Merge ~techalchemy/ubuntu-security-tools:feature/python3-migration into ubuntu-security-tools:master

[Dan Ryan]

Add support for python 3 across UST

- Add general compatibility for python 3 across UST
- Code convention & minor performance cleanup
- Safer file handle management
- str/bytes consciousness at the filesystem layer

Add python 3 support and minor implementation tweaks described below

- Begin implementing context managers around file handles
- Begin moving unguarded execution blocks to `if __name__ == '__main__'
    blocks in case code is ever used as a library (i.e. imported)
- Change print statements to functions
- Use `contextlib.closing` context manager around `urlopen` calls to
    ensure connections are closed
- Add alternative config parser using `ConfigParser` by adding a dummy
    section header when loading config files to avoid `configobj`
- Prefer to decompress remote gzipped content in memory to avoid writing
    to disk
- `yaml.safe_load` and `yaml.safe.dump` instead of `load` and `dump

ceede68... by Dan Ryan on 2020-01-30

syntax fixes

Signed-off-by: Dan Ryan <email address hidden>

Unmerged commits

ceede68... by Dan Ryan on 2020-01-30

syntax fixes

Signed-off-by: Dan Ryan <email address hidden>

41f83d0... by Dan Ryan on 2020-01-30

Merge branch 'master' into feature/python3-migration

16ad204... by Dan Ryan on 2020-01-30

Add support for python 3 across UST

- Begin implementing context managers around file handles
- Begin moving unguarded execution blocks to `if __name__ == '__main__'
  blocks
- Change print statements to functions
- Use `contextlib.closing` context manager around `urlopen` calls to
  ensure connections are closed
- Add alternative config parser using `ConfigParser` by adding a dummy
  section header when loading config files to avoid `configobj`
- Prefer to decompress remote gzipped content in memory to avoid writing
  to disk
- `yaml.safe_load` and `yaml.safe.dump` instead of `load` and `dump`

Signed-off-by: Dan Ryan <email address hidden>

diff --git a/audits/pk-list b/audits/pk-list
index 48857b5..8faa81a 100755
--- a/audits/pk-list
+++ b/audits/pk-list
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 
 # Author: Jamie Strandboge <[e-mail]>
 # Copyright 2012 Canonical Ltd.
@@ -13,7 +13,7 @@
 # TODO: Drop privs
 # TODO: add dbus reporting
 
-from __future__ import print_function
+from __future__ import absolute_import, print_function
 
 import glob
 import optparse
@@ -71,12 +71,12 @@ def get_merged_mapping(default_mapping, package_mapping, local_mapping):
             pat = re.compile(r'%s' % k)
             for i in merged.keys():
                 if pat.search(i):
-                    if i not in merged.keys():
+                    if i not in merged:
                         continue
                     merged[i]['overrides']['package'] = package_mapping[k]
                     #print "%s: %s" % (k, merged[i]['overrides']['package'])
         else:
-            if k not in merged.keys():
+            if k not in merged:
                 continue
             merged[k]['overrides']['package'] = package_mapping[k]
             #print "%s: %s" % (k, merged[k]['overrides']['package'])
@@ -221,10 +221,10 @@ class PKOverridesHandler():
                         entries[key] = value
                     _debug(entries)
 
-                    if "action" not in entries.keys():
+                    if "action" not in entries:
                         _warn("No action for '%s'. Skipping" % (section))
                         continue
-                    elif "identity" not in entries.keys():
+                    elif "identity" not in entries:
                         _warn("No identity for '%s'. Skipping" % (section))
                         continue
 
@@ -260,7 +260,7 @@ class PKActionsHandler(xml.sax.handler.ContentHandler):
     def startElement(self, name, attrs):
         _debug("PKActionsHandler.startElement()")
         if name == "action":
-            if 'id' in attrs.keys():
+            if 'id' in attrs:
                 self.curr_action = attrs['id']
                 self.mapping[self.curr_action] = dict()
                 self.in_action = True
@@ -276,11 +276,11 @@ class PKActionsHandler(xml.sax.handler.ContentHandler):
             return
 
         if re.search(r'_?description', name):
-            if 'xml:lang' not in attrs.keys():  # skip translated strings
+            if 'xml:lang' not in attrs:  # skip translated strings
                 self.in_description = True
                 self.mapping[self.curr_action]['description'] = ""
         elif re.search(r'_?message', name):
-            if 'xml:lang' not in attrs.keys():  # skip translated strings
+            if 'xml:lang' not in attrs:  # skip translated strings
                 self.in_message = True
                 self.mapping[self.curr_action]['message'] = ""
         elif name == "defaults":
@@ -353,7 +353,9 @@ class PKActionsHandler(xml.sax.handler.ContentHandler):
 
