[MIR] python-typing-extensions

[Danilo Egea Gondolfo]

[Availability]
The package python-typing-extensions is already in Ubuntu universe.
The package python-typing-extensions build for the architectures it is designed to work on.
It currently builds and works for architectures: all
Link to package https://launchpad.net/ubuntu/+source/python%2Dtyping%2Dextensions

[Rationale]
- The package python-typing-extensions is required in Ubuntu main as it is a transitive dependency
used by a new feature in netplan.io (package python3-rich (src:rich) depends on it).
- The package python-typing-extensions will generally be useful for a large part of our user base
- The package python-typing-extensions is a new runtime dependency of package rich used by netplan.io that we already support

- The package python-typing-extensions is required in Ubuntu main no later than Feb 23 due to feature freeze

[Security]
- Had 0 security issues in the past
- No CVEs/security issues in this software in the past

- no `suid` or `sgid` binaries
- no executables in `/sbin` and `/usr/sbin`
- Package does not install services, timers or recurring jobs
- Packages does not open privileged ports (ports < 1024)
- Packages does not contain extensions to security-sensitive software

[Quality assurance - function/usage]
- The package works well right after install

[Quality assurance - maintenance]
- The package is maintained well in Debian/Ubuntu and has not too many and long term critical bugs open
- Ubuntu https://bugs.launchpad.net/ubuntu/+source/python-typing-extensions/+bug
- Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=python-typing-extensions
- The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
- The package runs a test suite on build time, if it fails it makes the build fail, link to build log https://launchpadlibrarian.net/617143066/buildlog_ubuntu-kinetic-amd64.python-typing-extensions_4.3.0-2_BUILDING.txt.gz

- The package runs an autopkgtest, and is currently passing on all architectures but i386, link to test logs https://autopkgtest.ubuntu.com/results/autopkgtest-lunar/lunar/amd64/p/python-typing-extensions/20221229_204656_94262@/log.gz

- The package does have not failing autopkgtests right now

[Quality assurance - packaging]
- debian/watch is present and works

- debian/control defines a correct Maintainer field

- This package does not yield massive lintian Warnings, Errors
- Please link to a recent build log of the package https://launchpadlibrarian.net/617143066/buildlog_ubuntu-kinetic-amd64.python-typing-extensions_4.3.0-2_BUILDING.txt.gz
- Lintian overrides are not present

- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies

- The package will be installed by default, but does not ask debconf questions higher than medium

- Packaging and build is easy, link to d/rules https://git.launchpad.net/ubuntu/+source/python-typing-extensions/tree/debian/rules

[UI standards]
- Application is not end-user facing (does not need translation)

[Dependencies]
- No further depends or recommends dependencies that are not yet in main

[Standards compliance]
- This package correctly follows FHS and Debian Policy

[Maintenance/Owner]
- Owning Team will be Foundations
- Team is not yet, but will subscribe to the package before promotion

- This does not use static builds
- This does not use vendored code
- This package is not rust based

- The package successfully built during the most recent test rebuild

[Background information]
- The Package description explains the package well
- Upstream Name is typing_extensions
- Link to upstream project https://github.com/python/typing_extensions

[Danilo Egea Gondolfo (danilogondolfo)]

$ lintian --pedantic
E: python-typing-extensions changes: bad-distribution-in-changes-file unstable

[Didier Roche-Tolomelli (didrocks)]

Review for Package: python-typing-extensions

[Summary]
The overall package looks good and seems fine for a MIR team ACK. However, I have 2 required TODOs: one question to ensure that the rationale is clearer on this package use, and also that we investigate why it’s not been updated in Debian for a while, and the plan for future maintainance then.

