Change:
When trying to update nixos-24.05 from revision to , the check and build fail because is newly marked insecure (unstable PR: , backport PR: ). This breaks users of the package. I don't need the youtube-dl functionality and I don't wanna allow this insecure package on my system. Therefore, I'd appreciate an easier method to not depend on youtube-dl. This requires being able to build sendtokodi without youtube-dl altogether (and ensure sendtokodi does not use it). Either by default or as build option. Upstream seems to be mostly inactive, they won't help us here. Steps to reproduce the behavior: insecure packages (default behavior) to include sendtokodi on recent NixOS 24.05 ( or later) or unstable . Stable NixOS doesn't break on channel updates. Sendtokodi can be used without allowing any insecure packages. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --(the relevant nixpkgs commits/PRs are already referenced, I cannot build the config on the broken revision) Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
sure code was never even used or executed in the entire life of this package in anyways, so all one has to do is remove from line and everything will be fine please go ahead and create a PR and it will be much appreciated :bow:
This isn't entirely true, as users can toggle between the two of them via a configuration. But regardless of that I agree that patching out the dependency is the right thing to do, even if it means that we will dishonor that configuration now. I've created to do so.
right, i sorta glossed over that part we should see if upstream wants to drop backend or not i suppose

Discussion:
}; patches = [ <del> ./use-packaged-deps.patch </del> <ins> # Unconditionally depend on packaged yt-dlp. This removes the ability to # use youtube_dl, which is unmaintained and considered vulnerable (see # CVE-2024-38519). ./use-packaged-yt-dlp.patch </ins> ]; propagatedBuildInputs = [

''; passthru = { <del> # Instead of the vendored libraries, we propagate youtube-dl and yt-dlp via # the Python path. pythonPath = with kodi.pythonPackages; makePythonPath [ youtube-dl yt-dlp ]; </del> <ins> # Instead of the vendored libraries, we propagate yt-dlp via the Python # path. pythonPath = with kodi.pythonPackages; makePythonPath [ yt-dlp ]; </ins> }; meta = with lib; { homepage = "https://github.com/firsttris/plugin.video.sendtokodi"; <del> description = "Plays various stream sites on Kodi using youtube-dl"; </del> <ins> description = "Plays various stream sites on Kodi using yt-dlp"; </ins> license = licenses.mit; maintainers = teams.kodi.members ++ [ maintainers.pks ]; };

<del> diff --git a/service.py b/service.py index 1d7b6e4..9782993 100644 --- a/service.py +++ b/service.py @@ -241,9 +241,9 @@ def playlistIndex(url, playlist): # Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+) if xbmcplugin.getSetting(int(sys.argv[1]),"resolver") == "0" or sys.version_info[0] == 2: -    from lib.youtube_dl import YoutubeDL +    from youtube_dl import YoutubeDL else: -    from lib.yt_dlp import YoutubeDL +    from yt_dlp import YoutubeDL # patch broken strptime (see above) patch_strptime() </del>

<ins> diff --git a/service.py b/service.py index 024ad9a..6ef71dd 100644 --- a/service.py +++ b/service.py @@ -243,11 +243,8 @@ def playlistIndex(url, playlist): # Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+) -if xbmcplugin.getSetting(int(sys.argv[1]),"resolver") == "0" or sys.version_info[0] == 2: -    from lib.youtube_dl import YoutubeDL -else: -    from lib.yt_dlp import YoutubeDL - +from yt_dlp import YoutubeDL + # patch broken strptime (see above) patch_strptime() </ins>