Failure to import with newer python-3.11.10 due to TypeError

[UnitedMarsupials]

The 0.7.1, freshly built against Heimdal, fails in the simple line:

import krb5

The exception is:

  File ".../secrets.py", line 6, in <module>
    import krb5
  File "/opt/lib/python3.11/site-packages/krb5/__init__.py", line 87, in <module>
    from krb5._set_password import (
  File "src/krb5/_set_password.pyx", line 68, in init krb5._set_password
TypeError: function() argument 'code' must be code, not str

Please, advise. Thank you!

[jborean93]

I cannot replicate this on Debian 12 through a container

# podman run --rm -it --volume "$( pwd )":/tmp/build:z --workdir /tmp/build debian:12 /bin/bash

export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get -y install \
    python3 \
    python3-{pip,dev,venv} \
    heimdal-{clients,dev,kdc}

python3 -m venv .venv
source .venv/bin/activate
pip install .

python3 --version              # Python 3.11.2
krb5-config --version        # heimdal 7.8.0
python3 -c "import krb5"  # No output as expected

Can you share

• What OS/distro/version you built this on
• How did you install/link to Heimdal
• How did you install this package

[UnitedMarsupials]

I'm trying this on FreeBSD-14.x using the security/py-krb5 port. It fails the same regardless of whether I use older Heimdal included in the OS (1.1.0), or the newer version 7.8.0 installed by its own port.

My Python is 3.11.10, though -- not 3.11.2. Maybe, that is the culprit?

(Tried updating to 3.11.11 -- same error...)

[UnitedMarsupials]

This is the problem -- in _set_password.pyx:

class SetPasswordResult(typing.NamedTuple):
    result_code: SetPasswordResultCode
    result_code_string: bytes
    server_response: bytes

In the older Python-versions, typing.NamedTuple is a class and can be inherited from (subclassed). But in newer versions it is a function:

>>> import typing
>>> type(typing.NamedTuple)
<class 'function'>

which cannot be inherited and Python is being a duck with the obscure error-message :-( Rewriting the above snippet as:

SetPasswordResult = typing.NamedTuple('SetPasswordResult',
    result_code = SetPasswordResultCode,
    result_code_string = bytes,
    server_response = bytes)

seems to work -- but should be tested against older Python-versions...

[jborean93]

While I can see the type of NamedTuple has changed the function can still be subclassed and work as normal. Both methods are valid but the subclassing of typing.NamedTuple is a perfectly valid way of defining one and has the added benefit of also being able to define the type annotations.

I'll have to try and setup a FreeBSD host to test this out as it seems like potentially their version of CPython has some customisations that stop this from working. Either that of the cython generated code they used has produced a binary that is not usable with their environment.

[UnitedMarsupials]

I'll have to try and setup a FreeBSD host to test this out as it seems like potentially their version of CPython

I suspect, you'll be able to reproduce the problem just by updating your Python to the latest 3.11.11 or 3.11.10...

[jborean93]

Python 3.11.11 works just fine with this syntax

$ python --version
Python 3.11.11
$ python
Python 3.11.11 (main, Jan 12 2025, 10:34:26) [GCC 14.2.1 20240912 (Red Hat 14.2.1-3)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import typing
>>> 
>>> class MyTuple(typing.NamedTuple):
...     foo: str
...     bar: str
... 
>>> MyTuple(foo='abc', bar='def')
MyTuple(foo='abc', bar='def')

It's even called out in the Python docs as a valid way to define a named tuple with type annotations. See the seealso section in https://docs.python.org/3/library/collections.html#namedtuple-factory-function-for-tuples-with-named-fields.

See typing.NamedTuple for a way to add type hints for named tuples. It also provides an elegant notation using the class keyword:

Also to prove it works when compiled through Cython I install krb5 in that venv and was able to import it just fine

pip show krb5
python -c "import krb5; print(krb5.SetPasswordResult(1, b'foo', b'bar'))"

Name: krb5
Version: 0.7.1
Summary: Kerberos API bindings for Python
Home-page: https://github.com/jborean93/pykrb5
Author: Jordan Borean
Author-email: jborean93@gmail.com
License: MIT
Location: /home/jborean/.pyenv/versions/3.11.11/envs/test-venv/lib/python3.11/site-packages
Requires: 
Required-by: 

SetPasswordResult(result_code=1, result_code_string=b'foo', server_response=b'bar')

[UnitedMarsupials]

Python 3.11.11 works just fine with this syntax

I give up then :-( The exception is known -- and I got the proposed solution from StackOverflow. I'm puzzled, why it does not show up for you...

[jborean93]

The SO post (and the CPython docs) all indicate the typing.NamedTuple method is valid. Some people even recommend that syntax over the function variant but I've not seen anythin official that recommends one over the other. It's certainly true that typing.NamedTuple changed from a class to a function but it's still valid syntax.

My guess is that the krb5 package built by FreeBSD was with an older version of Cython so that compiled code isn't valid with how 3.11 is interpreting it. I need to setup an environment with FreeBSD to verify but by all accounts the syntax is valid and should work, it's a matter of figuring out why it doesn't.

[bhallnz]

I was experiencing this with python 3.9.10 (Which is needed for CY2022 VFX Reference Platform support). It was built on ubuntu 22.04 using separately compiled python and gcc 9.4.0 with cython 3.0.10. The _set_password.pyx patch fixed it.

[jborean93]

I've been able to track down the root cause behind this. If the krb5 package was compiled during installation by a Cython version that is too old then it will fail with this error.

# podman run --interactive --rm --tty almalinux:9

dnf install -y krb5-{devel,libs,workstation} gcc python3.11-{devel,pip,setuptools,wheel}

python3.11 -m pip install 'Cython==0.29.32'
python3.11 -m pip install krb5 --verbose --no-cache-dir --no-build-isolation
python3.11 -c "import krb5"

In this case I am using Cython 0.29.32 to replicate the error. This library pins Cython to Cython == 3.1.3 which is a lot newer than 0.29.32. When building krb5 against this build requirement things work just fine on the same Python install.

In an ideal situation you should not be disabling build isolation with tools like pip as it will ensure the correct build dependencies are met. In the cases where you are disabling build isolation or overriding the build deps with a constraints file set in the environment it is up to the caller to ensure the build deps are met. Failing to do so will result in errors like this.

[hackworth]

I ran into this issue when using a RedHat published Ansible Execution Environment. It appears krb5 is built into the EE image RedHat publishes, and attempting to use Python 3.11 inside that EE throws this error. Adding the following to uninstall the preinstalled krb5, then installing it later fixed the issue

append_base:
    - RUN python3.11 -m pip uninstall krb5 -y

Thanks @jborean93 for tracking down the cause!

[jborean93]

Yea the EE is what prompted me to look again. They are aware of the problem and are looking to push a fix hopefully sometime shortly.