             cleaned_lines = []
             skipped_doctype = False
-            for line in open(f).readlines():
+            with open(f, "r") as fh:
+                lines = fh.readlines()
+            for line in lines:
                 if line.startswith("<policyconfig>"):
                     skipped_doctype = True
                 if not skipped_doctype:
diff --git a/audits/test/data/encryption/ex_twisted.py b/audits/test/data/encryption/ex_twisted.py
index 891ca40..6a112a9 100644
--- a/audits/test/data/encryption/ex_twisted.py
+++ b/audits/test/data/encryption/ex_twisted.py
@@ -1,2 +1,3 @@
+from __future__ import absolute_import, print_function
 from twisted.internet import reactor, ssl
 from twisted.internet.ssl import ClientContextFactory
diff --git a/audits/test/test-mir-code-audit.py b/audits/test/test-mir-code-audit.py
index 4e6d548..73d8b6b 100755
--- a/audits/test/test-mir-code-audit.py
+++ b/audits/test/test-mir-code-audit.py
@@ -147,7 +147,8 @@ class T(unittest.TestCase):
                 for line in report.splitlines():
                     if '%s:' % f in line:
                         content += pat.sub('<path>', line) + "\n"
-                open(tmp, 'w').write(content)
+                with open(tmp, 'w') as fh:
+                    fh.write(content)
 
             # now compare each test result
             results = glob.glob("%s/*.result" % self.tmpdir)
diff --git a/audits/uaudit b/audits/uaudit
index 2ef95cf..1da183b 100755
--- a/audits/uaudit
+++ b/audits/uaudit
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 
 # Author: Jamie Strandboge <[e-mail]>
 # Copyright 2012 Canonical Ltd.
@@ -16,7 +16,8 @@
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 
-from __future__ import print_function
+from __future__ import absolute_import, print_function
+
 from pathlib import Path
 import glob
 import optparse
@@ -28,6 +29,11 @@ import sys
 import tempfile
 import json
 
+if sys.version_info[0] == 2:
+    raw_input = raw_input
+else:
+    raw_input = input
+
 DEBUGGING = False
 ust = {}
 
@@ -125,13 +131,14 @@ def parse_package_details():
     global ust
     details = {}
 
+    header = []
     try:
-        changelog = open('debian/changelog', 'r')
+        with open("debian/changelog", "r") as fh:
+            # Extract info from the first line of the changelog
+            header = fh.readline().split()
     except Exception:
         error("Could not open debian/changelog. Aborting.")
 
-    # Extract info from the first line of the changelog
-    header = changelog.readline().split()
     details['package'] = header[0]
     details['version'] = header[1].strip('()')
 
@@ -186,7 +193,7 @@ def find_build_log(pkg, ver):
     latest = None
     modified = None
     for log in glob.glob(ust['pkgbuild_logs'] + '/*%s_*' % (pkg)):
-        with open(log) as log_file:
+        with open(log, "r") as log_file:
             line = log_file.readline()
             if not line.startswith("Automatic build of"):
                 # Skip the first three lines of the file for newer sbuild
@@ -213,8 +220,10 @@ def load_ust_config(config_file):
 
     config = {}
     # no python-configobj in python3 yet, so read what we need ourselves
-    for line in open(config_file, 'r').readlines():
-        line.strip()
+    with open(config_file, "r") as fh:
+        lines = fh.readlines()
+    for line in lines:
+        line = line.strip()
         if line.startswith('#'):
             continue
         if '=' not in line:
@@ -264,7 +273,7 @@ def query_user_consent_to_install_tool(tool):
 
     while True:
         sys.stdout.write(question)
-        choice = input().lower()
+        choice = raw_input().lower()
         if choice in valid_answers:
             return valid_answers[choice]
         else:
@@ -623,8 +632,8 @@ def cov_analyze(covdir):
         return
 
     # parse auth token for host and port
-    fp = open(cov_auth_key, 'r')
-    token = json.load(fp)
+    with open(cov_auth_key, 'r') as fp:
+        token = json.load(fp)
     host = token['comments']['host']
     port = token['comments']['port']
     project = details['package']
@@ -1013,13 +1022,13 @@ if __name__ == "__main__":
                 if not os.path.exists(txt):
                     msg("Creating %s" % txt)
                     # replace variables in file
-                    s = open(base).read()
+                    with open(base, "r") as fh:
+                        s = fh.read()
                     s = s.replace('$package', package)
                     s = s.replace('$version', details['version'])
                     s = s.replace('$release', details['release'])
-                    f = open(txt, 'w')
-                    f.write(s)
-                    f.close()
+                    with open(txt, "w") as f:
+                        f.write(s)
             else:
                 warn("Could not find %s template to copy" % base)
 
diff --git a/build-tools/buildlog-compare b/build-tools/buildlog-compare
index 6225e69..697e3c1 100755
--- a/build-tools/buildlog-compare
+++ b/build-tools/buildlog-compare
@@ -1,15 +1,18 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 # Copyright (C) 2007-2018 Canonical, Ltd.
 # Author: Kees Cook <[e-mail]>
 #         Jamie Strandboge <[e-mail]>
 #         Marc Deslauriers <[e-mail]>
 # License: GPLv3
+from __future__ import absolute_import, print_function
 import sys, subprocess, tempfile, re, os
 import optparse
 
