[Git][security-tracker-team/security-tracker][master] 7 commits: lib/python: delete more Python 2 support

Emilio Pozuelo Monfort (@pochu) pochu at debian.org
Fri Feb 13 09:28:23 GMT 2026



Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c8e823cc by Helmut Grohne at 2026-02-12T09:54:45+01:00
lib/python: delete more Python 2 support

On Python 3.x, unicode is not a global. Hence these branches would
always raise a NameError before running isinstance. Do away with this as
Python 2 is unsupported since at least 2020.

- - - - -
0a376dd4 by Helmut Grohne at 2026-02-12T09:55:03+01:00
delete helpers.py

The only function left in helpers.py was isstring. The way it was
implemented was trying basestring first, thereby raising a NameError on
Python 3.x and then trying str. Since Python 2.x is no longer supported
since 2020 and isstring is used a lot, inline it as isinstance(...,
str), which is the standard way. It also is well understood by type
checkers such as mypy.

- - - - -
09fbf74b by Helmut Grohne at 2026-02-12T09:55:27+01:00
Python: drop fallback imports before bookworm

All of the relevant modules exist on Python 3.11 (bookworm) already.

- - - - -
b059b833 by Helmut Grohne at 2026-02-12T09:55:38+01:00
security_db: drop unnecessary unicode prefixes from test

This is another aspect of dropping support for Python 2.x.

- - - - -
1e4cb7ed by Helmut Grohne at 2026-02-12T09:55:47+01:00
bin: update python2 #! to python3

- - - - -
72c3c320 by Helmut Grohne at 2026-02-12T09:55:57+01:00
python: drop __future__ import of print_function

- - - - -
3eff1b47 by Emilio Pozuelo Monfort at 2026-02-13T09:28:18+00:00
Merge branch 'cleanup' into 'master'

clean up support for Python versions before bookworm

See merge request security-tracker-team/security-tracker!266
- - - - -


10 changed files:

- bin/apt-update-file
- bin/mass-bug-filer
- bin/secmaster.py
- bin/update-db
- lib/python/bugs.py
- lib/python/debian_support.py
- − lib/python/helpers.py
- lib/python/sectracker/diagnostics.py
- lib/python/security_db.py
- lib/python/web_support.py


Changes:

=====================================
bin/apt-update-file
=====================================
@@ -1,7 +1,6 @@
 #!/usr/bin/python3
 
 # This script is mainly used to demo the updateFile function.
-from __future__ import print_function
 import sys
 
 import setup_paths


=====================================
bin/mass-bug-filer
=====================================
@@ -1,5 +1,4 @@
-#!/usr/bin/python2
-from __future__ import print_function
+#!/usr/bin/python3
 
 import sys
 import apt


=====================================
bin/secmaster.py
=====================================
@@ -1,4 +1,4 @@
-#!/usr/bin/python2
+#!/usr/bin/python3
 # secmaster -- access to data on security-master.debian.org
 # Copyright (C) 2011 Florian Weimer <fw at deneb.enyo.de>
 # 
@@ -15,7 +15,6 @@
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-from __future__ import print_function
 
 # Name of the security-master host
 HOST = "seger.debian.org"


=====================================
bin/update-db
=====================================
@@ -1,5 +1,4 @@
 #!/usr/bin/python3
-from __future__ import print_function
 
 import os
 import sys


=====================================
lib/python/bugs.py
=====================================
@@ -21,8 +21,6 @@ import os
 import re
 import hashlib
 
-from helpers import isstring
-
 class Urgency(debian_support.PseudoEnum): pass
 
 def listUrgencies():
@@ -56,19 +54,19 @@ class PackageNote:
     def __init__(self, package, fixed_version, release, urgency):
         self.id = None
         self.package = package
-        if (isstring(fixed_version)):
+        if isinstance(fixed_version, str):
             self.fixed_version = debian_support.Version(fixed_version)
         else:
             self.fixed_version = fixed_version
         if release == '':
             self.release = None
         else:
-            if isstring(release):
+            if isinstance(release, str):
                 release = debian_support.internRelease(release)
                 if release is None:
                     raise ValueError("invalid release")
             self.release = release
-        if isstring(urgency):
+        if isinstance(urgency, str):
             urgency = internUrgency(urgency)
         if urgency is None:
             raise ValueError("invalid urgency")
@@ -166,13 +164,13 @@ class PackageNoteParsed(PackageNote):
 
