Unable to build xmlsec - dev team says to notify this package's dev team for solution

[sourcematters]

Hi python3-saml dev team - have been unable to pip install python3-saml due to (from my not-great understanding) an incompatibility with xmlsec/libxmlsec1.

When I raised the issue with xmlsec (lsh123/xmlsec#427), they advised to report issue to this dev team.

Can you help?

I'm on an M1 with python 3.11.2 and attempting pip install of python3-saml which is failing to build a wheel for xmlsec.

[garma83]

Also refer to xmlsec/python-xmlsec#254 (comment)

[pitbulk]

@sourcematters, Sorry but it seems there is some confusion.

python3-saml uses the xmlsec library, and its repository on github is:
https://github.com/xmlsec/python-xmlsec
not:
https://github.com/lsh123/xmlsec

@garma83 provided you a link to the right thread and it seems some collaborators provided ways to install it properly.

[cro]

python-xmlsec depends on libxmlsec1. libxmlsec1 >= 1.3 no longer supports SOAP, the SOAP functionality has been removed. Versions of libxmlsec1 that do support SOAP are no longer maintained. I think the OP was raising the issue because as Linux distros begin to package the later libxmlsec1, python3-saml will not be installable. The libxmlsec1 author stated that SOAP support was added "as part of an abandoned project to support SAML" (see lsh123/xmlsec#427 (comment)). The authors of python-xmlsec are approaching this by removing SOAP support in their package, but this is proving to be challenging (xmlsec/python-xmlsec#252). If python3-saml uses the deprecated SOAP functionality we will either have to pin environments to libxmlsec1<1.3 or find another way to parse the SOAP.

Maybe a comment in this project's README might help future users?

[mdgreenwald]

@sourcematters, Sorry but it seems there is some confusion.

python3-saml uses the xmlsec library, and its repository on github is: https://github.com/xmlsec/python-xmlsec not: https://github.com/lsh123/xmlsec

@garma83 provided you a link to the right thread and it seems some collaborators provided ways to install it properly.

@pitbulk While there are workarounds in that thread, they are by no means sustainable and they don't address the underlying incompatibility with libxmlsec1 1.3. A closer look reveals that https://github.com/xmlsec/python-xmlsec appears to be abandoned by the sole maintainer. The readme shows numerous builds failing, several threads have comments requesting that the issue get fixed with no acknowledgement from the maintainer, its not clear that there are any plans to continue maintaining that project. Does the python3-saml project have plans to mitigate this dependency in the future? Or perhaps to fork and maintain a new version? Thanks.

[pitbulk]

No plans for now to migrate from python-xmlsec, but the easiest approach I see is to reuse the xmlsec library that was used in python-saml, dm.xmlsec.binding, but not sure if Dieter Maurer is actively maintaining it, so we could be in a similar situation, I don't see recent releases, but a comment from him on a forum