 def pull_build_log(filename):
     sep = '\nChecking correctness of source dependencies...\n'
-    log = file(filename).read()
+    log = ""
+    with open(filename, "r") as fh:
+        log = fh.read()
     if sep in log:
         log = log.split(sep,1)[1]
 #        log = sep.join(log.split(sep)[:-1])+"\n"
@@ -345,15 +348,16 @@ newlog = re.sub('\[[ 0-9]{4}/[ 0-9]{4}\] Linking', '[XXXX/XXXX] Linking', newlog
 oldlog = re.sub('-DBUILD_DATETIME=...?[0-9]{4}-[0-9]{2}-[0-9]{2}T1?\d:[0-5]\d:[0-5]\d...? ', '-DBUILD_DATETIME=0000-00-00T00:00:00 ', oldlog)
 newlog = re.sub('-DBUILD_DATETIME=...?[0-9]{4}-[0-9]{2}-[0-9]{2}T1?\d:[0-5]\d:[0-5]\d...? ', '-DBUILD_DATETIME=0000-00-00T00:00:00 ', newlog)
 
-# Write out the files for diffing
-oldfile = tempfile.NamedTemporaryFile(prefix='buildlog-')
-write_log(oldfile, oldlog, opt.deparallel, pkg)
-
-newfile = tempfile.NamedTemporaryFile(prefix='buildlog-')
-write_log(newfile, newlog, opt.deparallel, pkg)
-
-# To debug, useful to do:
-#shutil.copy(oldfile.name, "/tmp/old")
-#shutil.copy(newfile.name, "/tmp/new")
-
-subprocess.call(['diff', '-ub', oldfile.name, newfile.name])
+# Write out the files for diffing, use context managers to clean up temporary
+# file handles & avoid leaking handles at interpreter exit
+with tempfile.NamedTemporaryFile(prefix='buildlog-', mode="w+") as oldfile:
+    write_log(oldfile, oldlog, opt.deparallel, pkg)
+    oldfile.flush()
+
+    with tempfile.NamedTemporaryFile(prefix='buildlog-', mode="w+") as newfile:
+        write_log(newfile, newlog, opt.deparallel, pkg)
+        newfile.flush()
+        subprocess.call(['diff', '-ub', oldfile.name, newfile.name])
+        # To debug, useful to do:
+        #shutil.copy(oldfile.name, "/tmp/old")
+        #shutil.copy(newfile.name, "/tmp/new")
diff --git a/build-tools/diff-reorder b/build-tools/diff-reorder
index ef641de..2a9232f 100755
--- a/build-tools/diff-reorder
+++ b/build-tools/diff-reorder
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 # This tool attempts to balance out +/- lines in the same or
 # adjacent diff chunks.  When doing parallel builds, output
 # frequently gets out of order, needlessly filling the diff
@@ -8,6 +8,8 @@
 #
 # Copyright (C) 2009, Canonical Ltd.
 # Author: Kees Cook <[e-mail]>
+from __future__ import absolute_import, print_function
+
 import sys
 
 def plus_minus_lines(hunk):
@@ -99,7 +101,7 @@ class Hunk(object):
         for line in self.lines:
             if line.startswith('@@') and self.is_empty():
                 break
-            print prefix + line
+            print(prefix + line)
 
 collector = ""
 minus = 0
@@ -130,7 +132,7 @@ for line in sys.stdin:
             plus = plus - 1
         else:
             # Broken patch!
-            raise ValueError, "Corrupted patch? '%s'" % (line.replace('\n',''))
+            raise ValueError("Corrupted patch? '%s'" % (line.replace('\n','')))
         if minus == 0 and plus == 0:
             # HUNK FINISHED
             counting = False
diff --git a/build-tools/umt b/build-tools/umt
index 400294d..69fcb93 100755
--- a/build-tools/umt
+++ b/build-tools/umt
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 
 # Author: Marc Deslauriers <[e-mail]>
 # Author: Kees Cook <[e-mail]>
@@ -845,114 +845,119 @@ def cmd_compare_log():
         err("Could not find 'diff-reorder' (is '$UST' set?). Aborting.")
         sys.exit(1)
 
