Debian Bug report logs - #628678
lintian: Please check that setup.py and debian/changelog have same version

Reply or subscribe to this bug.

Display info messages

Message #5 received at [email protected] (full text, mbox, reply):

From: Lars Wirzenius <[email protected]>

To: Debian Bug Tracking System <[email protected]>

Subject: devscripts: tool to verify setup.py and debian/changelog have same (upstream) version

Date: Tue, 31 May 2011 10:24:48 +0100

Package: devscripts
Version: 2.10.69+squeeze1
Severity: wishlist

Python programs typically contain a setup.py script, which does
all sorts of magic. Some additional magic from Debian then turns
the first magic into a proper Debian package, following the Debian
Python policy.

setup.py includes the upstream version number. When updating
a package it is sadly very easy to forget updating debian/changelog,
resulting in some confusion to users.

A tool such as the shell script below would be nice to include
in devscripts to automate a check that the version numbers match.
I run such a tool from debian/rules, but it would be possible to
run it also from the command line.

-- 8< -- 8< -- 8< --
#!/bin/sh
v1="$(python setup.py --version)"
v2="$(dpkg-parsechangelog | awk '/^Version:/ { print $2 }' | sed 's/-[^-]*$//')"

if [ "$v1" != "$v2" ]
then
    echo "setup.py report version $v1" 1>&2
    echo "debian/changelog reports version $v2" 1>&2
    echo "they do not match!"
    exit 1
fi
-- 8< -- 8< -- 8< --

(I do not actually consider this to be copyrightable, but any
free license that the devscripts maintainers like is OK with me.)


-- Package-specific info:

--- /etc/devscripts.conf ---

--- ~/.devscripts ---
DEBSIGN_KEYID=5E8511F9 

-- System Information:
Debian Release: 6.0.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages devscripts depends on:
ii  dpkg-dev                      1.15.8.10  Debian package development tools
ii  libc6                         2.11.2-10  Embedded GNU C Library: Shared lib
ii  perl                          5.10.1-17  Larry Wall's Practical Extraction 

Versions of packages devscripts recommends:
ii  at                 3.1.12-1              Delayed job execution and batch pr
ii  bsd-mailx [mailx]  8.1.2-0.20100314cvs-1 simple mail user agent
ii  bzr                2.1.2-1               easy to use distributed version co
ii  curl               7.21.0-1              Get a file from an HTTP, HTTPS or 
ii  dctrl-tools        2.14.5                Command-line tools to process Debi
ii  debian-keyring [de 2010.12.29            GnuPG keys of Debian Developers
ii  dput               0.9.6.1               Debian package upload tool
ii  epiphany-browser [ 2.30.6-1              Intuitive GNOME web browser
ii  equivs             2.0.8                 Circumvent Debian package dependen
ii  fakeroot           1.14.4-1              Gives a fake root environment
ii  git [git-core]     1:1.7.2.5-1           fast, scalable, distributed revisi
ii  gnupg              1.4.10-4              GNU privacy guard - a free PGP rep
ii  iceweasel [www-bro 3.5.16-7              Web browser based on Firefox
ii  libauthen-sasl-per 2.1500-1              Authen::SASL - SASL Authentication
ii  libcrypt-ssleay-pe 0.57-2                Support for https protocol in LWP
ii  libjson-perl       2.21-1                Perl module to parse and convert t
ii  libparse-debcontro 2.005-2               Easy OO parsing of Debian control-
ii  libsoap-lite-perl  0.712-2               Perl implementation of a SOAP clie
ii  libterm-size-perl  0.2-4+b1              Perl extension for retrieving term
ii  libtimedate-perl   1.2000-1              collection of modules to manipulat
ii  liburi-perl        1.54-2                module to manipulate and access UR
ii  libwww-perl        5.836-1               Perl HTTP/WWW client/server librar
ii  libyaml-syck-perl  1.12-1                Perl module providing a fast, ligh
ii  lintian            2.4.3                 Debian package checker
ii  lsb-release        3.2-23.2squeeze1      Linux Standard Base version report
ii  lzma               4.43-14               Compression method of 7z format in
ii  man-db             2.5.7-8               on-line manual pager
ii  openssh-client [ss 1:5.5p1-6             secure shell (SSH) client, for sec
ii  patch              2.6-2                 Apply a diff file to an original
ii  patchutils         0.3.1-2               Utilities to work with patches
ii  sensible-utils     0.0.4                 Utilities for sensible alternative
ii  strace             4.5.20-2              A system call tracer
ii  subversion         1.6.12dfsg-5          Advanced version control system
ii  unzip              6.0-4                 De-archiver for .zip files
ii  w3m [www-browser]  0.5.2-9               WWW browsable pager with excellent
ii  wdiff              0.6.3-1               Compares two files word by word
ii  wget               1.12-2.1              retrieves files from the web
ii  xz-utils           5.0.0-2               XZ-format compression utilities

