* Package name    : python-unshare
  Version         : 0.22
  Upstream Author : Shubham Sharma <shubhamsharma1172@gmail.com>
* URL             : https://github.com/shubham1172/unshare
* License         : GPL-3
  Programming Lang: Python
  Description     : extension for C unshare() call

 Python extension for C's unshare call, see unshare(2).

https://salsa.debian.org/python-team/packages/python-unshare/

/Simon

Hi Simon,
single syscall. You can achieve a similar effect using ctypes.

    import ctypes
    unshare = ctypes.CDLL(None, use_errno=True)["unshare"]
    unshare(flags)

The functionality being added here is useful, but in my opinion it does
not reach the bar of being sufficiently useful to warrant the cost of
carrying it in Debian yet. Bear in mind that every package being added
bears a permanent cost to Debian.

Please allow me to suggest an alternative.
https://git.subdivi.de/~helmut/python-linuxnamespaces.git/
Disclaimer: I am the author of the alternative.

I did not dare to propose adding this to Debian yet, because I consider
it work in progress, but even at this time, it does so much more than
the module you propose that it probably is worth looking into. It is not
API compatible, because it uses the enum module instead of numeric
constants. It also includes a pile of examples for more elaborate
container construction.

Helmut

/Simon

I have patched out use of python-unshare from python-netfilterqueue, it
was only used during self-tests but those did not work anyway.

https://salsa.debian.org/python-team/packages/python-netfilterqueue/-/commit/22a94f3ba90112ea8aa474ba2523f6c81ca1d333
https://salsa.debian.org/python-team/packages/python-netfilterqueue/-/pipelines/787900

I opened an upstream bug report to ask them to consider another
approach:

https://github.com/oremanj/python-netfilterqueue/issues/15#issuecomment-2564282968

It seems their code is here:

https://github.com/oremanj/python-netfilterqueue/blob/master/tests/test_basic.py
https://github.com/oremanj/python-netfilterqueue/blob/master/tests/conftest.py

If you (or anyone on debian-python that I'm cc'ing now) can propose a
patch for upstream, maybe that will convince them to avoid the
python-unshare dependency and we'll have better self-tests as a result.

Note that there appears to be two python-unshare: one on PyPI and
another one here: https://github.com/NightTsarina/python-unshare/

/Simon

Simon Josefsson <simon@josefsson.org> writes:

Hi Simon,
Debian and others ignore Python modules not on PyPI.

My reasons for ignoring PyPI:
 * It has a history of hosting malware.
 * It has a history of hosting low-quality modules (such as the one you
   are packaging).
 * It tends to have multiple competing modules for a usecase. Each of
   them has their own downsides and the good solution ends up not being
   uploaded to PyPI.
 * Modules come and go often only ever receiving a single upload and
   your dependency ends up becoming technical debt.
 * It has made uploading stuff harder and harder while simultaneously
   degrading security by stopping support for pgp signatures.
 * Accessing PyPI has become harder since it became "protected" by
   fastly.
 * Salvo Tomaselli gave a talk in Toulouse with more reasons.

I no longer consider PyPI worth my time. I have no objections to someone
else uploading linuxnamespaces to PyPI.

I note that you can also do optional dependencies. pqconnect may try
importing unshare and fall back to linuxnamespaces. The linuxnamespaces
module does something similar for dbus where you may opt for dbussy or
jeepney depending on your preference. Alternatively, you may carry a
patch in your pqconnect packaging to swap out the unshare module.

In any case, I stand by my recommendation of not uploading a module of
such dubious value to Debian when objectively[1] better replacements
exist.

Helmut

[1] I think there is one aspect that unshare is better at than
    linuxnamespaces and that's performance. However, creating thousands
    of namespaces per second is a very unusual use case, so I consider
    this irrelevant.

tag 1091506 wontfix
thanks

Helmut Grohne <helmut@subdivi.de> writes:

I agree with that, so tagging this ITP bug appropriately pending other
input or ideas in the future.

I can't speak of alternatives, but I've realized that python-unshare
isn't a showstopper for PQconnect since python-netfilterqueue has been
made to work without python-unshare now.

/Simon