-    diff = tempfile.NamedTemporaryFile(suffix='.diff',prefix='umt_compare-log_')
-    diff.write(b"Log file line counts:\n")
-    diff.flush()
-    subprocess.call(['wc','-l','--',old_logfile],stdout=diff)
-    subprocess.call(['wc','-l','--',new_logfile],stdout=diff)
-    diff.write(b"\n")
-    diff.flush()
-    command = [buildlog_compare]
-    if opt.deparallel:
+    with tempfile.NamedTemporaryFile(
+                suffix='.diff',prefix='umt_compare-log_', mode='w+b'
+            ) as diff, tempfile.NamedTemporaryFile(
+                suffix='.diff', prefix='umt_compare-log_', mode='w+b'
+            ) as patches_diff:
+        diff.write(b"Log file line counts:\n")
+        diff.flush()
+        subprocess.check_call(['wc','-l','--',old_logfile], stdout=diff)
+        subprocess.check_call(['wc','-l','--',new_logfile], stdout=diff)
+        diff.write(b"\n")
+        diff.flush()
+        command = [buildlog_compare]
+        if opt.deparallel:
+            if opt.balance:
+                err("Skipping --balance with --deparallel")
+            else:
+                command.append("--deparallel")
+        command += [details['package'],details['base_version_prior'],old_logfile,details['base_version'],new_logfile]
+
         if opt.balance:
-            err("Skipping --balance with --deparallel")
+            p1 = subprocess.Popen(command, stdout=subprocess.PIPE)
+            p2 = subprocess.Popen([diff_reorder], stdin=p1.stdout, stdout=subprocess.PIPE)
+            diff.write(p2.communicate()[0])
         else:
-            command.append("--deparallel")
-    command += [details['package'],details['base_version_prior'],old_logfile,details['base_version'],new_logfile]
-
-    if opt.balance:
-        p1 = subprocess.Popen(command, stdout=subprocess.PIPE)
-        p2 = subprocess.Popen([diff_reorder], stdin=p1.stdout, stdout=subprocess.PIPE)
-        diff.write(p2.communicate()[0])
-    else:
-        if subprocess.call(command,stdout=diff) != 0:
-            sys.exit(1)
+            try:
+                subprocess.check_call(command, stdout=diff)
+            except subprocess.CalledProcessError as e:
+                sys.exit(e.returncode)
+        diff.flush()
 
-    diff.flush()
-    if opt.dump_to_stdout:
-        subprocess.call(['cat', diff.name])
-        return
+        if opt.dump_to_stdout:
+            subprocess.call(['cat', diff.name])
+            return
 
-    editor = os.getenv('EDITOR') or 'vi'
-    if editor.find('vi') >= 0:
-        subprocess.call([editor,'+set syntax=diff', diff.name])
-    else:
-        subprocess.call([editor, diff.name])
+        editor = os.getenv('EDITOR') or 'vi'
+        if editor.find('vi') >= 0:
+            subprocess.call([editor,'+set syntax=diff', diff.name])
+        else:
+            subprocess.call([editor, diff.name])
 
-    # Show what is happening to the patches in a build
-    patches_diff = tempfile.NamedTemporaryFile(suffix='.diff',prefix='umt_compare-log_')
-    patches_diff.write(b"Listing of applied patch differences:\n")
-    patches_diff.write(("%s\n%s\n" % (old_logfile, new_logfile)).encode())
-    patches_diff.flush()
+        # Show what is happening to the patches in a build
+        patches_diff.write(b"Listing of applied patch differences:\n")
+        patches_diff.write(("%s\n%s\n" % (old_logfile, new_logfile)).encode())
+        patches_diff.flush()
 
-    (rc, report) = runcmd(['what-patch'])
-    if rc != 0:
-        err("running 'what-patch':\n%s" % report)
-        sys.exit(1)
-    patch_system = report.strip()
-
-    if patch_system == "quilt" or patch_system == "dpatch" or patch_system == "cdbs":
-        patch_list = []
-        skip = False
-        if patch_system == "cdbs":
-            fn = "debian/patches"
-            if not os.path.isdir(fn):
-                patches_diff.write(("Skipping checks for patch system '%s', missing '%s'" % (patch_system, fn)).encode())
-                skip = True
+        (rc, report) = runcmd(['what-patch'])
+        if rc != 0:
+            err("running 'what-patch':\n%s" % report)
+            sys.exit(1)
+        patch_system = report.strip()
+
+        if patch_system == "quilt" or patch_system == "dpatch" or patch_system == "cdbs":
+            patch_list = []
+            skip = False
+            if patch_system == "cdbs":
+                fn = "debian/patches"
+                if not os.path.isdir(fn):
+                    patches_diff.write(("Skipping checks for patch system '%s', missing '%s'" % (patch_system, fn)).encode())
+                    skip = True
+                else:
+                    for p in os.listdir(fn):
+                        if p.endswith('.patch') or p.endswith('.diff'):
+                            patch_list.append(".".join(p.split('.')[:-1]))
+                        else:
+                            patch_list.append(p)
+                    patch_list.sort()
             else:
-                for p in os.listdir(fn):
-                    if p.endswith('.patch') or p.endswith('.diff'):
-                        patch_list.append(".".join(p.split('.')[:-1]))
-                    else:
-                        patch_list.append(p)
-                patch_list.sort()
-        else:
-            if patch_system == "quilt":
-                fn = "debian/patches/series.in"
+                if patch_system == "quilt":
+                    fn = "debian/patches/series.in"
+                    if not os.path.exists(fn):
+                        fn = "debian/patches/series"
+                elif patch_system == "dpatch":
+                    fn = "debian/patches/00list"
+
                 if not os.path.exists(fn):
-                    fn = "debian/patches/series"
-            elif patch_system == "dpatch":
-                fn = "debian/patches/00list"
+                    patches_diff.write(("Skipping checks for patch system '%s', missing '%s'" % (patch_system, fn)).encode())
+                    skip = True
+                else:
+                    for p in open(fn).readlines():
+                        p = p.strip()
+                        if p.startswith('#') or re.search(r'^\s*$', p):
+                            continue
+                        if p.endswith('.dpatch') or p.endswith('.patch') or p.endswith('.diff'):
+                            patch_list.append(".".join(p.split('.')[:-1]))
+                        else:
+                            patch_list.append(p)
+            if not skip:
+                tmp = ""
+                for p in patch_list:
+                    (rc, report) = runcmd(['egrep', p, diff.name])
 