Versions of packages devscripts suggests:
ii  build-essential        11.5              Informational list of build-essent
pn  cvs-buildpackage       <none>            (no description available)
pn  devscripts-el          <none>            (no description available)
ii  gnuplot                4.4.0-1.1         A command-line driven interactive 
pn  libfile-desktopentry-p <none>            (no description available)
pn  libnet-smtp-ssl-perl   <none>            (no description available)
ii  mutt                   1.5.20-9+squeeze1 text-based mailreader supporting M
pn  svn-buildpackage       <none>            (no description available)
ii  w3m                    0.5.2-9           WWW browsable pager with excellent

-- no debconf information

Message #22 received at [email protected] (full text, mbox, reply):

From: Niels Thykier <[email protected]>

To: [email protected], Lars Wirzenius <[email protected]>

Subject: Re: lintian: please check that setup.py and debian/changelog have same version

Date: Sat, 04 Jun 2011 22:57:20 +0200

Hey

Personally I feel that running setup.py code inside the package is a
"no-go" for Lintian;  perhaps there is another way we can "trivially"
extract it from setup.py?

~Niels

Message #27 received at [email protected] (full text, mbox, reply):

From: Lars Wirzenius <[email protected]>

To: Niels Thykier <[email protected]>

Cc: [email protected]

Subject: Re: lintian: please check that setup.py and debian/changelog have same version

Date: Sat, 4 Jun 2011 23:15:59 +0100

On Sat, Jun 04, 2011 at 10:57:20PM +0200, Niels Thykier wrote:
> Personally I feel that running setup.py code inside the package is a
> "no-go" for Lintian;  perhaps there is another way we can "trivially"
> extract it from setup.py?

Not running code is a very good point. Unfortunately, there is no
other portable way, since the setup.py code may be executing code
to extract the version number from elsewhere (and frequently does,
for my own packages: "import foo" and then using foo.__version__
for the version number).

So I guess this is not an appropriate check for lintian after all.

-- 
Freedom-based blog/wiki/web hosting: http://www.branchable.com/

Message #34 received at [email protected] (full text, mbox, reply):

From: Jakub Wilk <[email protected]>

To: Lars Wirzenius <[email protected]>, [email protected]

Subject: Re: Bug#628678: lintian: please check that setup.py and debian/changelog have same version

Date: Mon, 19 Sep 2011 14:35:10 +0200

* Lars Wirzenius <[email protected]>, 2011-06-04, 23:15:
>>Personally I feel that running setup.py code inside the package is a 
>>"no-go" for Lintian;  perhaps there is another way we can "trivially" 
>>extract it from setup.py?
>
>Not running code is a very good point. Unfortunately, there is no other 
>portable way, since the setup.py code may be executing code to extract 
>the version number from elsewhere (and frequently does, for my own 
>packages: "import foo" and then using foo.__version__ for the version 
>number).

However, this piece of metadata often ends up in the binary package, 
where lintian could read it easily. I implemented a check for this in my 
lintian-like application:
https://bitbucket.org/jwilk/lintian4python/src/3b171d8ed0e8/checks/egg-info
https://bitbucket.org/jwilk/lintian4python/src/3b171d8ed0e8/checks/egg-info.desc
The check is written in a very defensive way so that there are almost no 
false-positives, yet number of true positives is surprisingly high (a 
few dozens IIRC).

If someone (hint, hint) contributes a better tag description, and 
possibly a better name than egg-info-version-mismatch, I can port this 
code to lintian proper.

-- 
Jakub Wilk

Message #39 received at [email protected] (full text, mbox, reply):

From: Niels Thykier <[email protected]>

To: Lars Wirzenius <[email protected]>, [email protected]

Subject: Re: Bug#628678: lintian: please check that setup.py and debian/changelog have same version

Date: Mon, 22 Jul 2013 13:34:16 +0200

Control: tags -1 -wontfix

On 2011-09-19 14:35, Jakub Wilk wrote:
> * Lars Wirzenius <[email protected]>, 2011-06-04, 23:15:
>>> Personally I feel that running setup.py code inside the package is a
>>> "no-go" for Lintian;  perhaps there is another way we can "trivially"
>>> extract it from setup.py?
>>
>> Not running code is a very good point. Unfortunately, there is no
>> other portable way, since the setup.py code may be executing code to
>> extract the version number from elsewhere (and frequently does, for my
>> own packages: "import foo" and then using foo.__version__ for the
>> version number).
> 
> However, this piece of metadata often ends up in the binary package,
> where lintian could read it easily. I implemented a check for this in my
> lintian-like application:
> https://bitbucket.org/jwilk/lintian4python/src/3b171d8ed0e8/checks/egg-info
> https://bitbucket.org/jwilk/lintian4python/src/3b171d8ed0e8/checks/egg-info.desc
> 
> The check is written in a very defensive way so that there are almost no
> false-positives, yet number of true positives is surprisingly high (a
> few dozens IIRC).
> 
> If someone (hint, hint) contributes a better tag description, and
> possibly a better name than egg-info-version-mismatch, I can port this
> code to lintian proper.
> 

Indeed that check looks reasonable.  If someone can supply a patch for
it (with tag description and tests), I will gladly review it.

~Niels

Send a report that this bug log contains spam.