[Bug 1977645] Re: python3-gpg 1.16.0-unknown version is incomparable, dependencies always fail

Wed Feb 22 15:32:23 UTC 2023

Trying to install additional pip/pip3 packages fails due to invalid
version of python3-gpg.

----------

Platform: Ubuntu 20.04 (Focal)
----------
Package: python3-gpg
Version: 1.13.1-7ubuntu2
Priority: optional
Section: python
Source: gpgme1.0
Origin: Ubuntu
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Original-Maintainer: Debian GnuPG Maintainers <pkg-gnupg-maint at lists.alioth.debian.org>
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Installed-Size: 1,110 kB
Provides: python3.8-gpg
Depends: python3 (<< 3.9), python3 (>= 3.8~), python3:any, libc6 (>= 2.14), libgpgme11 (>= 1.12.0)
Homepage: https://www.gnupg.org/related_software/gpgme/
Task: samba-server, kubuntu-desktop, kubuntu-full, ubuntukylin-desktop, ubuntu-mate-core, ubuntu-mate-desktop
Download-Size: 165 kB
APT-Manual-Installed: no
APT-Sources: http://archive.ubuntu.com/ubuntu focal/main amd64 Packages
Description: Python interface to the GPGME GnuPG encryption library (Python 3)
---------
Installed as dependency of python3-rosinstall:

#apt install python3-rosinstall
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  brz bzr git git-man less libapr1 libaprutil1 libcurl3-gnutls liberror-perl libgpgme11 libpython2-stdlib libpython2.7-minimal libpython2.7-stdlib libserf-1-1 libsvn1 libutf8proc2 mercurial
  mercurial-common python2 python2-minimal python2.7 python2.7-minimal python3-blinker python3-breezy python3-catkin-pkg python3-cffi-backend python3-configobj python3-cryptography
  python3-deprecated python3-dulwich python3-entrypoints python3-fastimport python3-github python3-gitlab python3-gpg python3-httplib2 python3-jwt python3-keyring python3-launchpadlib
  python3-lazr.restfulclient python3-lazr.uri python3-oauthlib python3-rosdistro python3-rosdistro-modules python3-rospkg python3-rospkg-modules python3-secretstorage python3-simplejson
  python3-vcstools python3-wadllib python3-wrapt python3-wstool subversion

--------

command: pip install -y gcovr cobertura-clover-transform
output:
ERROR: Exception:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/pip/_internal/cli/base_command.py", line 186, in _main
    status = self.run(options, args)
  File "/usr/lib/python3/dist-packages/pip/_internal/commands/install.py", line 357, in run
    resolver.resolve(requirement_set)
  File "/usr/lib/python3/dist-packages/pip/_internal/legacy_resolve.py", line 177, in resolve
    discovered_reqs.extend(self._resolve_one(requirement_set, req))
  File "/usr/lib/python3/dist-packages/pip/_internal/legacy_resolve.py", line 333, in _resolve_one
    abstract_dist = self._get_abstract_dist_for(req_to_install)
  File "/usr/lib/python3/dist-packages/pip/_internal/legacy_resolve.py", line 270, in _get_abstract_dist_for
    skip_reason = self._check_skip_installed(req)
  File "/usr/lib/python3/dist-packages/pip/_internal/legacy_resolve.py", line 228, in _check_skip_installed
    req_to_install.check_if_exists(self.use_user_site)
  File "/usr/lib/python3/dist-packages/pip/_internal/req/req_install.py", line 443, in check_if_exists
    self.satisfied_by = pkg_resources.get_distribution(str(no_marker))
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 514, in get_distribution
    dist = get_provider(dist)
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 386, in get_provider
    return working_set.find(moduleOrReq) or require(str(moduleOrReq))[0]
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 956, in require
    needed = self.resolve(parse_requirements(requirements))
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 815, in resolve
    dist = self._resolve_dist(
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 844, in _resolve_dist
    env = Environment(self.entries)
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 1044, in __init__
    self.scan(search_path)
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 1077, in scan
    self.add(dist)
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 1096, in add
    dists.sort(key=operator.attrgetter('hashcmp'), reverse=True)
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 2640, in hashcmp
    self.parsed_version,
  File "/usr/local/lib/python3.8/dist-packages/pkg_resources/__init__.py", line 2694, in parsed_version
    raise packaging.version.InvalidVersion(f"{str(ex)} {info}") from None
pkg_resources.extern.packaging.version.InvalidVersion: Invalid version: '1.13.1-unknown' (package: gpg)

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gpgme1.0 in Ubuntu.
https://bugs.launchpad.net/bugs/1977645

Title:
  python3-gpg 1.16.0-unknown version is incomparable, dependencies
  always fail

Status in gpgme1.0 package in Ubuntu:
  Confirmed
Status in gpgme1.0 package in Debian:
  Fix Released

Bug description:
  The python version of the gpgme version contains "unknown" and is
  therefore not PEP440 order compatible.

  See this example:

    # pip3 freeze | grep gpg
    gpg===1.16.0-unknown

    # pip3 install pstore
    ...
    Successfully installed gpg-1.10.0
    Successfully installed pstore-2.0.0

    # pip3 freeze | grep gpg
    gpg==1.10.0

  Key takeways from that example:

  - pstore depends on gpg>=1.10

  - 1.16 SHOULD be higher than 1.10

  - pip installs 1.10 even though 1.16 exists

  - the triple-= (gpg===1.16.0-unknown) means that the version exists,
  but cannot be version compared:
  https://peps.python.org/pep-0440/#arbitrary-equality

  Suggested fix:

  - replace the '-' from `gpgme-config --version` "1.16.0-unknown" with
  a '+'; that will compare as expected;

  - fix so "-unknown" isn't appended.

  Apparently, this is caused by insufficient fixes in 0001-avoid-identifying-as-beta.patch

  I've attached a FIXED version, which should fix things.

  Before:

    $ autoreconf -ivf

    $ grep Generated.*gpgme configure
    # Generated by GNU Autoconf 2.71 for gpgme 1.16.0-unknown.

  After:

    $ quilt push 
    Applying patch 0001-avoid-identifying-as-beta-FIXED.patch

    $ autoreconf -ivf

    $ grep Generated.*gpgme configure
    # Generated by GNU Autoconf 2.71 for gpgme 1.16.0.

  Versions:

  $ lsb_release -a 2>/dev/null| grep Codename
  Codename:	jammy

  $ apt-cache policy python3-gpg  | grep Installed
    Installed: 1.16.0-1.2ubuntu4

  Cheers,
  Walter Doekes
  OSSO B.V.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gpgme1.0/+bug/1977645/+subscriptions