-            if not os.path.exists(fn):
-                patches_diff.write(("Skipping checks for patch system '%s', missing '%s'" % (patch_system, fn)).encode())
-                skip = True
-            else:
-                for p in open(fn).readlines():
-                    p = p.strip()
-                    if p.startswith('#') or re.search(r'^\s*$', p):
-                        continue
-                    if p.endswith('.dpatch') or p.endswith('.patch') or p.endswith('.diff'):
-                        patch_list.append(".".join(p.split('.')[:-1]))
-                    else:
-                        patch_list.append(p)
-        if not skip:
-            tmp = ""
-            for p in patch_list:
-                (rc, report) = runcmd(['egrep', p, diff.name])
+                    tmp = ""
+                    for line in report.splitlines():
+                        if patch_system == "cdbs" and re.search(r'^[+-]patches: ', line):
+                            continue
+                        if (line.startswith('-') or line.startswith('+')) and not re.search(r'^[+-]  ', line):
+                            if line.startswith('+revert'):
+                                tmp += "# UMT WARNING: This patch was reverted. This may be a problem.\n"
+                                tmp += "# UMT WARNING: Check debian/rules and/or README.source for details.\n"
+                            tmp += line + "\n"
 
-                tmp = ""
-                for line in report.splitlines():
-                    if patch_system == "cdbs" and re.search(r'^[+-]patches: ', line):
+                    if tmp == "":
                         continue
-                    if (line.startswith('-') or line.startswith('+')) and not re.search(r'^[+-]  ', line):
-                        if line.startswith('+revert'):
-                            tmp += "# UMT WARNING: This patch was reverted. This may be a problem.\n"
-                            tmp += "# UMT WARNING: Check debian/rules and/or README.source for details.\n"
-                        tmp += line + "\n"
-
-                if tmp == "":
-                    continue
-                else:
-                    patches_diff.write(("\n%s:" % (p)).encode())
-                    patches_diff.write(tmp.encode())
-    else:
-       patches_diff.write(("Skipping checks for patch system '%s'" % (patch_system)).encode())
-    patches_diff.flush()
-    if editor.find('vi') >= 0:
-        subprocess.call([editor,'+set syntax=diff', patches_diff.name])
-    else:
-        subprocess.call([editor, patches_diff.name])
+                    else:
+                        patches_diff.write(("\n%s:" % (p)).encode())
+                        patches_diff.write(tmp.encode())
+        else:
+        patches_diff.write(("Skipping checks for patch system '%s'" % (patch_system)).encode())
+        patches_diff.flush()
+        if editor.find('vi') >= 0:
+            subprocess.call([editor,'+set syntax=diff', patches_diff.name])
+        else:
+            subprocess.call([editor, patches_diff.name])
 
 def cmd_compare_bin():
     '''Compare binary debs with prior version'''
@@ -1352,10 +1357,8 @@ Acquire::Languages "none";
             continue
 
         path = os.path.join(reports_dest, b + '_' + arch + '.txt')
-        handle = open(path,"w+")
-        handle.write(report)
-        handle.flush()
-        handle.close()
+        with open(path,"w+") as handle:
+            handle.write(report)
 
         if opt.edit:
             editor = os.getenv('EDITOR') or 'vi'
diff --git a/bzr-tools/plugins/uct-check_syntax.py b/bzr-tools/plugins/uct-check_syntax.py
index c22e3a7..5f7b56c 100644
--- a/bzr-tools/plugins/uct-check_syntax.py
+++ b/bzr-tools/plugins/uct-check_syntax.py
@@ -1,13 +1,20 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 
-from __future__ import print_function
+from __future__ import absolute_import, print_function
+
+import sys
 
