Pkg xen devel - Dec 2021 - Bug#1001256: Rearrange packages (break PyGRUB off, perhaps others too)

Package: src:xen
Version: 4.14.3+32-g9de3671772-1
Severity: wishlist
>From experimentation there is minimal or no version association needed
for the initial stage bootloaders.  The Xen 4.11 version of PyGRUB was
perfectly able to load kernel/initrd for Xen 4.14.  It really would be
better to discourage use of PyGRUB with its security implications.
Additionally there is at least one additional bootloader besides PvGRUB
available (Tianocore).

Might be nice to only install xenstored or oxenstored.  I suspect most
installations will only need one.


-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \BS (    |         ehem+sigmsg at m5p.com  PGP 87145445         |    )   /
  \_CS\   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445

Control: found 1001256 4.16.0-1~exp1
Control: affects src:xen 978595

I doubt this set is an adequate job, but hopefully they function as rough
proof of concept patches.

PyGRUB is mostly independent of the rest of Xen.  I've confirmed the
PyGRUB build associated with xen-utils-4.11 works fine for loading Linux
with Xen 4.14 or 4.16.  Mostly PyGRUB is dependent on filesystem support,
so as long as ext4 remains popular and doesn't grow incompatible
features, older versions of PyGRUB will continue functioning.

On x86 PvGRUB is vastly superior to PyGRUB in nearly every way.
Presently though PvGRUB is unavailable for ARM(64).

Using EDK2 as a bootloader functions quite well on ARM(64) and work is
under way to have that functioning on x86.  See bug #978595.  This
successfully boots FreeBSD on Xen/ARM (work in-progress).



As such create a xen-domu-bootloader virtual package and make the
resultant xen-pygrub package provide this.  Ideally grub-xen-host would
start providing this.

I suspect xen-pygrub may need to be marked as "Replaces: xen-utils-*"
for
some set of versions.  This would be to ensure PyGRUB isn't lost during
upgrade.


-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \BS (    |         ehem+sigmsg at m5p.com  PGP 87145445         |    )   /
  \_CS\   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445


-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-debian-control-Update-utils-Recommends.patch
Type: text/x-diff
Size: 1452 bytes
Desc: not available
URL:
<http://alioth-lists.debian.net/pipermail/pkg-xen-devel/attachments/20220227/7c17c75f/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-debian-Add-architecture-triplet-to-template-subst.patch
Type: text/x-diff
Size: 1404 bytes
Desc: not available
URL:
<http://alioth-lists.debian.net/pipermail/pkg-xen-devel/attachments/20220227/7c17c75f/attachment-0001.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-debian-Break-PyGRUB-into-package-separate-from-Xen.patch
Type: text/x-diff
Size: 4060 bytes
Desc: not available
URL:
<http://alioth-lists.debian.net/pipermail/pkg-xen-devel/attachments/20220227/7c17c75f/attachment-0002.patch>

Processing control commands:
> found 1001256 4.16.0-1~exp1
Bug #1001256 [src:xen] Rearrange packages (break PyGRUB off, perhaps others too)
Marked as found in versions xen/4.16.0-1~exp1.
> affects src:xen 978595
Unknown command or malformed arguments to command.


-- 
1001256: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001256
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems

Control: found 1001256 4.17.5+23-ga4e5191dc0-1
Control: found 1001256 4.17.5+23-ga4e5191dc0-1+deb12u1
Control: found 1001256 4.20.0+68-g35cb38b222-1
Control: severity 1001256 normal

The main issue #1001256 is pointing at is the Python dependency.  Since
xen-utils-4.17 dependes on Python 3.11, while xen-utils-4.20 depends on
Python 3.13 it is impossible to install them simultaneously.  In turn
this makes upgrades far more troublesome than they otherwise need to be.

For xen-utils-4.17 the files:
/usr/lib/xen-4.17/bin/convert-legacy-stream
/usr/lib/xen-4.17/bin/pygrub
/usr/lib/xen-4.17/bin/verify-stream-v2
/usr/lib/xen-4.17/bin/xenpvnetboot

Are Python 3 scripts.

For xen-utils-4.20 the files:
/usr/lib/xen-4.17/bin/convert-legacy-stream
/usr/lib/xen-4.17/bin/pygrub
/usr/lib/xen-4.17/bin/verify-stream-v2

Likely remain Python 3 scripts.

