MIME-Version: 1.0
From: Bradford Boyle <bradford.d.boyle@gmail.com>
Date: Wed, 19 Jun 2024 23:50:08 -0700
Message-ID: 
 <CAOMoQbTE3MUJHZh3HkbwkkGbeEBy37AMAQwZUPr7atvmMZyXMw@mail.gmail.com>
Subject: omnidb-server: fix for bug 1053100
To: pgsql-pkg-debian@lists.postgresql.org
Content-Type: multipart/mixed; boundary="000000000000913e2a061b4cba83"
Archived-At: 
 <https://www.postgresql.org/message-id/CAOMoQbTE3MUJHZh3HkbwkkGbeEBy37AMAQwZUPr7atvmMZyXMw%40mail.gmail.com>
Precedence: bulk

--000000000000913e2a061b4cba83
Content-Type: text/plain; charset="UTF-8"

Hi All,

I have been looking at Debian bug 1053100 (omnidb-server crashes when
creating a new PostgreSQL connection) [1] and I have identified that
this is caused by a change in one of OmniDB's Python dependencies.

OmniDB configures Django's session serialization format to use Python's
`pickle` module instead of the default JSON-based serialization. The
class `Session` has a field `v_databases` that is a dictionary tha
contains references to objects holding information for the various
connections the user has configured. When a connection to a PostgreSQL
database is configured, the `Session` object ends up transitively
referencing an instance of `PGSpecial` from provided by the Python
package `pgspecial`. A recent change in `pgspecial` means that
`PGSpecial` objects are no longer serializable with Python's `pickle`
module.

Reviewing OmniDB's use of `PGSpecial` within its `PostgreSQL` class, it
appears to be a "stateless" in that it does not use the `PGSpecial`
object in any way that would cause its fields to be change value from
when it was constructed. Based on this observation, an approach to
fixing the reported bug is to patch OmniDB's `PostgreSQL` class to omit
`PGSpecial` during serialization and to recreate it during
deserialization. I have a attached a patch that will do this. In my
limited local testing, this fixes the bug. If there are no concerns with
the proposed patch, I can update the package on s.d.o.

It looks like Django 5.x has deprecated `PickleSerializer` [2] so its
unlikely that OmniDB will continue working going forward. At the moment,
Debian testing still provides Django 4.2 but I do not know if the Debian
Python team has plans to update to the newer major version. Independent
of the Django major version incompatibility, it looks like the upstream
repo for OmniDB has gone inactive and the project is unmaintained [3].
Does it make sense to continue publishing packages of OmniDB for newer
releases of Debian and Ubuntu?

-- Bradford

[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053100
[2]: https://github.com/django/django/pull/15139
[3]: https://github.com/OmniDB/OmniDB

--000000000000913e2a061b4cba83
Content-Type: application/octet-stream;
	name="0001-Customize-PostgreSQL-class-pickle-serialization.patch"
Content-Disposition: attachment;
	filename="0001-Customize-PostgreSQL-class-pickle-serialization.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_lxmwj66m0>
X-Attachment-Id: f_lxmwj66m0

