[MIR] python-requests-kerberos and pykerberos (deps of python-keystoneauth1)

[Matthias Klose]

[MIR] python-requests-kerberos and pykerberos (deps of python-keystoneauth1)

[Mathieu Trudel-Lapierre (cyphermox)]

python-requests-kerberos looks good; it appears to be well-maintained in Debian and Ubuntu, and is a simple package that relies on python-requests which is already in main. However, it is blocked by pykerberos, which appears to be missing hardening flags:

N: Processing binary package python3-kerberos (version 1.1.5-2build1, arch amd64) ...
I: python3-kerberos: hardening-no-bindnow usr/lib/python3/dist-packages/kerberos.cpython-35m-x86_64-linux-gnu.so
N: ----
N: Processing binary package python-kerberos (version 1.1.5-2build1, arch amd64) ...
I: python-kerberos: hardening-no-bindnow usr/lib/python2.7/dist-packages/kerberos.so

[Mathieu Trudel-Lapierre (cyphermox)]

python-requests-kerberos and pykerberos are also missing a team subscriber; a team that will look after bugs in these packages.

pykerberos is a little worrying in that the last changes happened over a year ago, and there has been a new upstream version since June that hasn't been packaged. It's not horrible yet, as it appears to be a fairly regularly maintained project upstream, but it may be missing an active maintainer team to look after the package in Debian and Ubuntu. The new upstream version should be packaged.

Team subscriber is definitely a blocker, and so is enabling hardening for pykerberos. Given that pykerberos deals with potentially sensitive auth/authz information, it should be reviewed by the security team.

[James Page (james-page)]

This was an optional dependency; no direct requirement to pull into main, so marking both bug tasks as Invalid.