#1152404 python-maturin: please upgrade to using zip 9

#1152404#5
Date:
2026-10-28 20:00:06 UTC
From:
To:
Dear Maintainer,

We needed to do a fast bump of zip to version 9, to handle a bunch of CVE's.

Please bump this package to use zip 9 instead of zip 5.

//Alex

#1152404#14
Date:
2026-10-29 11:20:05 UTC
From:
To:
in the upstream repository, for testing convenience), I got:

error[E0107]: struct takes 2 lifetime arguments but 1 lifetime argument was supplied
   --> src/compression.rs:97:58
    |
97 |     pub(crate) fn get_file_options(&self) -> zip::write::FileOptions<'static, ()> {
    |                                                          ^^^^^^^^^^^ ------- supplied 1 lifetime argument
    |                                                          |
    |                                                          expected 2 lifetime arguments
    |
note: struct defined here, with 2 lifetime parameters: `'k`, `'n`
   --> /home/cjwatson/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/zip-9.1.3/src/write/options.rs:53:12
    |
53 | pub struct FileOptions<'k, 'n, T: sealed::FileOptionExtension> {
    |            ^^^^^^^^^^^ --  --
help: add missing lifetime argument
    |
97 |     pub(crate) fn get_file_options(&self) -> zip::write::FileOptions<'static, 'static, ()> {
    |                                                                             +++++++++

For more information about this error, try `rustc --explain E0107`.


OK, so I did that.  Then I get this mess:

error[E0599]: the method `to_string` exists for enum `Result<Cow<'_, str>, ZipError>`, but its trait bounds were not satisfied
    --> tests/common/integration.rs:568:37
     |
568 |         if !seen.insert(file.name().to_string()) {
     |                                     ^^^^^^^^^ method cannot be called on `Result<Cow<'_, str>, ZipError>` due to unsatisfied trait bounds
     |
    ::: /usr/src/rustc-1.97.1/library/core/src/result.rs:557:1
     |
557 | pub enum Result<T, E> {
     | --------------------- doesn't satisfy `Result<Cow<'_, str>, ZipError>: ToString` or `Result<Cow<'_, str>, ZipError>: std::fmt::Display`
     |
     = note: the following trait bounds were not satisfied:
             `Result<Cow<'_, str>, ZipError>: std::fmt::Display`
             which is required by `Result<Cow<'_, str>, ZipError>: ToString`

error[E0277]: `Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
    --> tests/common/integration.rs:569:41
     |
569 |             bail!("Duplicate file: {}", file.name());
     |                                    --   ^^^^^^^^^^^ `Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
     |                                    |
     |                                    required by this formatting parameter
     |
     = help: the trait `std::fmt::Display` is not implemented for `Result<Cow<'_, str>, ZipError>`
     = note: in format strings you may be able to use `{:?}` (or {:#?} for pretty-print) instead
     = note: this error originates in the macro `$crate::__export::format_args` which comes from the expansion of the macro `bail` (in Nightly builds, run with -Z macro-backtrace for more info)

error[E0631]: type mismatch in closure arguments
    --> tests/common/other.rs:387:17
     |
381 |     let drop_platform_specific_files = |file: &&str| -> bool {
     |                                        --------------------- found signature defined here
...
387 |         .filter(drop_platform_specific_files)
     |          ------ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ expected due to this
     |          |
     |          required by a bound introduced by this call
     |
     = note: expected closure signature `for<'a> fn(&'a Result<Cow<'_, str>, ZipError>) -> _`
                found closure signature `fn(&&str) -> _`
note: required by a bound in `filter`
    --> /usr/src/rustc-1.97.1/library/core/src/iter/traits/iterator.rs:955:34
     |
952 |     fn filter<P>(self, predicate: P) -> Filter<Self, P>
     |        ------ required by a bound in this associated function
...
955 |         P: FnMut(&Self::Item) -> bool,
     |                                  ^^^^ required by this bound in `Iterator::filter`
help: consider wrapping the function in a closure
     |
387 |         .filter(|arg0: &Result<Cow<'_, str>, ZipError>| drop_platform_specific_files(/* &&str */))
     |                 +++++++++++++++++++++++++++++++++++++++                             +++++++++++++

