Bug#889836: Embedded code copy of python-magic

Gianfranco Costamagna locutusofborg at debian.org
Wed Feb 21 11:31:59 UTC 2018


Hello,

>-> and now he is trying to force his own TRUE version for a simple wrapper.
>Case closed


I agree with upstream here, you are trying to push something that upstream/magic didn't even
merge in master yet, so the upstream/sqlmap is correct, this breaks probably other linux distro.
>Note: It is Adam Hupp, the author of the magic bindings that *sqlmap* *uses*,
>who thankfully is implementing this change.


yes, but *before* he should release a new stable version, with the compatibility layer,
and then I think the sqlmap implementation will sync, and a patch will be trivially applicable.
>, but anyway I think you could still apply your really non-invasive patch in
>Debian. If anything *should* break, it can be removed within seconds. But you
>had tried to comply a little bit more with policy. FTR diff attached between
>current magic in sqlmap vs. current magic [1].


This would break older debian/ubuntu, where python-magic still points to the other implementation,
since this is an arch:all package, I don't want to break people grabbing the debian around the various
mirrors.

I propose to followup with sqlmap upstream folks, because I'm still not a python-savvy man.

In any case, a new python-magic release, with pip release, packaged by many distro and so on, will
make this simpler, for us, sqlmap and other folks (I can enforce a runtime version on the deb file, 
if we find an *upstream/magic* common version that can be used by everyone).

Hopefully doing things in a correct way will make me/sqlmap folks able to merge a future patch...

I hope you agree with this point.

Gianfranco



More information about the Pkg-security-team mailing list