[python3-yaml] update to 5.4.1.1. Contributes to JB#58954

[nephros]

There are three possible update candidates for this package:

• 5.3.1: the most conservative change, mainly a security fix link to changes
• 5.4.1(.1): some changes and another CVE fix link to changes
• 6.0: latest released version link to changes

The fork this PR originates from has branches implementing a bump for each of those. 5.4 is proposed here as a middle ground between conservative bump and security fixes gained.

For testing packages are available for each of these: https://build.merproject.org/project/show/home:nephros:sailfishos:python

The main motivation for this PR is the ability to bump the 'yq' tool (in chum) to a more recent version - which requires pyyaml >= 3.5.1.
Due to the "don't ship packages which replace system packages" agreement on Chum, we can't bump pyyaml there.

The only user of this package I am aware of is the spectacle tool, which works fine with 5.4.x, but there might be others to test.

[nephros]

The current .spec packages documentation as well.

If requested, I can remove those from the package (or put in a subpackage) after the version has been decided.

[vigejolla]

To me updating to 5.4.1.1 makes most sense. I created an item for this in our internal bug tracker, so perhaps you could add "JB#58954" to the commit message?

As for the documentation, your suggestion to separate it to a subpackage makes sense, but let's do that in a separate PR.

[Thaodan]

Please also add 'BuildRequires pkgconfig(yaml-0.1)' so it picks up libyaml properly instead of using internal yaml implementation.

[nephros]

dependency added and squashed

[nephros]

rpmlint suggests to switch to BuildArch: noarch.

Is it right? I'm never sure with python packages.

[vigejolla]

dependency added and squashed

I kind of wish Thaodan hadn't asked you to add the dependency, as it's a bit out of scope here. The old version wasn't using libyaml either. But anyway, since you already started moving towards that direction... Just adding pkgconfig(yaml-0.1) isn't enough. You need python3dist(cython) as well.

[vigejolla]

rpmlint suggests to switch to BuildArch: noarch.

Is it right? I'm never sure with python packages.

Well, technically speaking, for the current package, rpmlint speaks the truth. However, once you get it to use libyaml, it will contain architecture-specific library, so after that noarch will no longer do. But I suppose rpmlint will also stop complaining.

[vigejolla]

According to my tests, it seems to work. However, I would still like those commits cleaned up a bit before merging. i.e. both BuildRequirements added in a single commit, with a nice commit message with a changelog entry. e.g. [python3-yaml] Use libyaml instead of internal implementation

[vigejolla]

Thank you!