 from bzrlib.branch import Branch
 
+if sys.version_info[0] == 2:
+    raw_input = raw_input
+else:
+    raw_input = input
+
 def run_tests(local, master, old_revno, old_revid, new_revno, new_revid, tree_delta, new_tree):
     # print(local, master, old_revno, old_revid, new_revno, new_revid, tree_delta, new_tree)
     import os
-    if 'ubuntu-cve-tracker' in master.base and not os.environ.has_key('UCT_IGNORE_CHECK_SYNTAX'):
+    if 'ubuntu-cve-tracker' in master.base and 'UCT_IGNORE_CHECK_SYNTAX' not in os.environ:
         import subprocess
         print('')
 
diff --git a/bzr-tools/plugins/uct-check_syntax_full.py b/bzr-tools/plugins/uct-check_syntax_full.py
index a9e2d5c..14eaea0 100644
--- a/bzr-tools/plugins/uct-check_syntax_full.py
+++ b/bzr-tools/plugins/uct-check_syntax_full.py
@@ -1,12 +1,20 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
+from __future__ import absolute_import, print_function
+import sys
 from bzrlib.branch import Branch
 
+if sys.version_info[0] == 2:
+    raw_input = raw_input
+else:
+    raw_input = input
+
+
 def run_tests(local, master, old_revno, old_revid, new_revno, new_revid, seven, eight):
     #print local, master, old_revno, old_revid, new_revno, new_revid, seven, eight
     import os
-    if 'ubuntu-cve-tracker' in master.base and not os.environ.has_key('UCT_IGNORE_CHECK_SYNTAX'):
+    if 'ubuntu-cve-tracker' in master.base and 'UCT_IGNORE_CHECK_SYNTAX' not in os.environ:
         import subprocess
-        print ''
+        print('')
         rc = subprocess.call(['./scripts/check-syntax','--verbose'])
         if rc != 0:
             import sys
diff --git a/p-l-p/bug-status.py b/p-l-p/bug-status.py
index 16cbfbf..55c0bc9 100755
--- a/p-l-p/bug-status.py
+++ b/p-l-p/bug-status.py
@@ -1,36 +1,43 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Jamie Strandboge <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
-import sys
+from __future__ import absolute_import, print_function
+
 import os
+import sys
 import launchpadbugs.connector as Connector
 
-Bug = Connector.ConnectBug()
-Bug.authentication = os.path.join(os.environ['HOME'], '.cookies.sqlite')
 
-for num in sys.argv[1:]:
-    bug = Bug(int(num))
+def print_bugs():
+    Bug = Connector.ConnectBug()
+    Bug.authentication = os.path.join(os.environ['HOME'], '.cookies.sqlite')
+
+    for num in sys.argv[1:]:
+        bug = Bug(int(num))
+
+        print(num + ": " + bug.title)
+        print("  URL: https://bugs.launchpad.net/bugs/" + num)
+        if bug.duplicate_of:
+            print("  Duplicate of " + str(bug.duplicate_of))
+        print("  Status: " + bug.status + "\n")
 
-    print num + ": " + bug.title
-    print "  URL: https://bugs.launchpad.net/bugs/" + num
-    if bug.duplicate_of:
-      print "  Duplicate of " + str(bug.duplicate_of)
-    print "  Status: " + bug.status + "\n"
+        if bug.private:
+            print("  Private: yes")
+        else:
+            print("  Private: no")
 
-    if bug.private:
-      print "  Private: yes"
-    else:
-      print "  Private: no"
+        if bug.security:
+            print("  Security: yes")
+        else:
+            print("  Security: no")
 
-    if bug.security:
-      print "  Security: yes"
-    else:
-      print "  Security: no"
+        print("\n  Subscribers:")
+        for s in bug.subscribers:
+            print("    " + s)
 
-    print "\n  Subscribers:"
-    for s in bug.subscribers:
-      print "    " + s
+        print("\n--\n")
 
-    print "\n--\n"
 
+if __name__ == "__main__":
+    print_bugs()
 \ No newline at end of file
diff --git a/p-l-p/cookies-sql2txt.py b/p-l-p/cookies-sql2txt.py
index cc6347c..304ca01 100755
--- a/p-l-p/cookies-sql2txt.py
+++ b/p-l-p/cookies-sql2txt.py
@@ -1,33 +1,38 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 # Extract.cookies.sqlite.txt-like file from FF3 sqlite3 cookies file.  e.g.:
 # .cookies.sqlite-sql2txt ~/.mozilla/*/cookies.sqlite launchpad
 #
 # Copyright 2008 Kees Cook <[e-mail]>
 # License: GPLv2
-import sys
+from __future__ import absolute_import, print_function
 import os
+import sys
+# TODO: Migrate this to sqlite3 + argparse
 from pysqlite2 import dbapi2 as sqlite
 
-def usage():
-    print >>sys.stderr, "Usage: %s SQLITE3DB DOMAIN"
+def print_usage():
+    print("Usage: %s SQLITE3DB DOMAIN", file=sys.stderr)
     sys.exit(1)
 