Notes:
Required TODOs:
- Question: Please clarify the rationale for this dependency.
the description is as such: "The typing module was added to the standard library in Python 3.5 on a provisional basis and will no longer be provisional in Python 3.7. However,
 this means users of Python 3.5 - 3.6 who are unable to upgrade will not be able to take advantage of new types added to the typing module…"
 However, it’s been long that we are in python 3.7+ as it’s from focal+. So do you plan to backport netplan on even older versions, or is the description mistitled and actually, even more backport happened post 3.7?
- The current release is NOT packaged (4.4.0), which was released quite some months ago: Oct 7, 2022. Any idea when it will hit Debian to ensure this is still actively maintained?

[Duplication]
There is no other package in main providing the same functionality.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- python-typing-extensions checked with `check-mir`
- all dependencies can be found in `seeded-in-ubuntu` (already in main)
- none of the (potentially auto-generated) dependencies (Depends
 and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
OK:
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard
- Does not include vendored code

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats (files [images, video, audio,
  xml, json, asn.1], network packets, structures, ...) from
  an untrusted source.
- does not open a port/socket
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)

[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- does have a non-trivial test suite that runs as autopkgtest
- no new python2 dependency
- Python package, but using dh_python

[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- symbols tracking not applicable for this kind of code.
- d/watch is present and looks ok
- Upstream update history is good
- Debian/Ubuntu update history is good
- promoting this does ...

[Danilo Egea Gondolfo (danilogondolfo)]

Thanks for looking at that, Didier.

Answering your questions:

1)

The main purpose of the typing_extensions module is to allow older versions of Python to use new types introduced in newer versions.
We are not planning to backport the new netplan feature to older versions of Ubuntu. It's just an indirect dependency.

The thing is that Python doesn't have a module called typing_extensions and it is used in many places by markdown-it-py and rich:

markdown-it-py/markdown_it/renderer.py: from typing_extensions import Protocol # type: ignore[misc]
markdown-it-py/pyproject.toml: "typing_extensions>=3.7.4;python_version<'3.8'",
markdown-it-py/docs/conf.py: ("py:class", "typing_extensions.Protocol"),
rich/rich/console.py: from typing_extensions import (
rich/rich/align.py: from typing_extensions import Literal # pragma: no cover
rich/rich/emoji.py: from typing_extensions import Literal # pragma: no cover
rich/rich/box.py: from typing_extensions import Literal # pragma: no cover
rich/rich/progress.py: from typing_extensions import Literal # pragma: no cover
rich/rich/live_render.py: from typing_extensions import Literal # pragma: no cover
rich/rich/control.py: from typing_extensions import Final # pragma: no cover
rich/rich/_ratio.py: from typing_extensions import Protocol # pragma: no cover
rich/examples/top_lite_simulator.py: from typing_extensions import Literal

So we can't just not have it installed or it will break things.

There was a quick discussion about this a couple of years ago https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978536

2)

This package is not maintained by an individual but by the Debian Python Team. So I believe it's a matter of time until someone pick it up. As it's a dependency of many other packages I'd say they care for this package.
I will reach out and check if they are working on that.

[Didier Roche-Tolomelli (didrocks)]

on 1 -> Ack. The markdown-it-py is not a build time thing only but this is ran at runtime too? if this is more a linter part, we can keep it in universe, as a build-dependency only.

I did wait a little bit to see if you had an answer on 2), but it seems you don’t have it still, which is a little bit scary in term of long term maintainance.
Mind having some definitive answer? If the answer is positive, then, we can ACK/nACK it based on that answer? (I’m reverting the status to reflect that we are waiting on this).

[Danilo Egea Gondolfo (danilogondolfo)]

Hello again,

1) Yes, it's a runtime dependency.

2) Sorry, I should have updated this bug report. Debian has the newest version now and we also have it in proposed: https://launchpad.net/ubuntu/+source/python%2Dtyping%2Dextensions

[Didier Roche-Tolomelli (didrocks)]

Excellent news! However, it seems the new version is stuck in proposed as autopkgtests are now failing on all arch:

autopkgtest for python-typing-extensions/4.4.0-1: amd64: Regression ♻ , arm64: Regression ♻ , armhf: Regression ♻ , i386: Not a regression, ppc64el: Regression ♻ , s390x: Regression ♻
Also, it creates a regression on one of its deps, autopkgtests fails.

