🔒 smb client recommendation

[sand phoenix]

is this a good/legit/used library? I can't tell from pypi/github if many people actually use it.

I need a way to interact with smb, I like how easy would be with that lib, but I'm open to other suggestions if that's not ok.

my problem is that I find very little stuff online about libs about smb, that I assume would be a common thing to do, and that makes me question my choice

[dusky grotto]

@sand phoenix

Python help channel opened

Remember to:

• Ask your Python question, not if you can ask or if there's an expert who can help.
• Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
• Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.

[rigid crater]

don't know since i have never used such a library, normally i would i would just make sure to mount the smb share through the OS and access files through that

[sand phoenix]

that's what I do now, but it has resulted in several incidents over the years, and I'm trying to solve that

[rigid crater]

best option is usually to not use smb at all

[sand phoenix]

that's not an option

[rigid crater]

if that is really true and there is no way around it, that's unfortunate and you have my condolences

[sand phoenix]

thank you. this is just the standard here and has always been for storage

[rigid crater]

i've seen that too at places, and i has cause production issues at multiple places multiple times, maybe that is proof that once should look for another solution/protocol instead

[sand phoenix]

while that's true, I have no power in changing this, so I just have to roll with it

[rigid crater]

but i do understand that change is hard, especially for organizations set in their ways

[sand phoenix]

the only power I have is to find better ways to access it with hopefully less incidents

[rigid crater]

but if you guys have had production problems due to problems smb mounts, that should tell the powers that be that they maybe should not be so locked in to their old ways/solutions, as they eventuality don't work very well/reliably

[rigid crater]

if you can't get another solution greenlit and this or another library doesn't make it any better, maybe good monitoring is a band aid, so that you can get notified as soon as the smb mount doesn't work as expected and can action it as soon as possible

[sand phoenix]

it's easier said than done. we tried to add railguards that somewhat worked, but during an unrelated change recently, they didn't anymore

if the lib I linked works as I expect it, it would pretty much solve all my problems

[rigid crater]

what kind of railguards?
i was thinking monitoring that both checks the mount as well as trying to write something to the smb mount and then reads it to check that it contains the expected data and then removes the file or something like that (and notify admins if something goes wrong)

[sand phoenix]

we didn't have wrong data problems, at least not that I know of

[rigid crater]

i was thinking that it might be that you loss the mount or that operations on the mount stalls/fails, so with proper timeouts you could detect that

[sand phoenix]

one of the big problems for instance is that the mount on macos will just fail to umount sometimes, and a recursive rm (from different sources) would also wipe portions of the file storage. no matter where we moved the mounted path, this keeps coming back somehow

we have several checks and several umount in different places, but it hasn't solved everything

also with moving folders around with smbclient on linux, we either have managed to copy the whole share onto the CI machine, or copy a lot of the CI machine onto the file server

the file sharing going out of space means also sometimes copying just deadlocking.. but that's not usually that bad

[rigid crater]

failing to umount mount points can happen for several different reasons, but the problem with wiping the whole partitions is new to me and sounds really serious as well as strange

[sand phoenix]

the CI software will just wipe parts of the build folder/other parts of the system to bring them back to a "normal" state either at the end of the build or at the start of the new one

also sometimes hitting the mounted folder

this is a macos problem because there's no docker like containerization

[rigid crater]

remote file systems are finicky in general and i try to use them for as few operations as possible and try to only use them to transfer data at the start (to get data) and/or end (to deliver results) of an operation

[sand phoenix]

yes, same

not going through the os where it can leave traces later like a mounted path seems just the best way forward for me right now

[rigid crater]

either way, i haven't used that library or any other like it, so can't really say anything about it unfortunately

[sand phoenix]

that's fair

[rigid crater]

yeah, if you have no choice of setting up any other way of doing the file transfer

i guess the way to know is to try it out for yourself

also, using macOS for servers?

[sand phoenix]

well, you can't do a macos build but on a macos server

[rigid crater]

ah, i see, you are using them for builds of software for macOS specifically 💡

[sand phoenix]

yes

I'm quite paranoid about malicious 3rdparty, and that's the main thing I wanted an opinion on. for crates.io I usually look at the number of downloads and I try to review the source, but for python I don't know what to look at.

[rigid crater]

it's been a while since Apple made servers, then their were the rack mounted mac pros, but those aren't really a think anymore either
now everyone has to look to mac minis and mac studios

[sand phoenix]

thankfully that's not my problem to deal with

I just have to not wipe stuff again

[rigid crater]

you are lucky then 😁

[sand phoenix]

not surprisingly I guess this whole thing has been pretty painlessly on windows

[rigid crater]

yeah, supply chain and security is trick
can you guys firewall things for the servers running this code so that you can be sure that it got no way to call out if there is any malicious code in there? (now or in the future)

[sand phoenix]

sure, but that's not a silver bullet

[rigid crater]

no, but it helps a whole lot, what is such code going to do if it can't connect "home" to anywhere? (but all traffic to the internet would have to be filtered, even DNS traffic, ICMP, email and similar)
otherwise all of the malicious logic would have to be packaged with the library and would be quite indiscriminate, which would make it loud and probably found quite quickly by the community

[sand phoenix]

mhm, it would be very hard

[rigid crater]

and i don't know if your build process needs internet access, if it does it will be hard to filter the traffic that extensively

[sand phoenix]

it kind of does

[rigid crater]

yeah, i usually is unfortunately, OS updates and stuff

[rigid crater]

then it's hard to fully protect against such stuff

[sand phoenix]

indeed

that's why I'm usually going for "mainstream" libs and as much as python std as possible

[rigid crater]

if you don't have your own repositories/mirrors where you get everything from that you can allow-list traffic to

[rigid crater]

yeah, that is usually the way to go 👍

[sand phoenix]

and that's why I was hoping more people on the internet would've said something about that lib

[rigid crater]

but it's hard when you need something a little bit more out of the ordinary

[sand phoenix]

yeah, in my mind accessing smb is quite ordinary..

