search

SAML-Toolkits / python3-saml

MIT License
704 stars 309 forks source link

Unable to build xmlsec - dev team says to notify this package's dev team for solution #359

Closed sourcematters closed 5 months ago

sourcematters commented 1 year ago

Hi python3-saml dev team - have been unable to pip install python3-saml due to (from my not-great understanding) an incompatibility with xmlsec/libxmlsec1.

When I raised the issue with xmlsec (https://github.com/lsh123/xmlsec/pull/427), they advised to report issue to this dev team.

Can you help?

I'm on an M1 with python 3.11.2 and attempting pip install of python3-saml which is failing to build a wheel for xmlsec.

garma83 commented 1 year ago

Also refer to https://github.com/xmlsec/python-xmlsec/issues/254#issuecomment-1511135314

pitbulk commented 1 year ago

@sourcematters, Sorry but it seems there is some confusion.

python3-saml uses the xmlsec library, and its repository on github is: https://github.com/xmlsec/python-xmlsec not: https://github.com/lsh123/xmlsec

@garma83 provided you a link to the right thread and it seems some collaborators provided ways to install it properly.

cro commented 1 year ago

python-xmlsec depends on libxmlsec1. libxmlsec1 >= 1.3 no longer supports SOAP, the SOAP functionality has been removed. Versions of libxmlsec1 that do support SOAP are no longer maintained. I think the OP was raising the issue because as Linux distros begin to package the later libxmlsec1, python3-saml will not be installable. The libxmlsec1 author stated that SOAP support was added "as part of an abandoned project to support SAML" (see https://github.com/lsh123/xmlsec/pull/427#issuecomment-1587567310). The authors of python-xmlsec are approaching this by removing SOAP support in their package, but this is proving to be challenging (https://github.com/xmlsec/python-xmlsec/issues/252). If python3-saml uses the deprecated SOAP functionality we will either have to pin environments to libxmlsec1<1.3 or find another way to parse the SOAP.

Maybe a comment in this project's README might help future users?

mdgreenwald commented 12 months ago

@sourcematters, Sorry but it seems there is some confusion.

python3-saml uses the xmlsec library, and its repository on github is: https://github.com/xmlsec/python-xmlsec not: https://github.com/lsh123/xmlsec

@garma83 provided you a link to the right thread and it seems some collaborators provided ways to install it properly.

@pitbulk While there are workarounds in that thread, they are by no means sustainable and they don't address the underlying incompatibility with libxmlsec1 1.3. A closer look reveals that https://github.com/xmlsec/python-xmlsec appears to be abandoned by the sole maintainer. The readme shows numerous builds failing, several threads have comments requesting that the issue get fixed with no acknowledgement from the maintainer, its not clear that there are any plans to continue maintaining that project. Does the python3-saml project have plans to mitigate this dependency in the future? Or perhaps to fork and maintain a new version? Thanks.

pitbulk commented 9 months ago

No plans for now to migrate from python-xmlsec, but the easiest approach I see is to reuse the xmlsec library that was used in python-saml, dm.xmlsec.binding, but not sure if Dieter Maurer is actively maintaining it, so we could be in a similar situation, I don't see recent releases, but a comment from him on a forum