Restrict jsonschema

[Secrus]

Pull Request Check List

Resolves: #8160

This restricts jsonschema to versions below the problematic ones.

[Secrus]

@radoering or @neersighted could you please take a look, backport to 1.5 branch, and do a release of this as a hotfix?

[oc-ben-ellis]

Are hotfixes required for older versions? Just curious but doesn't affect me directly as I'm on 1.5.1.

[Secrus]

Are hotfixes required for older versions? Just curious but doesn't affect me directly as I'm on 1.5.1.

The tricky part is that it's fine for already installed versions, but if you were to reinstall Poetry, it would pull jsonschema 4.18 which requires Rust toolchain. For most systems it will be fine, but as presented in the issue, MUSL based OS will have problems.

[dimbleby]

afaik the jsonschema that poetry requires by regular means is ignored anyway, in favour of the vendored jsonschema in poetry-core...

That vendoring seems likely to become awkward, if there's now effectively a binary-only sub-dependency.

Perhaps should be looking for a way to remove the jsonschema dependency from poetry-core altogether...

[oc-ben-ellis]

@Secrus Looks like this version has a dependency on rust also?

error: can't find Rust compiler

[oc-ben-ellis]

Separate from this PR but maybe worth adding alpine linux to the list of distros to test?

[radoering]

For the BSD tests you probably can just add jsonschema<4.18.0 to

poetry/.cirrus.yml

Line 26 in d31dfa8

- $POETRY_HOME/bin/pip install poetry

[radoering]

Can you add a comment, why we are restricting it?

[Secrus]

Done

[johnthagen]

Has anyone asked for MUSL wheels?

Last I tried to install Poetry on Alpine (year or so ago?) it also failed due to cryptography missing the Rust tool chain, but these days it looks like they publish MUSL wheels?

• https://pypi.org/project/cryptography/41.0.1/#files

Perhaps jsonschema would be open to providing them too?

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.