RnJvbSA2YTQ2YzEwNjhiZjkwZmFhZjNiNzMwMjRlOGM0OGIwNDg5OWE4ZTk3IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiAiQnJhZGZvcmQgRC4gQm95bGUiIDxicmFkZm9yZC5kLmJveWxl
QGdtYWlsLmNvbT4KRGF0ZTogU3VuLCAxMiBNYXkgMjAyNCAyMDozOTowNyAtMDcwMApTdWJqZWN0
OiBbUEFUQ0hdIEN1c3RvbWl6ZSBQb3N0Z3JlU1FMIGNsYXNzIHBpY2tsZSBzZXJpYWxpemF0aW9u
CgpUaGlzIGNvbW1pdCBtb2RpZmllcyBQb3N0Z3JlU1FMIHRvIG9taXQgdl9zcGVjaWFsIHdoZW4g
cGlja2xpbmcuIE9tbmlEQgppcyBjb25maWd1cmVkIHRvIHVzZSBkamFuZ28ncyBQaWNrbGVTZXJp
YWxpemVyIGJ1dCBQeXRob24ncyBwaWNrbGUKbW9kdWxlIGNhbiBvbmx5IHNlcmlhbGl6ZSBmdW5j
dGlvbnMgdGhhdCBhcmUgYWNjZXNzaWJsZSBmcm9tIHRoZQp0b3AtbGV2ZWwgb2YgYSBtb2R1bGUu
IE5ld2VyIHZlcnNpb24ncyBvZiBwZ3NwZWNpYWwgdXNlIGFuIGlubmVyCmZ1bmN0aW9uIHdoZW4g
Y3JlYXRpbmcgU3BlY2lhbENvbW1hbmRzLiBUaGlzIGNhdXNlcyBhbiBBdHRyaWJ1dGVFcnJvciB0
bwpiZSB0aHJvd24gd2l0aCB0aGUgZm9sbG93aW5nIG1lc3NhZ2U6CgogICAgQXR0cmlidXRlRXJy
b3I6IENhbid0IHBpY2tsZSBsb2NhbCBvYmplY3QKICAgICdzaG93X2V4dHJhX2hlbHBfY29tbWFu
ZC48bG9jYWxzPi5wbGFjZWhvbGRlcicKCldoZW4gYW4gaW5zdGFuY2Ugb2YgUG9zdGdyZVNRTCBp
cyBkZXNlcmlhbGl6ZWQsIHZfc3BlY2lhbCBpcyByZWNyZWF0ZWQuClRoaXMgYXBwcm9hY2ggd29y
a3Mgc2luY2Ugdl9zcGVjaWFsIGlzIG9ubHkgcmVhZCBhbmQgaXNuJ3QgbW9kaWZpZWQuCgpodHRw
czovL2J1Z3MuZGViaWFuLm9yZy9jZ2ktYmluL2J1Z3JlcG9ydC5jZ2k/YnVnPTEwNTMxMDAKaHR0
cHM6Ly9kb2NzLnB5dGhvbi5vcmcvMy9saWJyYXJ5L3BpY2tsZS5odG1sI3doYXQtY2FuLWJlLXBp
Y2tsZWQtYW5kLXVucGlja2xlZAotLS0KIE9tbmlEQi9PbW5pREJfYXBwL2luY2x1ZGUvU3BhcnRh
Y3VzL0RhdGFiYXNlLnB5IHwgMTAgKysrKysrKysrKwogMSBmaWxlIGNoYW5nZWQsIDEwIGluc2Vy
dGlvbnMoKykKCmRpZmYgLS1naXQgYS9PbW5pREIvT21uaURCX2FwcC9pbmNsdWRlL1NwYXJ0YWN1
cy9EYXRhYmFzZS5weSBiL09tbmlEQi9PbW5pREJfYXBwL2luY2x1ZGUvU3BhcnRhY3VzL0RhdGFi
YXNlLnB5CmluZGV4IGE0MTI4MWJjLi40ZWMyNWEwOCAxMDA2NDQKLS0tIGEvT21uaURCL09tbmlE
Ql9hcHAvaW5jbHVkZS9TcGFydGFjdXMvRGF0YWJhc2UucHkKKysrIGIvT21uaURCL09tbmlEQl9h
cHAvaW5jbHVkZS9TcGFydGFjdXMvRGF0YWJhc2UucHkKQEAgLTE4NTksNiArMTg1OSwxNiBAQCBj
bGFzcyBQb3N0Z3JlU1FMKEdlbmVyaWMpOgogICAgICAgICAgICAgaWYgbm90IHZfa2VlcDoKICAg
ICAgICAgICAgICAgICBzZWxmLkNsb3NlKCkKIAorICAgIGRlZiBfX2dldHN0YXRlX18oc2VsZik6
CisgICAgICAgIHN0YXRlID0gc2VsZi5fX2RpY3RfXy5jb3B5KCkKKyAgICAgICAgIyBkb24ndCBw
aWNrbGUgJ3Zfc3BlY2lhbCcKKyAgICAgICAgZGVsIHN0YXRlWyJ2X3NwZWNpYWwiXQorICAgICAg
ICByZXR1cm4gc3RhdGUKKworICAgIGRlZiBfX3NldHN0YXRlX18oc2VsZiwgc3RhdGUpOgorICAg
ICAgICBzZWxmLl9fZGljdF9fLnVwZGF0ZShzdGF0ZSkKKyAgICAgICAgIyBhZGQgJ3Zfc3BlY2lh
bCcgYmFjayBzaW5jZSBpdCBkb2Vzbid0IGV4aXN0IGluIHRoZSBwaWNrbGUKKyAgICAgICAgc2Vs
Zi52X3NwZWNpYWwgPSBQR1NwZWNpYWwoKQogCiAnJycKIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQotLSAKMi40
NS4yCgo=
--000000000000913e2a061b4cba83--