Re: [PATCH v2 2/2] python/sepolicy: add a pyproject.toml file

Cathy Hu <[email protected]> Wed, 29 Jul 2026 17:29:35 +0200
Newsgroups	org.kernel.vger.selinux
Message-ID	<[email protected]>
On 7/29/26 3:10 PM, Stephen Smalley wrote:
> On Wed, Jul 29, 2026 at 8:39 AM Cathy Hu <[email protected]> wrote:
>>
>> On 7/24/26 7:51 PM, Stephen Smalley wrote:
>>> Add a pyproject.toml file for the sepolicy python module.  This
>>> required also updating setup.py to avoid defining author outside of
>>> pyproject.toml, and I further updated the authors to refer to the list
>>> like libselinux since Dan is enjoying retirement.
>>>
>>> Fixes: https://github.com/SELinuxProject/selinux/issues/505
>>> Signed-off-by: Stephen Smalley <[email protected]>
>>> ---
>>> v2 drops the dependencies since those were breaking, presumably
>>> because the libselinux python module is just called "selinux"?
>>> I remain unsure as to the correctness/completeness of these but
>>> they did pass the CI fully.
>>
>> I think dropping the dependencies is fine ATM, as setup.py also did not add those dependencies.
>>
>> The testing farm (https://github.com/SELinuxProject/selinux/actions/runs/30099962012/job/89503238013) failed i think because:
>> $ python3 -m pip install --no-build-isolation --force-reinstall --prefix=/usr `test -n "" && echo --root  --ignore-installed --no-deps` dist/*.whl
>>
>> and test -n "" is false (should be DESTDIR), so --no-deps is not used and the dependency section is checked.
>>
>> In our build DESTDIR is set to the BUILDROOT so it was not checking the dependency section anyway.
>>
>>>
>>>    python/sepolicy/pyproject.toml | 15 +++++++++++++++
>>>    python/sepolicy/setup.py       |  2 --
>>>    2 files changed, 15 insertions(+), 2 deletions(-)
>>>    create mode 100644 python/sepolicy/pyproject.toml
>>>
>>> diff --git a/python/sepolicy/pyproject.toml b/python/sepolicy/pyproject.toml
>>> new file mode 100644
>>> index 00000000..d33e78c8
>>> --- /dev/null
>>> +++ b/python/sepolicy/pyproject.toml
>>> @@ -0,0 +1,15 @@
>>> +[build-system]
>>> +requires = ["setuptools", "wheel"]
>>> +build-backend = "setuptools.build_meta"
>>> +
>>> +[project]
>>> +name = "sepolicy"
>>> +version = "3.11"
>>> +description = "Python tools for SELinux policy analysis (sepolicy, sepolgen)"
>>> +license = "GPL-2.0-or-later"
>>> +authors = [
>>> +    { name = "SELinux Project", email = "[email protected]" }
>>> +]
>>> +
>>
>>
>>> +[project.scripts]
>>> +sepolicy = "sepolicy.__main__:main"
>>
>> I had a deeper look and I am not sure if this scripts part is needed.
>>
>> Because sepolicy will throw an error when installed with pip only:
>>
>> $ cd python/sepolicy
>> $ python3 -m venv --system-site-packages env
>> $ source env/bin/activate
>> $ pip install .
>> $ sepolicy --help
>> ModuleNotFoundError: No module named 'sepolicy.__main__'
>>
>> Because by adding the [project.scripts] tag, setuptools writes this into env/bin/sepolicy:
>>
>> import sys
>> from sepolicy.__main__ import main
>> if __name__ == '__main__':
>>       sys.argv[0] = sys.argv[0].removesuffix('.exe')
>>       sys.exit(main())
>>
>> But __main__.py and main() does not exist, so it won't work I think.
>>
>> Probably this part is not needed in this case anyway because sepolicy.py gets installed "manually" here IIUC:
>>
>> https://github.com/SELinuxProject/selinux/blob/ad7efacea997ebad8c14b6472cca58993a35d2d2/python/sepolicy/Makefile#L31-L32
>>
>> So might make sense to delete the scripts section.
>>
>>> diff --git a/python/sepolicy/setup.py b/python/sepolicy/setup.py
>>> index ca0396b5..5c4f2e5d 100644
>>> --- a/python/sepolicy/setup.py
>>> +++ b/python/sepolicy/setup.py
>>> @@ -8,8 +8,6 @@ setup(
>>>        name="sepolicy",
>>>        version="3.11",
>>>        description="Python SELinux Policy Analyses bindings",
>>> -    author="Daniel Walsh",
>>> -    author_email="[email protected]",
>>>        packages=[
>>>            "sepolicy",
>>>            "sepolicy.templates",
>>
>> I thought maybe the duplicate definitions (name, version,...) in setup.py could be dropped,
>> but I tested it and the (gcc,pypy3.7) runner [0] still takes the definitions from setup.py
>> even though pyproject.toml exists because setuptools-47.1.0 < 61.0.0.
>>
>> Which means, it can not find the definitions when setup.py was dropped.
>>   From the runner (https://github.com/ca-hu/selinux/commit/3a0836b98f846af3981081b87ab73e5f5ed3f97b):
>>> Test .gitignore and make clean distclean
>>     error: missing .gitignore entry for libselinux/src/UNKNOWN.egg-info/
>>     error: missing .gitignore entry for python/sepolicy/UNKNOWN.egg-info/
>>
>> ^ see UNKNOWN instead of the package name
>>
>> Which makes me wonder if the author+author_email needs to be kept in the setup.py as well if setuptools < 61.0.0 is still supported
>> and it needs to be backwards compatible.
>>
>> In case setuptools < 61.0.0 is not supported anymore by the selinux toolchain (it is at least not by setuptools upstream), it might be possible to drop the setup.py entirely for sepolicy and rely on pyproject.toml alone.
>> Example:
>> https://github.com/ca-hu/selinux/commit/3a0836b98f846af3981081b87ab73e5f5ed3f97b
>>
>> At least on the openSUSE/SUSE SLES side, iiuc we have setuptools >= 61.0.0 for all supported versions, but I don't know about other distributions.
>>
>>
>> But feel free to disregard my review and merge it, it is building fine as is on our end.
> 
> Could you create and submit a v3 of these patches after testing on
> your end? I'm basically operating blind with these since I am not
> familiar with pyproject.toml or setup.py.

sure, I sent them now with the assumption that setuptools < 61 needs to be still supported, which means keeping setup.py as is in your patches.

also, please note that I don't have the permission to start the test farm, so I can only run the direct github CI and the opensuse builds,
which pass both.
OpenPGP_signature.asc (application/pgp-signature, 870 B)