[rigid crater]

you could try to ask out in #python-discussion as well, where a lot of people are active at times

[rigid crater]

yeah, but i think most people do it through a OS mounted share

[sand phoenix]

I guess most people also don't have to deal with server macos

[rigid crater]

and just never unmount it

[sand phoenix]

I think I'll just go use it

I found someone else that was already using it, finally

that eases my fears a lot

[rigid crater]

where did you find them?

[sand phoenix]

I mean a coworker

not being the first to do something different helps a lot

[rigid crater]

not being the first in the organization certainly helps
in the unlikely scenario that there would be anything malicious with that library you already have that problem inside your network and you are not introducing anything new

[sand phoenix]

exactly right

[rigid crater]

do you guys also run a mirror of the libraries that you use in production with a delay when new versions are released and do security scans on them? (i don't know the size of your organization)

[sand phoenix]

not for python

because it's not shipped

and I don't think people bothered

[rigid crater]

i see, but it's used in the build process

[sand phoenix]

yes

[rigid crater]

so, still part of the critical chain

[sand phoenix]

yes

[rigid crater]

i think we will see more and more automated security audits of software in the supply chain will be done by AI agents (of course also hardened against prompt injections) going forward

[sand phoenix]

I found AI review so far a waste of time

it almost never says something right

or it just sends you chase wild theories that it doesn't check itself because the context would be too big, and it's never right

until they get better at it, I hope that doesn't get introduced

[rigid crater]

it really depends on a lot of factors, how it's all setup and how much context it has about what it's operating on, and with narrower goals they generally do better

[sand phoenix]

sure

[rigid crater]

also, depends on the models used

[sand phoenix]

I think the only useful review I got from it was about how to do some dockerfiles better

and the file was small enough that it could actually say something useful

but for big project, I found them just bad

and sure, it depends on a lot of stuff, but that's my experience so far

[rigid crater]

yeah, i have had quite a lot of that myself as well, but i think it's getting better now with the right context and having a team of agents working together (or rather checking and double checking each others results)

[sand phoenix]

sure. I'm willing to try again in idk a year or whatever if someone else does the integration

[rigid crater]

yeah, we got a whole team that does the integrations for us so that we can just use them

[sand phoenix]

AttributeError: module 'smbclient' has no attribute 'shutil'```
![qb_what](https://cdn.discordapp.com/emojis/647145437429628979.webp?size=128 "qb_what")

[rigid crater]

do you have more context?

[sand phoenix]

trying to call smbclient.shutil.copytree

there's https://github.com/jborean93/smbprotocol/blob/master/src/smbclient/shutil.py but it can't find it

to be fair it's not in __init__.py, I assume it should appear there?

I don't know a lot of python

oh no I have to both

import smbclient
import smbclient.shutil```

wow..

[paper spindle]

no, only the latter

sorry, replied to the wrong message

you can do from smbclient.shutil import copytree

and just call copytree()

[sand phoenix]

yeah, ty

[rigid crater]

not very nice that the library is more or less lacking any decent documentation so that you need to go into the source files to find both docstrings and source code

[sand phoenix]

I don't mind that much, I'm used to it. I just didn't use modules in python much and I didn't knew I had to import that manually

[rigid crater]

it's one way to do it

[sand phoenix]

pip upgrade in a venv upgrades only the venv pip, right?

[rigid crater]

you mean --upgrade when you have the venv activated?

[sand phoenix]

yes

[rigid crater]

yeah, i'm almost never using anything manually anymore, i just use uv nowadays

but as long as you have the venv active you should be pretty safe when using pip

this is what i use (the standalone installer): https://docs.astral.sh/uv/getting-started/installation/#standalone-installer
and then use uv init once for the project (often with the --package option)
then just do uv add for my direct dependencies and run my code with uv run, no need to activate a venv and uv takes care of the venv stuff for you

[sand phoenix]

yeah, I heard about it, but integrating it would be a lot more work

https://pypi.org/project/cryptography/ what happened with python 3.9 that it's not accepted?

[rigid crater]

you can have it only in your development workflow and then still use venv and pip for your deployments if you wish (pip understands pyproject.toml since the version that was shipped with python 3.10 and even better since 3.11)

[sand phoenix]

yeah it looks like I have 3.9 right now

[rigid crater]

you are aware that it's EoL right?
https://devguide.python.org/versions/

[sand phoenix]

yes

[rigid crater]

if at all possible i would recommend to be on at least 3.13

[sand phoenix]

that's a bit optimistic

I probably can get 3.12 with some work

more than that would be a lot of work

[rigid crater]

3.12 is okay i guess

but at the very least you should be on a supported version

[sand phoenix]

yes

just a bit scared of touching windows docker stuff

to be fair I don't think the latest ubuntu lts has 13 either

less than a month until the new one

[rigid crater]

yeah, it shipped with python 3.12, which was the latest version of python when it 24.04 LTS was released, the new one will probably come with python 3.14

@sand phoenix did you also check the pysmb library as an alternative?

[dusky grotto]

Python help channel closed for inactivity

This help channel has been closed. Feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.