-try:
-    filename = sys.argv[1]
-    match = '%%%s%%' % sys.argv[2]
-except:
-    usage()
 
-con = sqlite.connect(filename)
+def print_cookie_file(filename, match_param):
+    match = '%%%s%%' % match_param
+    con = sqlite.connect(filename)
+
+    cur = con.cursor()
+    cur.execute("select host, path, isSecure, expiry, name, value from moz.cookies.sqlite where host like ?", [match])
 
-cur = con.cursor()
-cur.execute("select host, path, isSecure, expiry, name, value from moz.cookies.sqlite where host like ?", [match])
+    ftstr = ["FALSE","TRUE"]
 
-ftstr = ["FALSE","TRUE"]
+    print('# HTTP Cookie File')
+    for item in cur.fetchall():
+        print("%s\t%s\t%s\t%s\t%s\t%s\t%s" % (
+            item[0], ftstr[item[0].startswith('.')], item[1],
+            ftstr[item[2]], item[3], item[4], item[5]))
 
-print '# HTTP Cookie File'
-for item in cur.fetchall():
-    print "%s\t%s\t%s\t%s\t%s\t%s\t%s" % (
-        item[0], ftstr[item[0].startswith('.')], item[1],
-        ftstr[item[2]], item[3], item[4], item[5])
 
+if __name__ == "__main__":
+    try:
+        print_cookie_file(sys.argv[1], sys.argv[2])
+    except Exception:
+        print_usage()
 \ No newline at end of file
diff --git a/p-l-p/dump-bug.py b/p-l-p/dump-bug.py
index 8b7d8d6..bf2851a 100755
--- a/p-l-p/dump-bug.py
+++ b/p-l-p/dump-bug.py
@@ -1,15 +1,16 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Jamie Strandboge <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
+from __future__ import absolute_import, print_function
 import sys
 import os
 import launchpadbugs.connector as Connector
 
 
 def printDict(di, format="%-25s %s"):
-    for (key, val) in di.items():
-        print format % (str(key)+':', val)
+    for key, val in di.items():
+        print(format % (str(key)+':', val))
 
 def dumpObj(obj, maxlen=77, lindent=24, maxspew=600):
     """Print a nicely formatted overview of an object.
@@ -79,7 +80,7 @@ def dumpObj(obj, maxlen=77, lindent=24, maxspew=600):
         elif (isinstance(attr, types.MethodType) or
               isinstance(attr, types.FunctionType)):
             methods.append( (slot, attr) )
-        elif isinstance(attr, types.TypeType):
+        elif isinstance(attr, type):
             classes.append( (slot, attr) )
         else:
             attrs.append( (slot, attr) )
@@ -109,57 +110,57 @@ def dumpObj(obj, maxlen=77, lindent=24, maxspew=600):
         objclass = type(obj).__name__
     intro = "Instance of class '%s' as defined in module %s with id %d" % \
             (objclass, objmodule, id(obj))
-    print '\n'.join(prettyPrint(intro, maxlen))
+    print('\n'.join(prettyPrint(intro, maxlen)))
 
     # Object's Docstring
     if objdoc is None:
         objdoc = str(objdoc)
     else:
         objdoc = ('"""' + objdoc.strip()  + '"""')
-    print
-    print prettyPrintCols( ('Documentation string:',
+    print()
+    print(prettyPrintCols( ('Documentation string:',
                             truncstring(objdoc, maxspew)),
-                          normalwidths, ' ')
+                          normalwidths, ' '))
 
     # Built-in methods
     if builtins:
         bi_str   = delchars(str(builtins), "[']") or str(None)
-        print
-        print prettyPrintCols( ('Built-in Methods:',
+        print()
+        print(prettyPrintCols( ('Built-in Methods:',
                                 truncstring(bi_str, maxspew)),
-                              normalwidths, ', ')
+                              normalwidths, ', '))
         
     # Classes
     if classes:
-        print
-        print 'Classes:'
+        print()
+        print('Classes:')
     for (classname, classtype) in classes:
         classdoc = getattr(classtype, '__doc__', None) or '<No documentation>'
-        print prettyPrintCols( ('',
+        print(prettyPrintCols( ('',
                                 classname,
                                 truncstring(classdoc, maxspew)),
-                              tabbedwidths, ' ')
+                              tabbedwidths, ' '))
 
     # User methods
     if methods:
-        print
-        print 'Methods:'
+        print()
+        print('Methods:')
     for (methodname, method) in methods:
         methoddoc = getattr(method, '__doc__', None) or '<No documentation>'
-        print prettyPrintCols( ('',
+        print(prettyPrintCols( ('',
                                 methodname,
                                 truncstring(methoddoc, maxspew)),
-                              tabbedwidths, ' ')
+                              tabbedwidths, ' '))
 