Once migrated, add the new dep from python3-rich on it and we can promote it.

[Danilo Egea Gondolfo (danilogondolfo)]

Right. Apparently it's failing due to the way the tests are executed. If I run them with pytest they work. I will look at that.

The numpy regression appears to be caused by a different problem though:

E: Unable to locate package libopenblas-base
openblas FAIL badpkg

[Lukas Märdian (slyon)]

> Once migrated, add the new dep from python3-rich on it and we can promote it.

python-typing-extensions 4.4.0 is now passing its tests and migrated to lunar-release. I just stubscribed ~foundations-bugs, too.

I think this is ready for promotion (it is already being pulled as a dependency in lunar-proposed).

[Didier Roche-Tolomelli (didrocks)]

Thanks for the feedback! And done:
$ ./change-override -c main -S python-typing-extensions
Override component to main
python-typing-extensions 4.4.0-1 in lunar: universe/misc -> main
python3-typing-extensions 4.4.0-1 in lunar amd64: universe/python/optional/100% -> main
python3-typing-extensions 4.4.0-1 in lunar arm64: universe/python/optional/100% -> main
python3-typing-extensions 4.4.0-1 in lunar armhf: universe/python/optional/100% -> main
python3-typing-extensions 4.4.0-1 in lunar i386: universe/python/optional/100% -> main
python3-typing-extensions 4.4.0-1 in lunar ppc64el: universe/python/optional/100% -> main
python3-typing-extensions 4.4.0-1 in lunar riscv64: universe/python/optional/100% -> main
python3-typing-extensions 4.4.0-1 in lunar s390x: universe/python/optional/100% -> main
Override [y|N]? y
8 publications overridden.

[Lukas Märdian (slyon)]

This package should probably be owned by the OpenStack team, due to their dependency chain. It's not used as any Foundations dependency anymore.

jaraco.text -> pyton-inflect -> pydantic -> python-typing-extensions

[Steve Langasek (vorlon)]

This doesn't look to me like the archive is ready to change, as there is no bug subscriber. Has the Openstack Team been asked to take this?

[James Page (james-page)]

$ ./subscribe-to-package.py --user ubuntu-openstack --package pydantic,python-typing-extensions,python-autocommand,python-inflect,jaraco.text
ubuntu-openstack is now subscribed to all bugs about pydantic.
ubuntu-openstack is now subscribed to all bugs about python-typing-extensions.
ubuntu-openstack is now subscribed to all bugs about python-autocommand.
ubuntu-openstack is now subscribed to all bugs about python-inflect.
ubuntu-openstack is now subscribed to all bugs about jaraco.text.

Bug subscriptions added.

[Christian Ehrhardt  (paelzer)]

Slyon:
> jaraco.text -> pyton-inflect -> pydantic -> python-typing-extensions

It also is now
alembic -> python-typing-extensions
which is also openstack

Subscription was done, package is listed under openstack in http://reqorts.qa.ubuntu.com/reports/m-r-package-team-mapping.html now.

Everything else was ready already, promoting back to main.

 python-typing-extensions | 4.7.1-2 | noble/universe | source

Override component to main
python-typing-extensions 4.7.1-2 in noble: universe/misc -> main
python3-typing-extensions 4.7.1-2 in noble amd64: universe/python/optional/100% -> main
python3-typing-extensions 4.7.1-2 in noble arm64: universe/python/optional/100% -> main
python3-typing-extensions 4.7.1-2 in noble armhf: universe/python/optional/100% -> main
python3-typing-extensions 4.7.1-2 in noble i386: universe/python/optional/100% -> main
python3-typing-extensions 4.7.1-2 in noble ppc64el: universe/python/optional/100% -> main
python3-typing-extensions 4.7.1-2 in noble riscv64: universe/python/optional/100% -> main
python3-typing-extensions 4.7.1-2 in noble s390x: universe/python/optional/100% -> main
Override [y|N]? y
8 publications overridden.