I would suggest creating xen-utils-X.YY-python to split the Python
scripts out of the main xen-utils-X.YY package.  Other trick is
grub-xen-host sort of makes PyGRUB deprecated.


-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \BS (    |         ehem+sigmsg at m5p.com  PGP 87145445         |    )   /
  \_CS\   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445

Processing control commands:
> found 1001256 4.17.5+23-ga4e5191dc0-1
Bug #1001256 [src:xen] Rearrange packages (break PyGRUB off, perhaps others too)
Marked as found in versions xen/4.17.5+23-ga4e5191dc0-1.
> found 1001256 4.17.5+23-ga4e5191dc0-1+deb12u1
Bug #1001256 [src:xen] Rearrange packages (break PyGRUB off, perhaps others too)
Marked as found in versions
xen/4.17.5+23-ga4e5191dc0-1+deb12u1.
> found 1001256 4.20.0+68-g35cb38b222-1
Bug #1001256 [src:xen] Rearrange packages (break PyGRUB off, perhaps others too)
Marked as found in versions xen/4.20.0+68-g35cb38b222-1.
> severity 1001256 normal
Bug #1001256 [src:xen] Rearrange packages (break PyGRUB off, perhaps others too)
Severity set to 'normal' from 'wishlist'

-- 
1001256: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001256
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems

On Mon, Nov 03, 2025 at 03:26:01PM -0800, Elliott Mitchell
wrote:
> Are Python 3 scripts.
If it would be just about scripts, it should be possible to make it
depends on any python3 version, but there are also a bunch of python
libs:
/usr/lib/xen-4.20/lib/python/grub/ExtLinuxConf.py
/usr/lib/xen-4.20/lib/python/grub/GrubConf.py
/usr/lib/xen-4.20/lib/python/grub/LiloConf.py
/usr/lib/xen-4.20/lib/python/grub/__init__.py
/usr/lib/xen-4.20/lib/python/pygrub-0.7.egg-info/PKG-INFO
/usr/lib/xen-4.20/lib/python/pygrub-0.7.egg-info/dependency_links.txt
/usr/lib/xen-4.20/lib/python/pygrub-0.7.egg-info/top_level.txt
/usr/lib/xen-4.20/lib/python/xen-3.0.egg-info/PKG-INFO
/usr/lib/xen-4.20/lib/python/xen-3.0.egg-info/dependency_links.txt
/usr/lib/xen-4.20/lib/python/xen-3.0.egg-info/top_level.txt
/usr/lib/xen-4.20/lib/python/xen/__init__.py
/usr/lib/xen-4.20/lib/python/xen/lowlevel/__init__.py
/usr/lib/xen-4.20/lib/python/xen/lowlevel/xc.cpython-313-x86_64-linux-gnu.so
/usr/lib/xen-4.20/lib/python/xen/lowlevel/xs.cpython-313-x86_64-linux-gnu.so
/usr/lib/xen-4.20/lib/python/xen/migration/__init__.py
/usr/lib/xen-4.20/lib/python/xen/migration/legacy.py
/usr/lib/xen-4.20/lib/python/xen/migration/libxc.py
/usr/lib/xen-4.20/lib/python/xen/migration/libxl.py
/usr/lib/xen-4.20/lib/python/xen/migration/public.py
/usr/lib/xen-4.20/lib/python/xen/migration/tests.py
/usr/lib/xen-4.20/lib/python/xen/migration/verify.py
/usr/lib/xen-4.20/lib/python/xen/migration/xl.py
/usr/lib/xen-4.20/lib/python/xen/util.py
/usr/lib/xen-4.20/lib/python/xenfsimage.cpython-313-x86_64-linux-gnu.so

Some of those might be used by other software.
> I would suggest creating xen-utils-X.YY-python to split the Python
> scripts out of the main xen-utils-X.YY package.
That might help, if such xen-utils-X.YY-python would not be installed
(or at least would not be needed during upgrade). But is it the case?
> Other trick is grub-xen-host sort of makes PyGRUB deprecated.
TBH, it's a good idea to get rid of PyGRUB anyway, for so many
reasons...