 class PackageNoteNoDSA:
     def __init__(self, package, release, comment, reason=None):
-        assert isstring(package) and package != ''
-        assert isstring(release) and release != ''
-        assert isstring(comment)
+        assert isinstance(package, str) and package != ''
+        assert isinstance(release, str) and release != ''
+        assert isinstance(comment, str)
         if not reason:
             reason = ''
         else:
-            assert isstring(reason)
+            assert isinstance(reason, str)
         self.package = package
         release = debian_support.internRelease(release)
         if release is None:
@@ -194,7 +192,7 @@ class BugBase:
     re_cve_name = re.compile(r'^CVE-\d{4}-\d{4,}$')
 
     def __init__(self, fname, lineno, date, name, description, comments):
-        assert isstring(fname)
+        assert isinstance(fname, str)
         lineno = to_integer(lineno)
         self.source_file = fname
         self.source_line = lineno
@@ -269,7 +267,7 @@ class Bug(BugBase):
         for n in notes:
             assert isinstance(n, PackageNote) \
                    or isinstance(n, PackageNoteNoDSA)
-        assert len(xref) == 0 or isstring(xref[0])
+        assert len(xref) == 0 or isinstance(xref[0], str)
         assert isinstance(not_for_us, bool)
         BugBase.__init__(self, fname, lineno, date, name,
                          description, comments)
@@ -303,7 +301,7 @@ class Bug(BugBase):
 
 class BugFromDB(Bug):
     def __init__(self, cursor, name):
-        assert isstring(name)
+        assert isinstance(name, str)
 
         def lookup(bug):
             for r in cursor.execute('SELECT * FROM bugs WHERE name = ?',


=====================================
lib/python/debian_support.py
=====================================
@@ -14,7 +14,6 @@
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-from __future__ import print_function
 
 """This module implements facilities to deal with Debian-specific metadata."""
 
@@ -25,26 +24,10 @@ import os.path
 import re
 import sys
 import tempfile
-
-try:
-    from urllib.request import urlopen
-    from urllib.error import URLError
-except ImportError:
-    from urllib2 import urlopen
-    from urllib2.error import URLError
-
-try:
-    from cStringIO import StringIO as streamIO
-except ImportError:
-    from io import BytesIO as streamIO
-
-from helpers import isstring
-
-try:
-    from hashlib import sha1
-except ImportError:
-    import sha
-    sha1 = sha.new
+from urllib.request import urlopen
+from urllib.error import URLError
+from io import BytesIO as streamIO
+from hashlib import sha1
 
 import apt_pkg
 apt_pkg.init()
@@ -95,13 +78,7 @@ class Version:
 
     def __init__(self, version):
         """Creates a new Version object."""
-        try:
-            if isinstance(version, unicode):
-                version = version.encode('UTF-8')
-        except:
-            pass
-
-        assert isstring(version), repr(version)
+        assert isinstance(version, str), repr(version)
         assert version != ""
         self.__asString = version
         self.__forCompare = _version_normalize_regexp.sub("", version)
@@ -164,7 +141,7 @@ class PackageFile:
     def readline(self):
         line = self.file.readline()
 
-        if line != None and not isstring(line):
+        if line != None and not isinstance(line, str):
             line = line.decode('utf-8')
 
         return line


=====================================
lib/python/helpers.py deleted
=====================================
@@ -1,7 +0,0 @@
-# helpers.py -- utility functions that don't belong elsewhere
-
-def isstring(s):
-    try:
-        return isinstance(s, basestring)
-    except NameError:
-        return isinstance(s, str)


=====================================
lib/python/sectracker/diagnostics.py
=====================================
@@ -17,12 +17,10 @@
 
 from collections import namedtuple as _namedtuple
 
-from helpers import isstring
-
 Message = _namedtuple("Message", "file line level message")
 
 def _checkfile(file):
-    if not isstring(file):
+    if not isinstance(file, str):
         raise ValueError("file name is not a string: " + repr(file))
     return file
 


=====================================
lib/python/security_db.py
=====================================
@@ -14,7 +14,6 @@
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-from __future__ import print_function
 
 """This module implements a small database for tracking security bugs.
 
