[Tts-project] Bug#838665: /usr/lib/python3/dist-packages/speechd_config/config.py: runs argparse on Python module import

[Dominik George]

Package: python3-speechd
Version: 0.8.5-1
Severity: critical
File: /usr/lib/python3/dist-packages/speechd_config/config.py
Justification: breaks unrelated software

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

The speechd_config.config module in the Python API breaks software that
imports all installed Python modules, e.g. for iterating over them and
listing them, or doing other stuff that should not be too harmful.

The Options class runs argparse on __init__, thus consuming all
arguments of the importing script and trying to parse them as
speechd_config command-line options.

As a fun note, this leads to unrelated Python software exiting with
something like this if it in turn tries to use argparse itself:

Usage: your-unrelated-python-program [options]
A simple dialog based tool for basic configuration of Speech Dispatcher
and problem diagnostics.

Simply importing a module in Python must never have any side effects on
the importing code!


The issue is well-known, and noone seems to feel responsible for fixing it:

https://bugs.archlinux.org/task/40478
https://its.freebsoft.org/its/issues/29268
https://sourceforge.net/p/plone/mailman/message/27434223/


Please get upstream to fix this issue, fix it in a Debian patch, or
remove speech-dispatcher from Debian.

- -- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/lksh
Init: systemd (via /run/systemd/system)

Versions of packages python3-speechd depends on:
ii  python3-xdg  0.25-4
pn  python3:any  <none>

python3-speechd recommends no packages.

python3-speechd suggests no packages.

- -- no debconf information

-----BEGIN PGP SIGNATURE-----

iQJhBAEBCABLBQJX5SItMRpodHRwczovL3d3dy5kb21pbmlrLWdlb3JnZS5kZS9n
cGctcG9saWN5LnR4dC5hc2MSHG5pa0BuYXR1cmFsbmV0LmRlAAoJELeaPBagxPKW
jKYP/iJJZqkxfx7VHfQPl1pH/RUW16hRsBjirx1GHH/KTigNNf1p/2QC6F/1zh2i
GvXXqYg3s1kczIy/OmK0dF6tM+/JlgUq3lZaCV+th1US9imIOL334Wes/fBf9M7S
PGeH7y6yj2Yv1V1Y5gwomqJQA0y2PQI9egRCW0QCbF/F5heXTODyMV/DAZ7jp+Ov
gwSG7z7DqEFcyfNl1bmukZ3UrXcey1mk58XC/AwlEr31L0Bdg11USnXNf2yfp0yz
HLPtVD/ClLZzYLl+LDX6D5NrVpq9HZz5J9DWuA+1M+ReCNWIVlcoGv/ejI8L0oRS
labEiLhLRy/ATCmvJgrEUSyTUlU7daOxod3qbpKJpWfuXXURmsxWJMtvZMQXw6Dw
cUcrIh5VmjimXu6rdUzrXZkXSMOh5s3L5NNTijzSFZpC7gqQLn0Qpvs27LKikRQq
B0V1DvQ/iGrJUdo8iCyjlyirtgzRGygGMo/yPW9ynmypelhRsz8sRc4FSrW4eddS
U52beJFJeJKC85emsX11qpHhkxlkD3uhgg7kQsMA84ZMXh/aQq8YLpivIfOC67Ta
LnVJKx7L/njc9BIyd4aGlvarmidkguDQXhnKnxnKvnpND+B0+fsa9GiKb3GYpnHO
7SN4DDtHsJbwlyKEMN0vihgVAlryRktV/kanoNFCp1QzgoRc
=xZz+
-----END PGP SIGNATURE-----