az keyvault: module 'inspect' has no attribute 'getargspec' (Python 3.11)

[nemobis]

This is autogenerated. Please review and update as needed.

Describe the bug

Command Name
az keyvault secret show

Errors:

module 'inspect' has no attribute 'getargspec'

Traceback:

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.11/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
    raise ex
  File "/usr/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
    result = cmd_copy(params)
             ^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
    return self.handler(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/azure/cli/command_modules/keyvault/_command_type.py", line 138, in keyvault_command_handler
    return keyvault_exception_handler(self.command_loader, ex)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/azure/cli/command_modules/keyvault/_command_type.py", line 51, in keyvault_exception_handler
    raise CLIError(ex)
knack.util.CLIError: module 'inspect' has no attribute 'getargspec'

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Put any pre-requisite steps here...
• az keyvault secret show --vault-name {} --name {}

Expected Behavior

Not error out

Environment Summary

azure-cli installed from Fedora repositories, both Fedora 37and Fedora 38

Linux-6.2.11-200.fc37.x86_64-x86_64-with-glibc2.36, Fedora Linux 37 (KDE Plasma)
Python 3.11.3
Installer: RPM

azure-cli 2.48.1

Additional Context

inspect.getargspec() was deprecated in Python 3.0 (released in 2008),

python/cpython#100680 (comment)

In master it's supposed to be called only for backward compatibility:

$ ack -C1 getargspec
src/azure-cli-core/azure/cli/core/util.py
664-    except AttributeError:
665:        sig = inspect.getargspec(op)  # pylint: disable=deprecated-method
666-        return sig.args

src/azure-cli-testsdk/azure/cli/testsdk/scenario_tests/utilities.py
72-    if not is_preparer_func(fn):
73:        args, _, kw, _ = inspect.getargspec(fn)  # pylint: disable=deprecated-method
74-        if kw is None:

src/azure-cli/azure/cli/command_modules/keyvault/vendored_sdks/azure_keyvault_t1/key_vault_authentication.py
61-        return self._user_callback(server, resource, scope) \
62:            if len(inspect.getargspec(self._user_callback).args) == 3 \
63-            else self._user_callback(server, resource, scope, scheme)

[yonzhan]

Thank you for opening this issue, we will look into it.

[nemobis]

Works for me after monkey patching that BC code in _auth_callback_compat() from

        return self._user_callback(server, resource, scope) \
            if len(inspect.getargspec(self._user_callback).args) == 3 \
            else self._user_callback(server, resource, scope, scheme)

to

    def _auth_callback_compat(self, server, resource, scope, scheme):
        try:
            return self._user_callback(server, resource, scope, scheme)
        except Exception:
            return self._user_callback(server, resource, scope)

I'd create a PR but probably you know better which exception class to use so that it actually falls back where needed.

[ChandlerSwift]

I also got hit pretty hard by this issue today, so I did a bit of digging. Here's what I found!

I'm running azure-cli 2.48.1-3 on Arch Linux from the AUR, which places everything in /opt.

I first found the file referenced above (src/azure-cli/azure/cli/command_modules/keyvault/vendored_sdks/azure_keyvault_t1/key_vault_authentication.py, in my case found at /opt/azure-cli/lib/python3.11/site-packages/azure/cli/command_modules/keyvault/vendored_sdks/azure_keyvault_t1/key_vault_authentication.py) and edited it, but that wasn't sufficient to solve the problem for me. In fact, I did a fair bit of testing and it looks like that function isn't even called!

Instead, the file I wanted to edit was /opt/azure-cli/lib/python3.11/site-packages/azure/keyvault/key_vault_authentication.py. This is from the azure-keyvault@1.1.0 package, which is installed as a dependency of azure-cli. (This is similar, but not quite the same, as what's vendored in the possibly-unused vendored_sdks/azure_keyvault_t1 directory from above.) I fixed that file and now I'm off to the races: Everything I tested seems to work fine. (Presumably, this is also what @nemobis did, above.)

And, much like @nemobis, I don't think I have the context to do much more than some armchair programming here, but I'll do that, anyway :) It seems like the CLI references at least two very old versions of the keyvault library, which include the call to getargspec causing our python 3.11 failures here; one is vendored in, and one is required as a dependency. Ideally, I'd imagine that azure-cli would like to drop the vendored module, and to be using the current version of azure-keyvault. If it makes sense, I'm happy to draft a PR with any of those changes!

[ChandlerSwift]

Ah, and a bit more sleuthing shows that this was fixed upstream, in https://github.com/Azure/azure-sdk-for-python, in Azure/azure-sdk-for-python@472ad50#diff-f30a51a90a4f5d130438cd6a1d8b90675129154d7c45bca09cb2a37a3fc03a82L61 (which is a merge commit of Azure/azure-sdk-for-python#6080, including Azure/azure-sdk-for-python@f914749#diff-f30a51a90a4f5d130438cd6a1d8b90675129154d7c45bca09cb2a37a3fc03a82L61), and so any version released after that (so azure-keyvault>=4.0.0, the next (track2?) version after 1.1.0, which this library is using) should work fine with Python3.11.

[evelyn-ys]

@calvinhzy is working on migrating secret related commands to use track2 SDK which will replace current azure-keyvault

[gkotian]

Thanks @ChandlerSwift for your detective work. You saved me a lot of trouble 💯