error[E0599]: the method `map` exists for struct `Filter<impl Iterator<Item = Result<Cow<'_, str>, ZipError>>, {closure@tests/common/other.rs:381:40: 381:61}>`, but its trait bounds were not satisfied
    --> tests/common/other.rs:388:10
     |
381 |       let drop_platform_specific_files = |file: &&str| -> bool {
     |                                          --------------------- doesn't satisfy `<_ as FnOnce<(&Result<Cow<'_, str>, ZipError>,)>>::Output = bool`
...
385 |       Ok(wheel
     |  ________-
386 | |         .file_names()
387 | |         .filter(drop_platform_specific_files)
388 | |         .map(str::to_owned)
     | |         -^^^ method cannot be called due to unsatisfied trait bounds
     | |_________|
     |
     |
    ::: /usr/src/rustc-1.97.1/library/core/src/iter/adapters/filter.rs:21:1
     |
  21 |   pub struct Filter<I, P> {
     |   ----------------------- doesn't satisfy `_: Iterator`
     |
     = note: the following trait bounds were not satisfied:
             `<{closure@tests/common/other.rs:381:40: 381:61} as FnOnce<(&Result<Cow<'_, str>, ZipError>,)>>::Output = bool`
             which is required by `Filter<impl Iterator<Item = Result<Cow<'_, str>, ZipError>>, {closure@tests/common/other.rs:381:40: 381:61}>: Iterator`
             `Filter<impl Iterator<Item = Result<Cow<'_, str>, ZipError>>, {closure@tests/common/other.rs:381:40: 381:61}>: Iterator`
             which is required by `&mut Filter<impl Iterator<Item = Result<Cow<'_, str>, ZipError>>, {closure@tests/common/other.rs:381:40: 381:61}>: Iterator`

error[E0599]: no method named `contains` found for reference `&Result<Cow<'_, str>, ZipError>` in the current scope
    --> tests/common/other.rs:398:23
     |
398 |         .filter(|f| f.contains(".dist-info/sboms/"))
     |                       ^^^^^^^^ method not found in `&Result<Cow<'_, str>, ZipError>`
     |
     = help: items from traits can only be used if the trait is in scope
help: trait `Seq` which provides `contains` is implemented but not in scope; perhaps you want to import it
     |
   1 + use chumsky::container::Seq;
     |

error[E0599]: the method `to_string` exists for enum `Result<Cow<'_, str>, ZipError>`, but its trait bounds were not satisfied
    --> tests/common/other.rs:399:20
     |
399 |         .map(|f| f.to_string())
     |                    ^^^^^^^^^ method cannot be called on `Result<Cow<'_, str>, ZipError>` due to unsatisfied trait bounds
     |
    ::: /usr/src/rustc-1.97.1/library/core/src/result.rs:557:1
     |
557 | pub enum Result<T, E> {
     | --------------------- doesn't satisfy `Result<Cow<'_, str>, ZipError>: ToString` or `Result<Cow<'_, str>, ZipError>: std::fmt::Display`
     |
     = note: the following trait bounds were not satisfied:
             `Result<Cow<'_, str>, ZipError>: std::fmt::Display`
             which is required by `Result<Cow<'_, str>, ZipError>: ToString`

error[E0599]: no method named `ends_with` found for reference `&Result<Cow<'_, str>, ZipError>` in the current scope
    --> tests/common/other.rs:671:37
     |
671 |                 .filter(|name| name.ends_with(".so"))
     |                                     ^^^^^^^^^ method not found in `&Result<Cow<'_, str>, ZipError>`

error[E0369]: binary operation `==` cannot be applied to type `Vec<Result<Cow<'_, str>, ZipError>>`
    --> tests/common/other.rs:673:13
     |
673 | /             assert_eq!(
674 | |                 extensions,
675 | |                 [format!(
676 | |                     "pyo3_abi3_and_abi3t/pyo3_abi3_and_abi3t{expected_suffix}"
677 | |                 )]
678 | |             );
     | |             ^
     | |             |
     | |_____________Vec<Result<Cow<'_, str>, ZipError>>
     |               [std::string::String; 1]
     |
note: `Result<Cow<'_, str>, ZipError>` does not implement `PartialEq<std::string::String>`
    --> /usr/src/rustc-1.97.1/library/core/src/result.rs:557:1
     |
557 | pub enum Result<T, E> {
     | ^^^^^^^^^^^^^^^^^^^^^ `Result<Cow<'_, str>, ZipError>` is defined in another crate
     = note: this error originates in the macro `$crate::assert_eq` which comes from the expansion of the macro `assert_eq` (in Nightly builds, run with -Z macro-backtrace for more info)

error[E0599]: no method named `starts_with` found for reference `&Result<Cow<'_, str>, ZipError>` in the current scope
    --> tests/common/other.rs:803:29
     |
803 |         .filter(|name| name.starts_with("bin_with_python_module/"))
     |                             ^^^^^^^^^^^ method not found in `&Result<Cow<'_, str>, ZipError>`

error[E0369]: binary operation `==` cannot be applied to type `Vec<Result<Cow<'_, str>, ZipError>>`
    --> tests/common/other.rs:812:5
     |
812 |     assert_eq!(package_files, expected);
     |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     |     |
     |     Vec<Result<Cow<'_, str>, ZipError>>
     |     Vec<&str>
     |
note: `Result<Cow<'_, str>, ZipError>` does not implement `PartialEq<&str>`
    --> /usr/src/rustc-1.97.1/library/core/src/result.rs:557:1
     |
557 | pub enum Result<T, E> {
     | ^^^^^^^^^^^^^^^^^^^^^ `Result<Cow<'_, str>, ZipError>` is defined in another crate
     = note: this error originates in the macro `$crate::assert_eq` which comes from the expansion of the macro `assert_eq` (in Nightly builds, run with -Z macro-backtrace for more info)

Some errors have detailed explanations: E0277, E0369, E0599, E0631.
For more information about an error, try `rustc --explain E0277`.


