Debian Bug report logs - #960869
python3: python package does not depend on ca-certificates

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Christian Heimes <christian@python.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: python3: python package does not depend on ca-certificates

Date: Sun, 17 May 2020 18:23:29 +0000

Package: python3
Version: 3.7.3-1
Severity: important

Dear Maintainer,

Python has no dependency on ca-certificates. Installing Python on a
minimal Debian or Ubuntu container image does not pull in ca-certificates.
This results in certificate validation issues as no trust anchors are
available. Python's ssl module and ssl.create_default_context() depend
on default root CA packages being available.

Reproducer:

# docker run -ti debian:buster /bin/bash
# apt-get update
# apt-get install python3
# ls -la /etc/ssl/certs/ca-certificates.crt
ls: cannot access '/etc/ssl/certs/ca-certificates.crt': No such file or directory
# dpkg -l ca-certificates
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name            Version      Architecture Description
+++-===============-============-============-=================================
un  ca-certificates <none>       <none>       (no description available)

Proposed solution:
Either all Python interpreter packages or libssl should pull in
ca-certificates.

Christian

-- System Information:
Debian Release: 10.4
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.6.11-300.fc32.x86_64 (SMP w/8 CPU cores)
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages python3 depends on:
ii  libpython3-stdlib  3.7.3-1
ii  python3-minimal    3.7.3-1
ii  python3.7          3.7.3-2+deb10u1

python3 recommends no packages.

Versions of packages python3 suggests:
pn  python3-doc   <none>
pn  python3-tk    <none>
pn  python3-venv  <none>

-- no debconf information

Message #10 received at 960869-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 960869-close@bugs.debian.org

Subject: Bug#960869: fixed in python3.11 3.11.2-3

Date: Fri, 10 Feb 2023 05:22:04 +0000

Source: python3.11
Source-Version: 3.11.2-3
Done: Matthias Klose <doko@debian.org>

We believe that the bug you reported is fixed in the latest version of
python3.11, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 960869@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Matthias Klose <doko@debian.org> (supplier of updated python3.11 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 10 Feb 2023 05:59:34 +0100
Source: python3.11
Architecture: source
Version: 3.11.2-3
Distribution: unstable
Urgency: medium
Maintainer: Matthias Klose <doko@debian.org>
Changed-By: Matthias Klose <doko@debian.org>
Closes: 960869 1009189 1026802
Changes:
 python3.11 (3.11.2-3) unstable; urgency=medium
 .
   [ Stefano Rivera ]
   * Refresh patches.
   * Revert pip importlib.metadata workaround, fixed in pip 22.2.
   * Declare python3.11 to be PEP 668 EXTERNALLY-MANAGED.
   * Update and install README.venv, explaining this.
   * Recommend ca-certificates from python3.11. Closes: #960869.
   * Configure --with-ssl-default-suites=openssl. Closes: #1026802.
   * Update watch file.
   * Include CCSHARED override in distutils test_customize_compiler.
 .
   [Matthias Klose]
   * Really new upstream version.
   * Configure --with-ssl-default-suites=openssl. Closes: #1009189.
   * Build-depend on libb2-dev.
   * Fix removing Debian build flags from _sysconfigdata. LP: #2006738.
Checksums-Sha1:
 c9d3ce7155d1f4524cb8a6a70f16d3e4349d2758 3643 python3.11_3.11.2-3.dsc
 3f561c6768d83b2891ee115639a5770fa647ed42 212616 python3.11_3.11.2-3.debian.tar.xz
 8f96fae2f9b86b843a24c7be6997ed677786140c 10119 python3.11_3.11.2-3_source.buildinfo
Checksums-Sha256:
 51f6a5b586405f7ba58277caf311925d24dbbd3ca55388d8d7aa33779be9f3c5 3643 python3.11_3.11.2-3.dsc
 f1a9bb6451dbb39816dd74c9ddcf39bed33d52864902842f7382f333337d1fa1 212616 python3.11_3.11.2-3.debian.tar.xz
 81254d87d6167671c7f4f673aca2c87d8c12614f271dc6cd0bd9fab88e4bc4f4 10119 python3.11_3.11.2-3_source.buildinfo
Files:
 36fea41b53ce93aa75b1e49063bb428b 3643 python optional python3.11_3.11.2-3.dsc
 8524d5c31fd8cb7cce938851901c26e8 212616 python optional python3.11_3.11.2-3.debian.tar.xz
 7b291492e48693901cdaa87c8c07394f 10119 python optional python3.11_3.11.2-3_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJEBAEBCgAuFiEE1WVxuIqLuvFAv2PWvX6qYHePpvUFAmPlz8QQHGRva29AZGVi
aWFuLm9yZwAKCRC9fqpgd4+m9b1GEADK5dNZLdHxleNUG/eV5JR8ITMHcCkme+uG
Kxqdot8U1fTPXxQyk4rDB/xkujetz0gsHI7jGmuUbAtHwDeDL/uZPI5sv6kS7MKx
g85EcCchsFfw5d0zN7wN1mxYHe7nDQHZMncw0X4Gcx2hcF1imO9LbngHqP7ivtat
8qkk0O3xe5yZGc/HFXmc1MnjCcdhuPvHdRow+O8DVCpVyx5b6M0CVsEpFzNUANza
Hv6PYEPk6uvSS9CuyeBcRI2j1xJ5dMZjB3/r8QntCgCe9zdDUluYcqr8hVT6L8MK
dNT0QBRD1HHO4+MuBMnXa5V+CDltDPDD9qArDV7OOsog5MLkOuRvM5CjOcdGAINj
8973gZwUGUB89FLAgdAHOoijaEg/ZGE+CLhbohUT3/fAHQQyscxiF7j3lh9OOg1/
sgF9HKkjOKzNgevR21dZ8VQk3EkHhsDtEWvm03P39PpyAhL6gxB1zR1oqr3yo/Z5
zGVS6NIgHmB9lzRUbn0aQZbL9JN8pFF7EMaRRnD1VHQdMQDxhoxdwyUbJ6fojLsS
G3B0gKuR905B8NdsXBlMIcBJqWHIADLiLlwe7K5L2EaaDGPrVCjDymMsgddH8jKb
uRlLGU9VY8YX42Q1up+Nt/9nXu/9bp4a008u5Lz1CxKxGwLgYjUnOD72r2tucBVt
rX5166XQLA==
=llwt
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.