Problem with using v0.4 package

[szszszsz]

After installing the latest pynitrokey v0.4, it cannot be called successfully:

$ nitropy
AttributeError: module 'pynitrokey' has no attribute 'fido2' 

• correct
• add CI check
• check dependencies

[daringer]

cannot reproduce ;(

# to not rely on pip for removal
$ sudo rm -rf /usr/lib/python3.8/pynitrokey* /usr/bin/nitropy

# install
$ sudo pip install pynitrokey

# run
$ nitropy
*** Nitrokey tool for Nitrokey FIDO2 & Nitrokey Start
Usage: nitropy [OPTIONS] COMMAND [ARGS]...

Options:
  --help  Show this message and exit.

Commands:
  fido2    Interact with Nitrokey FIDO2 keys, see subcommands.
  ls       List Nitrokey keys (in firmware or bootloader mode)
  start    Interact with 'Nitrokey Start' keys, see subcommands.
  version  Version of pynitrokey library and tool.

dang, "works on my computer" ... will check CI, or better do a pip-based CI
ok, but CircleCI also seems to work: https://app.circleci.com/pipelines/github/Nitrokey/pynitrokey/13/workflows/b96038f1-36e9-41e9-8bc5-fb5e5a35129e , but will add a release install and run CI now to be sure

[daringer]

please check:
https://app.circleci.com/pipelines/github/Nitrokey/pynitrokey/16/workflows/66511b0e-ee25-43ab-aeb6-db2950ed3834/jobs/29

any chance you forgot to use -U or something with pip?
You could also crosscheck the Makefile and tell me the difference between your install process and the one CI-ed....

[szszszsz]

The reproduction scenario is a simple call of pip install without the -U, on a used system, with previously installed fido2 0.7.x library (so potential upgrade path from 0.3.2).

I believe the problem lies in the requirements file, where fido2 dependency lowest version is not set:

pynitrokey/pyproject.toml

Lines 13 to 24 in 6917b2f

	requires = [
	"click >= 7.0",
	"cryptography",
	"ecdsa",
	"fido2",
	"intelhex",
	"pyserial",
	"pyusb",
	"requests",
	"pygments",
	"cffi",
	"cbor",

Could you update the dep version here as well by the way?

• https://github.com/Nitrokey/pynitrokey/blob/master/ci-requirements.txt#L5

[daringer]

ah ok, good finding, will be fixed in a moment

[daringer]

added to CI, to not fall over it anytime later:
https://app.circleci.com/pipelines/github/Nitrokey/pynitrokey/18/workflows/f98833c7-503e-48dc-b57d-ff0bcf94c2eb/jobs/36

[szszszsz]

While at the topic, I would go into more general way of update process check: install the previous version first, then update to latest to see, if all dependencies were set up correctly. That would require locking versions at the time at release though (either pip freeze or pipenv lock.

[szszszsz]

Hi!
Could you make a release with that? It breaks CI unless the proper package is pinned.
Edit: https://travis-ci.org/github/Nitrokey/nitrokey-fido2-firmware/builds/729911220#L1107