@@ -47,8 +46,6 @@ import config
 import debian_support
 from debian_support import PointUpdateParser
 
-from helpers import isstring
-
 class InsertError(Exception):
     """Class for capturing insert errors.
 
@@ -65,12 +62,12 @@ class InsertError(Exception):
 
 def mergeLists(a, b):
     """Merges two lists."""
-    if isstring(a):
+    if isinstance(a, str):
         if a == "":
             a = []
         else:
             a = a.split(',')
-    if isstring(b):
+    if isinstance(b, str):
         if b == "":
             b = []
         else:
@@ -2378,12 +2375,12 @@ f"""SELECT DISTINCT source_package_status.bug_name, source_packages.name
             print("  architecture:", architecture)
 
 def test():
-    assert mergeLists(u'',u'') == [], mergeLists(u'', u'')
-    assert mergeLists(u'', []) == []
-    assert mergeLists(u'a', u'a') == [u'a']
-    assert mergeLists(u'a', u'b') == [u'a', u'b']
-    assert mergeLists(u'a,c', u'b') == [u'a', u'b', 'c']
-    assert mergeLists(u'a,c', [u'b', u'de']) == [u'a', u'b', u'c', u'de']
+    assert mergeLists('','') == [], mergeLists('', '')
+    assert mergeLists('', []) == []
+    assert mergeLists('a', 'a') == ['a']
+    assert mergeLists('a', 'b') == ['a', 'b']
+    assert mergeLists('a,c', 'b') == ['a', 'b', 'c']
+    assert mergeLists('a,c', ['b', 'de']) == ['a', 'b', 'c', 'de']
 
     import os
     db_file = 'test_security.db'


=====================================
lib/python/web_support.py
=====================================
@@ -24,30 +24,11 @@ import sys
 import grp
 import traceback
 import threading
-
-try:
-    from urllib import quote as urllib_quote
-except ImportError:
-    from urllib.parse import quote as urllib_quote
-
-try:
-    from cgi import parse_qs
-except ImportError:
-    from urllib.parse import parse_qs
-
-try:
-    from SocketServer import ThreadingMixIn
-    from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
-except ImportError:
-    from socketserver import ThreadingMixIn
-    from http.server import HTTPServer, BaseHTTPRequestHandler
-
-try:
-    from cStringIO import StringIO
-except ImportError:
-    from io import StringIO
-
-from helpers import isstring
+from urllib.parse import quote as urllib_quote
+from urllib.parse import parse_qs
+from socketserver import ThreadingMixIn
+from http.server import HTTPServer, BaseHTTPRequestHandler
+from io import StringIO
 
 class ServinvokeError(Exception):
     pass
@@ -295,7 +276,7 @@ class Compose(HTMLBase):
 
     def flatten(self, write):
         for x in self.__contents:
-            if isstring(x):
+            if isinstance(x, str):
                 write(escapeHTML(x))
             else:
                 x.flatten(write)
@@ -342,7 +323,7 @@ class Tag(HTMLBase):
             closing = "</%s>" % self.__name
             try:
                 for x in self.contents:
-                    if isstring(x):
+                    if isinstance(x, str):
                         write(escapeHTML(x))
                     else:
                         x.flatten(write)
@@ -679,15 +660,7 @@ class HTMLResult(Result):
         buf = StringIO()
         buf.write(self.doctype)
         buf.write('\n')
-        def write_both(s):
-            try:
-                if isinstance(s, unicode):
-                    s = s.encode('UTF-8')
-            except:
-                pass
-            finally:
-                buf.write(s)
-        self.contents.flatten(write_both)
+        self.contents.flatten(buf.write)
         buf = buf.getvalue()
         buf = maybe_encode(buf)
         self.headers['Content-Length'] = str(len(buf))



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/28e2baa5f3afda77614c5a6be86a6d23484f7231...3eff1b47a6cac06c7c4530a5b592b3ca37556bfc

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/28e2baa5f3afda77614c5a6be86a6d23484f7231...3eff1b47a6cac06c7c4530a5b592b3ca37556bfc
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260213/cbb11c8a/attachment-0001.htm>


More information about the debian-security-tracker-commits mailing list