Paramiko depends on RandomPool

As a follow up to this, pycrypto 2.1.0 has now been released. Which introduces a different way to get random data. It then wraps RandomPool in the new functionality, and issues a deprecation warning.

It would be nice if paramiko would detect the new functionality is available, and use it instead.

It would be really nice if paramiko could not use RandomPool since it spews a very ugly deprecation warning on PyCrypto 2.1.0.

Here's the Linux DeprecationWarning for future reference:

$ python
Python 2.6.4 (r264:75706, Dec 7 2009, 18:43:55)
[GCC 4.4.1] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import Crypto
>>> Crypto.__version__
'2.1.0'
>>> import paramiko
/var/www/pinax-env/lib/python2.6/site-packages/Crypto/Util/randpool.py:40: RandomPool_DeprecationWarning: This application uses RandomPool, which is BROKEN in older releases. See http://www.pycrypto.org/randpool-broken
  RandomPool_DeprecationWarning)

I've made a patch for this here: http://github.com/garyvdm/paramiko

I'm seeing the same error on OpenSUSE 11.3,

> python
Python 2.6.5 (r265:79063, Jul 5 2010, 11:46:13)
[GCC 4.5.0 20100604 [gcc-4_5-branch revision 160292]] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import Crypto
>>> Crypto.__version__
'2.1.0'
>>> import paramiko
/usr/lib64/python2.6/site-packages/Crypto/Util/randpool.py:40: RandomPool_DeprecationWarning: This application uses RandomPool, which is BROKEN in older releases. See http://www.pycrypto.org/randpool-broken
  RandomPool_DeprecationWarning)
>>>

Problem manifests, e.g., @ use of bzr+ssh:// pulls

Jelmer, this hasn't been fixed in paramiko upstream -- did you perhaps mean to change paramiko (Ubuntu) to Fix Committed?

Jelmer, the appropriate procedure is to propose merging your packaging branch with the ubuntu branch. I took the liberty of doing that.

Setting status to Triaged as upstream has this bug and the fix is available. Importance in Ubuntu is Low per Ubuntu bug importance guidelines.

This bug was fixed in the package paramiko - 1.7.6-5ubuntu1

---------------
paramiko (1.7.6-5ubuntu1) natty; urgency=low

  [ Jelmer Vernooij ]

  * Avoid deprecated RandomPool. Patch by Gary van der Merwe. Closes:
    #576697, LP: #271791, LP: #682600.
  * Switch to source format 3.0 (quilt).

  [ Andrew Bennetts ]

  * Try connecting to each available address family until one succeeds.
    LP: #579530
 -- Jelmer Vernooij <email address hidden> Fri, 14 Jan 2011 06:54:41 +0100

It is confusing where the fix is released. I installed a while back on AIX using easy_install paramiko. I am seeing the randpool warning. If I do another easy_install paramiko, will I get the fix or is the fix only for Ubuntu?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 20/01/2011 23:49, Brent S Elmer wrote:
> It is confusing where the fix is released. I installed a while back on
> AIX using easy_install paramiko. I am seeing the randpool warning. If
> I do another easy_install paramiko, will I get the fix or is the fix
> only for Ubuntu?
>

My patch is here: https://github.com/garyvdm/paramiko/. You can do
easy_install http://github.com/garyvdm/paramiko/tarball/master
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk04siQACgkQd/3EdwGKOh3WOACffOvsIUP+Uzt0QY9v62cdYhA5
wUgAoKS6H2IQjTCtB5TrwOtcG6pHUGSg
=j39Q
-----END PGP SIGNATURE-----

Hi Brent,

The fix has been released in the Ubuntu package of paramiko. The upstream fix has been submitted but not merged yet.

On Solaris:

# python -c "import paramiko"
/opt/csw/lib/python2.6/site-packages/Crypto/Util/randpool.py:40: RandomPool_DeprecationWarning: This application uses RandomPool, which is BROKEN in older releases. See http://www.pycrypto.org/randpool-broken
  RandomPool_DeprecationWarning)

Where can I get the patch? I cannot find it on github..

On Thu, 2011-02-10 at 14:27 +0000, Wesley Schwengle wrote:
> On Solaris:
>
> # python -c "import paramiko"
> /opt/csw/lib/python2.6/site-packages/Crypto/Util/randpool.py:40: RandomPool_DeprecationWarning: This application uses RandomPool, which is BROKEN in older releases. See http://www.pycrypto.org/randpool-broken
> RandomPool_DeprecationWarning)
>
> Where can I get the patch? I cannot find it on github..
There are various branches attached to this bug report with the fix.

Cheers,

Jelmer