[tor-bugs] #28682 [- Select a component]: Carml lacks PGP singatures and instructions for secure installation

[Tor Bug Tracker & Wiki]

#28682: Carml lacks PGP singatures and instructions for secure installation
----------------------------------+------------------------
 Reporter:  wagon                 |          Owner:  meejah
     Type:  defect                |         Status:  closed
 Priority:  Medium                |      Milestone:
Component:  - Select a component  |        Version:
 Severity:  Normal                |     Resolution:  fixed
 Keywords:  carml                 |  Actual Points:
Parent ID:                        |         Points:
 Reviewer:                        |        Sponsor:
----------------------------------+------------------------

Comment (by wagon):

 About new
 [[https://carml.readthedocs.io/en/latest/installation.html|installation]]:

 Since Jessie doesn't have `python3-humanize` and `python3-click`, I tried
 manual installation which fails at this stage:
 {{{
 python3 -m pip install --require-hashes --no-deps --requirements
 requirements.txt

 Usage:
   /usr/bin/python3 -m pip install [options] <requirement specifier> ...
   /usr/bin/python3 -m pip install [options] -r <requirements file> ...
   /usr/bin/python3 -m pip install [options] [-e] <vcs project url> ...
   /usr/bin/python3 -m pip install [options] [-e] <local project path> ...
   /usr/bin/python3 -m pip install [options] <archive url/path> ...

 no such option: --require-hashes
 }}}
 Is it because my python3 is too old?
 {{{
 $ python3 --version
 Python 3.4.2
 $ pip3 --version
 pip 1.5.6 from /usr/lib/python3/dist-packages (python 3.4)
 }}}
 In [[https://pip.pypa.io/en/stable/news/?highlight=require-hashes|pip
 changelog]] the first mentioning of this option is for 8.1.0 released in
 2016-03-05, while 1.5.6 was released in 2014-05-16. But changelog doesn't
 list added options in detail, so I'm not sure that 8.1.0 is the first
 version that supports it. If `--require-hashes` is deleted, it blames
 another option:
 {{{
 no such option: --requirements
 }}}
 Change of `--requirements` to `-r` leads to python crash.

 To avoid all these troubles it would be good to have Tor-related software
 in Tor Debian repository. Now it shares only last version of Tor itself,
 while it could share also Stem, Nyx, Carml, Onionshare and similar tools.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/28682#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online