stream-zip: upstream repository gone

[avalentino]

While the package for stream-zip in PyPi.org is still available, the source code repository has been removed from GitHub and it is not clear what is the development status of the project.

Being stream-zip a dependency of eodag, this could be an issue in the future:

• no security fixes
• no bug fixes/enhancements
• no updates to support new Python versions or compatibility with other packages

The stream-zip package has been also removes from Debian and Ubuntu due to this unclear upstream state, and this implies the impossibility to have eodag packages for Debian and Debian derivatives.

My question is:

• do you have a plan to remove the dependency of eodag from stream-zip?
• is there any alternative library with compatible or similar API that could be used instead
• is there any workaround that can be put in place in the short term to avoid the use of stream-zip?

[sbrunato]

Thanks for this information @avalentino , I just contacted the support to have explanations on the status of stream-zip.
And you are right, we already have to think about alternatives.

[sbrunato]

their answer :

We're unable to provide more information due to Section 24 of FOIA.
You can read more about Section 24 here: https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-24-safeguarding-national-security

We definitely have to find an alternative

[sbrunato]

chosen alternative is zipstream-ng, it will be implemented in the next release #1805

[avalentino]

FYI, we have just include eodag in Debian (see https://tracker.debian.org/pkg/eodag).
For the time being we have vendored stream-zip (see https://salsa.debian.org/debian-gis-team/eodag/-/blob/master/debian/patches/0004-vendor-stream_zip.patch?ref_type=heads) but it is considered a temporary workaround waiting for the the solution you will implement upstream.

[sbrunato]

great for the debian package, many thanks!