Comment 64 for bug 2055114

Revision history for this message
Mauricio Faria de Oliveira (mfo) wrote :

The vendorized asyncore.py is identical in python3-pyasyncore (main).

It's better to rely on the package (vs. vendoring) for the stable release,
specially for an LTS, where ESM is 10-12 years, to avoid code duplication
and monitoring/patching on potential security vulnerabilities in 2 places.

Also, in the future, if upstream does migrate from asyncore to asyncio,
the compat module might be abandoned and we'd lose updates/fixes, if any;
and, if this were to happen, again, it's potential bug fixes in 2 places.

I discussed the approach with Steve L., and he confirmed this to be fine.

So, I adjusted the existing 2 uploads, build/start tested in PPA/locally,
and confirmed the asyncore module comes from python3-pyasyncore, and the
asynchat module comes from fail2ban compat/vendoring.

Re-uploading to Noble.

...

$ sudo apt install -y python3-pyasyncore
$ dpkg -S /usr/lib/python3/dist-packages/asyncore/asyncore.py
python3-pyasyncore: /usr/lib/python3/dist-packages/asyncore/asyncore.py
$ wget 'https://raw.githubusercontent.com/fail2ban/fail2ban/054e1d89ca3fa8b767ee21db1a3368f3d890baa8/fail2ban/compat/asyncore.py'
$ md5sum asyncore.py /usr/lib/python3/dist-packages/asyncore/asyncore.py
b4d0825373f6b54927cd50763ccfb641 asyncore.py
b4d0825373f6b54927cd50763ccfb641 /usr/lib/python3/dist-packages/asyncore/asyncore.py

...

PPA build with -proposed enabled:
https://launchpad.net/~mfo/+archive/ubuntu/lp2055114

$ systemctl status --full --no-pager fail2ban.service
...
     Active: active (running) since Mon 2024-06-10 19:33:55 -03; 7s ago
...

Jun 10 19:33:55 noble-fail2ban systemd[1]: Started fail2ban.service - Fail2Ban Service.
Jun 10 19:33:55 noble-fail2ban fail2ban-server[10839]: 2024-06-10 22:33:55,664 fail2ban.configreader [10839]: WARNING 'allowipv6' not defined in 'Definition'. Using default one: 'auto'
Jun 10 19:33:55 noble-fail2ban fail2ban-server[10839]: Server ready

...

$ sudo systemctl stop fail2ban.service

$ sudo strace -e openat /usr/bin/python3 /usr/bin/fail2ban-server -xf start 2>&1 | grep -F -e asynchat. -e asyncore.
openat(AT_FDCWD, "/usr/lib/python3/dist-packages/asyncore/__pycache__/asyncore.cpython-312.pyc", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib/python3/dist-packages/fail2ban/compat/__pycache__/asynchat.cpython-312.pyc", O_RDONLY|O_CLOEXEC) = 3