borgbackup: Accept newer msgpack versions Upstream borgbackup added a check in February 2019 that requires manually allowlisting new msgpack versions [1]. This was done in response to a number of problematic releases of msgpack back then, which caused problems for borgbackup [2]. This was around the time that Python 3.4 to 3.6 were current, and there seemed to have been problems with support for 3.4, which msgpack dropped early, as well as a data corruption issue in the pure python msgpack when using 0.4.6. [3] In the 0.5.x series of releases, borgbackup upstream had concerns about warnings that broke tests [4], build failures [5], memory leaks [6] and other issues based on the msgpack ChangeLog [7]. Since then, upstream has updated the file that checks for the specific msgpack version 13 times without major problems in: - https://github.com/borgbackup/borg/commit/0ebfaa5b61a675c22cda301bc20d0b00372dd181 - https://github.com/borgbackup/borg/commit/e2ee7fd24b73f560168b89bf8b7d457de58a56ee - https://github.com/borgbackup/borg/commit/da6d1ac538827100fc8a546378fb5fd9bca6ca7d - https://github.com/borgbackup/borg/commit/0937ae90787b7a42f29818a49197e93e1301114b - https://github.com/borgbackup/borg/commit/a970f000b04f808c712eee5e53a32dec66efe803 - https://github.com/borgbackup/borg/commit/1ab90b339e39535e74695b1f5d7176c90f035164 - https://github.com/borgbackup/borg/commit/bc9ce99e9b86f964aad6276c8f5d76983193958c - https://github.com/borgbackup/borg/commit/95e75b90f1a092bad10e0b93ef065e78dfabb227 - https://github.com/borgbackup/borg/commit/cdcab4df6851b5d3da6ac5435bcaeb8aa1d632b5 - https://github.com/borgbackup/borg/commit/a507a2cb3b9fed025743e80971ce1615887a47e4 - https://github.com/borgbackup/borg/commit/d43892d474499a56460753332748f0653a4d571e - https://github.com/borgbackup/borg/commit/862f19aab9780b91424bb7f9319d915751d0024f - https://github.com/borgbackup/borg/commit/467d0604dae10b816b3f80d8237f2f0353d8c27f In once instance, a release (1.0.1) was added to the blocklist: - https://github.com/borgbackup/borg/commit/12d9110882da6fb72537f243dd6bc09cb96c615f The commit message says it is unclear whether the (unspecified) issues affect borgbackup. The upstream msgpack ChangeLog [8] between the blocklisted 1.0.1 release and the allowlisted 1.0.2 refers to a year 2038 regression tracked in [9], which apparently never affected macOS [10]. At the same time, this check for a specific version of msgpack has caused no fewer than 5 tickets for MacPorts because the installed borgbackup broke on users systems when msgpack was updated, and one commit without a ticket for the same problem: - https://trac.macports.org/ticket/56868 - https://trac.macports.org/ticket/58215 - https://trac.macports.org/ticket/68998 - https://trac.macports.org/ticket/69452 - https://trac.macports.org/ticket/72682 - https://github.com/macports/macports-ports/commit/ab8dad0225ef9840744a00588400159fbed976b0 The NetBSD pkgsrc people did ask whether the msgpack check is still required in 2024 [11] without a clear answer. Given the churn this check causes in MacPorts and the improved track record of the msgpack developers in avoiding problems, I think it's time to remove this check. I'll also add a comment to the msgpack Portfile to recommend testing borgbackup and enable the borgbackup testsuite so we can run some downstream tests instead. [1]: https://github.com/borgbackup/borg/commit/18c9feb7e31d9c3dcf8d70cbf89ad520e35d1848 [2]: https://github.com/borgbackup/borg/issues/3753 [3]: https://github.com/borgbackup/borg/issues/3753#issuecomment-380230635 [4]: https://github.com/borgbackup/borg/issues/3753#issuecomment-380231618 [5]: https://github.com/borgbackup/borg/issues/3753#issuecomment-380241819 [6]: https://github.com/borgbackup/borg/issues/3753#issuecomment-380262549 [7]: https://github.com/borgbackup/borg/issues/3753#issuecomment-380399945 [8]: https://github.com/msgpack/msgpack-python/blob/main/ChangeLog.rst#102 [9]: https://github.com/msgpack/msgpack-python/issues/451 [10]: https://github.com/msgpack/msgpack-python/issues/451#issuecomment-747416323 [11]: https://github.com/borgbackup/borg/issues/8144 Upstream-Status: Inappropriate --- pyproject.toml.orig 2025-11-03 15:18:41 +++ pyproject.toml 2025-11-03 15:29:19 @@ -36,8 +36,8 @@ # Please note: # Using any other msgpack version is not supported by Borg development and # any feedback related to issues caused by this will be ignored. - "msgpack >=1.0.3, <=1.1.2", + "msgpack >=1.0.3", "packaging", ] --- src/borg/helpers/msgpack.py.orig 2025-11-05 22:58:07 +++ src/borg/helpers/msgpack.py 2025-11-05 23:00:39 @@ -144,12 +144,14 @@ version_check = os.environ.get('BORG_MSGPACK_VERSION_CHECK', 'yes').strip().lower() - return version_check == 'no' or ( - (1, 0, 3) <= msgpack.version[:3] <= (1, 1, 2) and - msgpack.version not in [] - ) + if version_check == "no": + return True + if msgpack.version in []: + return False + return True + def get_limited_unpacker(kind): """return a limited Unpacker because we should not trust msgpack data received from remote""" # Note: msgpack >= 0.6.1 auto-computes DoS-safe max values from len(data) for