-- 
Best Regards,
Marek Marczykowski-G?recki
Invisible Things Lab
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL:
<http://alioth-lists.debian.net/pipermail/pkg-xen-devel/attachments/20251104/1d8f07c6/attachment.sig>

On Tue, Nov 04, 2025 at 01:22:48AM +0100, Marek Marczykowski-G?recki
wrote:
> On Mon, Nov 03, 2025 at 03:26:01PM -0800, Elliott Mitchell wrote:
> > Are Python 3 scripts.
> 
> If it would be just about scripts, it should be possible to make it
> depends on any python3 version, but there are also a bunch of python
> libs:
> /usr/lib/xen-4.20/lib/python/grub/ExtLinuxConf.py
> /usr/lib/xen-4.20/lib/python/grub/GrubConf.py
> /usr/lib/xen-4.20/lib/python/grub/LiloConf.py
> /usr/lib/xen-4.20/lib/python/grub/__init__.py
> /usr/lib/xen-4.20/lib/python/pygrub-0.7.egg-info/PKG-INFO
> /usr/lib/xen-4.20/lib/python/pygrub-0.7.egg-info/dependency_links.txt
> /usr/lib/xen-4.20/lib/python/pygrub-0.7.egg-info/top_level.txt
> /usr/lib/xen-4.20/lib/python/xen-3.0.egg-info/PKG-INFO
> /usr/lib/xen-4.20/lib/python/xen-3.0.egg-info/dependency_links.txt
> /usr/lib/xen-4.20/lib/python/xen-3.0.egg-info/top_level.txt
> /usr/lib/xen-4.20/lib/python/xen/__init__.py
> /usr/lib/xen-4.20/lib/python/xen/lowlevel/__init__.py
>
/usr/lib/xen-4.20/lib/python/xen/lowlevel/xc.cpython-313-x86_64-linux-gnu.so
>
/usr/lib/xen-4.20/lib/python/xen/lowlevel/xs.cpython-313-x86_64-linux-gnu.so
> /usr/lib/xen-4.20/lib/python/xen/migration/__init__.py
> /usr/lib/xen-4.20/lib/python/xen/migration/legacy.py
> /usr/lib/xen-4.20/lib/python/xen/migration/libxc.py
> /usr/lib/xen-4.20/lib/python/xen/migration/libxl.py
> /usr/lib/xen-4.20/lib/python/xen/migration/public.py
> /usr/lib/xen-4.20/lib/python/xen/migration/tests.py
> /usr/lib/xen-4.20/lib/python/xen/migration/verify.py
> /usr/lib/xen-4.20/lib/python/xen/migration/xl.py
> /usr/lib/xen-4.20/lib/python/xen/util.py
> /usr/lib/xen-4.20/lib/python/xenfsimage.cpython-313-x86_64-linux-gnu.so
Guess I missed explicitly stating it, but I expected these to travel with
the scripts.  Actually I wonder whether the Python version dependency is
*strictly* the libraries while the scripts might work with a much wider
range of Python versions.
> Some of those might be used by other software.
Not visible in Debian.  Nothing outside of src:xen depends on
xen-utils-X.YY, so if this is so then something has a packaging error.
> > I would suggest creating xen-utils-X.YY-python to split the Python
> > scripts out of the main xen-utils-X.YY package.
> 
> That might help, if such xen-utils-X.YY-python would not be installed
> (or at least would not be needed during upgrade). But is it the case?
The *stream* scripts are likely for loading/transfering in VM images.  I
certainly hope no one plans to transfer live VMs in *during* an update.

The bigger issue is when installing Xen 4.20 on a system currently
running Xen 4.17, you *urgently* want to have most 4.17 and 4.20
utilities installed simultaneously.  Only once 4.20 is confirmed
operational should one remove the 4.17 utilities.

In particular due to them conflicting you must follow a series of steps.
First, install hypervisor 4.20.  Second, stop/migrate all currently
operational VMs.  Third, reboot.  Fourth, install xen-utils-4.20.

You cannot install the 4.20 utilities before reboot since you lose the
ability to stop currently running VMs.  This is particularly troublesome
if your bastion host happens to be a VM.
> > Other trick is grub-xen-host sort of makes PyGRUB deprecated.
> 
> TBH, it's a good idea to get rid of PyGRUB anyway, for so many
> reasons...
Indeed.  For x86 I think it would be a Fine Idea to remove PyGRUB from
future xen-utils-X.YY packages.  For ARM, until PyGRUB gets ported to
ARM it needs to remain.

The other bootloader which I've gotten good results with is
Tianocore/EDK2.  That though has an outstanding crucial bugfix, but also
needs to be ported to x86.


-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \BS (    |         ehem+sigmsg at m5p.com  PGP 87145445         |    )   /
  \_CS\   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445