[Bug 2115861] Re: [MIR] python3-charset-normalizer

[Pushkar Kulkarni]

** Also affects: python-debian (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: requests (Ubuntu)
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to python-debian in Ubuntu.
https://bugs.launchpad.net/bugs/2115861

Title:
  [MIR] python3-charset-normalizer

Status in python-charset-normalizer package in Ubuntu:
  In Progress
Status in python-debian package in Ubuntu:
  New
Status in requests package in Ubuntu:
  New

Bug description:
  [MIR] python3-charset-normalizer

  [Availability]
   - The package src:python-charset-normalizer is already in Ubuntu universe.
   - The package src:python-charset-normalizer builds for the architectures it is designed to work on.
   - It currently builds and works for architectures: amd64, arm64, armhf, s390x, ppc64el, riscv64
   - Link to package: https://launchpad.net/ubuntu/+source/python-charset-normalizer

  [Rationale]
  - The package python3-charset-normalizer is required in Ubuntu main for packages python3-requests and python3-debian.
  - The package python3-charset-normalizer is a new runtime dependency of package python3-requests and python3-debian that we already support
  - The package python3-charset-normalizer will not generally be useful for a large part of our user base, but is important/helpful still
    because the upstream projects for src:python-requests and src:python-debian have migrated their charset detection dependency from src:python-chardet to 
    src:python-charset-normalizer.
  - Package src:python-charset-normalizer covers the same use case as src:python-chardet, but the former is known to provide better performance and provides more functionality. See [Background] for details.
  - The binary packages python3-charset-normalizer needs to be in main to achieve parity with upstream and/or Debian:
    => Ubuntu's src:python3-requests has a patch to replace python3-charset-normalizer by python3-chardet
       https://git.launchpad.net/ubuntu/+source/requests/tree/debian/patches/0002-Fix-tests-with-HTTP-proxy.patch
    => src:python3-debian moves python3-charset-normalizer from Depends/Recommends to Suggests
  - All other binary packages built by src:python-charset-normalizer should remain in universe
    => the only other package is python-charset-normalizer-doc which python3-charset-normalizer "Suggests"
  - It would be great and useful to community/processes to have the package python3-charset-normalizer in Ubuntu main, but there is no definitive deadline.

  [Security]
  - No CVEs/security issues in this software in the past
    => This came up in a Google search, but I don't see how sqlparse relates to charset-normalzier
       https://security.snyk.io/vuln/SNYK-SLES154-PYTHON311CHARSETNORMALIZER-7981546
  - no `suid` or `sgid` binaries
  - no executables in `/sbin` and `/usr/sbin`
  - Package does not install services, timers or recurring jobs
  - Packages does not open privileged ports (ports < 1024)
  - Package does not expose any external endpoints
  - Packages does not contain extensions to security-sensitive software
  - From a security standpoint, this does not need any of the isolation/risk-mitigation approaches
  - Packages does not contain extensions to security-sensitive software (filters, scanners, plugins, UI skins, ...)

  
  [Quality assurance - function/usage]
  - The package works well right after install

  [Quality assurance - maintenance]
  - The package is maintained well in Debian/Ubuntu/Upstream and does not have too many, long-term & critical, open bugs
  - Ubuntu https://bugs.launchpad.net/ubuntu/+source/python-charset-normalizer/+bug
     - 1 low impact bug report
  - Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=python-charset-normalizer
     - 1 normal severity open bug-report which is relevant to cross-compilation (on Debian only?)
  - Upstream's bug tracker https://github.com/jawah/charset_normalizer/issues
     - No long-pending issues.
  - The package has no important open bugs relevant to Ubuntu
  - The package does not deal with exotic hardware we cannot support

  [Quality assurance - testing]
  - The package runs a test suite on build time, if it fails it makes the build fail
    Link to a build log: https://launchpadlibrarian.net/791480417/buildlog_ubuntu-questing-amd64.python-charset-normalizer_3.4.2-1_BUILDING.txt.gz
  - The package runs an autopkgtest, and is currently passing on amd64, arm64, armhf, ppc64el and s390x
    Link to test log: https://autopkgtest.ubuntu.com/results/autopkgtest-questing/questing/amd64/p/python-charset-normalizer/20250630_220548_cf11c@/log.gz
  - The package does have not failing autopkgtests right now

  [Quality assurance - packaging]
  - debian/watch is present and works
  - debian/control defines a correct Maintainer field
  - This package does not yield massive lintian Warnings, Errors
  - Link to a build log: https://launchpadlibrarian.net/791480417/buildlog_ubuntu-questing-amd64.python-charset-normalizer_3.4.2-1_BUILDING.txt.gz
  - Output of `lintian --pedantic` a following comment
  - This package does not rely on obsolete or about to be demoted packages.
  - This package has no python2 or GTK2 dependencies

  [UI standards]
  - Application is not end-user facing (does not need translation)

  [Dependencies]
  - No further depends or recommends dependencies that are not yet in main
    => checked with the check-mir tool

  [Standards compliance]
  - This package correctly follows FHS and Debian Policy

  [Maintenance/Owner]
  - The owning team will be the Debcrafters team, and I have their acknowledgment for that commitment
  - The owning team is not yet subscribed, but will subscribe to the package before promotion
  - This does not use static builds
  - This does not use vendored code
  - This package is not rust based
  - The package has been built within the last 3 months in the archive
  - Build link on launchpad: https://launchpad.net/ubuntu/+source/python-charset-normalizer/3.4.2-1

  [Background information]
  - The Package description explains the package well
  - Upstream Name is charset-normalizer
  - Link to upstream project: https://github.com/jawah/charset_normalizer
  - The charset-normalizer package is a functionally better, and better performing, alternative to chardet.
  - Details of the comparison are here: https://pypi.org/project/charset-normalizer/

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-charset-normalizer/+bug/2115861/+subscriptions