.2 exposed new method oauthlib.oauth2.is_secure_transport(), requests-oauthlib references that symbol. But if a version of oauthlib older than 0.6.2 is installed the package installer won't force an update of oauthlib because of the missing version dependency. The result is the python program aborts.