This is beyond me.  Help?

#1152404#19
Date:
2026-10-29 12:03:52 UTC
From:
To:
I did an attempt at a bump, and also sent it upstream:
https://github.com/PyO3/maturin/pull/3349

Also attached as a patch, against the latest commit on the maturin main branch.

//Alex

Den tors 29 okt. 2026 kl 12:20 skrev Colin Watson <cjwatson@debian.org>:

#1152404#24
Date:
2026-10-29 18:04:46 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
python-maturin, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152404@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated python-maturin package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 29 Oct 2026 17:34:30 +0000
Source: python-maturin
Architecture: source
Version: 1.16.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Closes: 1152404
Changes:
 python-maturin (1.16.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release:
     - Upgrade to zip 9 (closes: #1152404).
Checksums-Sha1:
 189c82d62820fe03925931c15e5bdfbd46e91942 6960 python-maturin_1.16.0-1.dsc
 7875705ebbb56578799c5d5f23420408e5afb7aa 813680 python-maturin_1.16.0.orig.tar.gz
 f89ed527f2e1d6c23d67c62a3c6eda9fa02e2d7b 7576 python-maturin_1.16.0-1.debian.tar.xz
 bad434cc05d6a57fdc7aed4af9595a8f6cb10fa9 1521380 python-maturin_1.16.0-1.git.tar.xz
 437d2ca115517f0dd165a9f86e7120f16c9731f2 17769 python-maturin_1.16.0-1_source.buildinfo
Checksums-Sha256:
 7802693187b859cbe9c73710499a06f3156e9349d91084a2f8536036fcfa06f5 6960 python-maturin_1.16.0-1.dsc
 b22d15b7dc4f27af50b831af0866bcd901bcce2433182c5b2f252dd420531c0d 813680 python-maturin_1.16.0.orig.tar.gz
 5d915f7860424ce0d9d58ebd6a2541590068b8e67bb71a0259bbf3cb97156e00 7576 python-maturin_1.16.0-1.debian.tar.xz
 9c9cb9be467eb94cb4c028c48529e7732a1340fe50f1a0f7667757455f3108e4 1521380 python-maturin_1.16.0-1.git.tar.xz
 44b9236a42ddc0229c4560e3fb7a1cc90f539add1f301d36eb1c7f64d92a35f2 17769 python-maturin_1.16.0-1_source.buildinfo
Files:
 396fc366b7d83d014eec55c125692864 6960 python optional python-maturin_1.16.0-1.dsc
 5d5fda89ab904e6d4728295629237422 813680 python optional python-maturin_1.16.0.orig.tar.gz
 0b7b1fa034a6c82f6d7d67fbe8dcf392 7576 python optional python-maturin_1.16.0-1.debian.tar.xz
 7ffc031ebc25d41f47db02881ef3f765 1521380 python None python-maturin_1.16.0-1.git.tar.xz
 c1b6a18b2630be90463ced8ac9729d87 17769 python optional python-maturin_1.16.0-1_source.buildinfo
Git-Tag-Info: tag=fa287791402124821909b9e15dfce91976baf3aa fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <cjwatson@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrjhQoACgkQYG0ITkaD
wHnGKw/+PMbEMkxUr7hx2VK0fSzvzltrcfd0/Iap7LxLpIlhfCBQuikNygmP/3jg
dB8KOUndnIZnBc6wsQ3fsLtYRCzETUyY2Cn7dcfG37v+eSfTgDiz9OVDD3ifn1Dj
fnw1TAgUptr9U3Wdj9g7fvKB4Dq9p7tTehj/q8aCfZo7WACWkP2Ls9FAvTGC50C5
pYlhzVvT1lXYInPdW4QnGdxTaZXxsT5NPQQ5YbbzjX2g71TWAoyLTyj0uESYhtad
ioNHk4TZqEISL1juyt+6AWs88IOduogB99r8fgMaXHnJKJSqSMwyQW/LcBB8h1iS
WcXQj1o4bhyl3zAFErtL1w4phnrR1huCt7WYkhDV472W66nlPJu9gTX2lMCfKPJO
cOBrrTBI5eZuxZ71HmL79/GZJOkSrBTLWXBHVW7jBOCHqvIbqcnvfpWbl0mAj4Vy
P65LLJz2L+eFtzJrp5TokLMa3MSvPVKAuuTGJJW6DtyPfUAqHG+MdM57Xq9ltFNu
DSTRd8aEzFjTTgtEK4e8IZR3QeVdWdMvjaLpHhrjeHkuHYDPJMQdYAkZ4Ef91l6H
dOw2Xlxb78PjlC0JoIlc2aHORMvqQP3taPPOh1IteiJ4iB93aE28HOUJLPoV0mp0
5wlkNmrgxTRbAgeiJkzO58/U6N6LqmbbdBqq7P7tN/PNT7tUq/8=
=/O+Z
-----END PGP SIGNATURE-----