#1031859 false positive of embedded expat library leads to ftp-master rejection

Package:
lintian
Source:
lintian
Submitter:
Matthias Klose
Date:
2025-08-17 17:51:49 UTC
Severity:
normal
Tags:
#1031859#5
Date:
2023-02-24 11:28:18 UTC
From:
To:
seen with the binary packages from
https://people.debian.org/~doko/tmp/

$ lintian -F python3.12_3.12.0~a5-1_amd64.changes
E: libpython3.12: embedded-library expat
[usr/lib/x86_64-linux-gnu/libpython3.12.so.1.0]
E: libpython3.12-dbg: embedded-library expat
[usr/lib/x86_64-linux-gnu/libpython3.12d.so.1.0]
E: python3.12-dbg: embedded-library expat [usr/bin/python3.12d]
E: python3.12-minimal: embedded-library expat [usr/bin/python3.12]
E: python3.12-nopie: embedded-library expat [usr/bin/python3.12]


The packages are confiured --with-system-expat, and all have proper dependencies
on libexpat1.

The same bogus messages can be found for python3.11 at
https://udd.debian.org/lintian/?packages=python3.11
#1031859#10
Date:
2023-02-25 14:14:34 UTC
From:
To:
control: tags -1 +moreinfo
Le vendredi 24 février 2023, 11:28:18 UTC Matthias Klose a écrit :
Hi doko;

Could you check why the "requested feature requires XML_DTD support in Expat" string is on the binary ?

Bastien
hi
#1031859#17
Date:
2023-02-25 14:14:34 UTC
From:
To:
control: tags -1 +moreinfo
Le vendredi 24 février 2023, 11:28:18 UTC Matthias Klose a écrit :
Hi doko;

Could you check why the "requested feature requires XML_DTD support in Expat" string is on the binary ?

Bastien
hi
#1031859#22
Date:
2023-02-26 13:17:54 UTC
From:
To:
control: tags -1 -moreinfo

yes, see https://github.com/python/cpython/blob/main/Modules/pyexpat.c
#1031859#29
Date:
2023-02-26 14:55:21 UTC
From:
To:
control: tags -1 + moreinfo
Le dimanche 26 février 2023, 13:17:54 UTC Matthias Klose a écrit :
Hi,

Ok I see do you see an unique string for expat not present in pyexpat, and present in old version ?

Bastien
#1031859#36
Date:
2023-02-26 20:11:16 UTC
From:
To:
Hi Matthias,

Matthias Klose wrote:

Thanks for that hint. So Python upstream copied a bunch of error
messages verbatim from libexpat since Python 3.11. 🤌 (I verified that
this got added in 3.11 and that 3.10.0 and 3.10.10 doesn't emit these
tags.)

So this means that this test works as it should and detected that fact.

In that case:

1) this is by no means an RC-critical as it only affects a single
   package (well, actually pypy, too, probably for similar reasons)
   and does not mean that the check itself is broken. In contrary!

   Hence downgrading the severity to minor, as there's a small chance
   that we can find an libexpat string that the Python upstream devs
   haven't copied verbatim into their code. 🤬

   (If we don't find one occasionally, I will close this bug report as
   wontfix.)

2) You should just add a lintian override as this is a very special
   circumstance only appearing in two python-related packages and
   nowhere else and the cause is a very weird behaviour of the
   upstream developers.

		Regards, Axel