     # Attributes
     if attrs:
-        print
-        print 'Attributes:'
+        print()
+        print('Attributes:')
     for (attr, val) in attrs:
-        print prettyPrintCols( ('',
+        print(prettyPrintCols( ('',
                                 attr,
                                 truncstring(str(val), maxspew)),
-                              tabbedwidths, ' ')
+                              tabbedwidths, ' '))
 
 def prettyPrintCols(strings, widths, split=' '):
     """Pretty prints text in colums, with each string breaking at
@@ -168,7 +169,7 @@ def prettyPrintCols(strings, widths, split=' '):
 
     assert len(strings) == len(widths)
 
-    strings = map(nukenewlines, strings)
+    strings = list(map(nukenewlines, strings))
 
     # pretty print each column
     cols = [''] * len(strings)
@@ -179,7 +180,7 @@ def prettyPrintCols(strings, widths, split=' '):
     format = ''.join(["%%-%ds" % width for width in widths[0:-1]]) + "%s"
 
     def formatline(*cols):
-        return format % tuple(map(lambda s: (s or ''), cols))
+        return format % tuple([(s or '') for s in cols])
 
     # generate the formatted text
     return '\n'.join(map(formatline, *cols))
@@ -226,11 +227,17 @@ def delchars(str, chars):
     return str.translate(identity, chars)
 
 
-Bug = Connector.ConnectBug()
-Bug.authentication = os.path.join(os.environ['HOME'], '.cookies.sqlite')
+# TODO: Migrate this to argparse
 
-for num in sys.argv[1:]:
-    bug = Bug(int(num))
+def print_bugs(*bugs):
+    Bug = Connector.ConnectBug()
+    Bug.authentication = os.path.join(os.environ['HOME'], '.cookies.sqlite')
 
-    dumpObj(bug, 1024, 24, 1024)
+    for num in bugs:
+        bug = Bug(int(num))
 
+        dumpObj(bug, 1024, 24, 1024)
+
+
+if __name__ == "__main__":
+    print_bugs(*sys.argv[1:])
 \ No newline at end of file
diff --git a/p-l-p/in-english.py b/p-l-p/in-english.py
index 8e56db0..ad75f5e 100755
--- a/p-l-p/in-english.py
+++ b/p-l-p/in-english.py
@@ -1,30 +1,37 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
-import sys
+from __future__ import absolute_import, print_function
 import os
+import sys
 import launchpadbugs.connector as Connector
 
 Bug = Connector.ConnectBug()
 Bug.authentication = os.path.join(os.environ['HOME'], '.cookies.sqlite')
 
-for num in sys.argv[1:]:
-    bug = Bug(num)
-
-    try:
-        bug.subscribers.add("ubuntu-bugs")
-    except:
-        pass
-
-    comment = Bug.NewComment(text='Thanks for taking the time to report this bug and helping to make Ubuntu better. Your bug report is more likely to get attention if it is made in English, since this is the language understood by the majority of Ubuntu developers.  Additionally, please only mark a bug as "security" if it shows evidence of allowing attackers to cross privilege boundaries or to directly cause loss of data/privacy. Please feel free to report any other bugs you may find.', subject='')
-    bug.comments.add(comment)
-    bug.private = False
-    bug.security = False
-    bug.status = 'Incomplete'
-
-    try:
-    	bug.subscribers.remove("ubuntu-security")
-    except:
-        pass
-    bug.commit(force_changes=True, ignore_lp_errors=False)
+
+def reassign_bugs_to_bugs_queue(*bugs)
+    for num in bugs:
+        bug = Bug(num)
+
+        try:
+            bug.subscribers.add("ubuntu-bugs")
+        except:
+            pass
+
+        comment = Bug.NewComment(text='Thanks for taking the time to report this bug and helping to make Ubuntu better. Your bug report is more likely to get attention if it is made in English, since this is the language understood by the majority of Ubuntu developers.  Additionally, please only mark a bug as "security" if it shows evidence of allowing attackers to cross privilege boundaries or to directly cause loss of data/privacy. Please feel free to report any other bugs you may find.', subject='')
+        bug.comments.add(comment)
+        bug.private = False
+        bug.security = False
+        bug.status = 'Incomplete'
+
+        try:
+            bug.subscribers.remove("ubuntu-security")
+        except:
+            pass
+        bug.commit(force_changes=True, ignore_lp_errors=False)
+
+
+if __name__ == "__main__":
+    reassign_bugs_to_bugs_queue(*sys.argv[1:])
 \ No newline at end of file
diff --git a/p-l-p/is-cache.py b/p-l-p/is-cache.py
index 5aafacf..da75103 100755
--- a/p-l-p/is-cache.py
+++ b/p-l-p/is-cache.py
@@ -1,29 +1,36 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
+from __future__ import absolute_import, print_function
 import sys, os
 import launchpadbugs.connector as Connector
 
-Bug = Connector.ConnectBug()
-Bug.authentication = os.path.expanduser('~/.plb_cookies')
-reply = '''Thanks for your report. We appreciate the difficulties you are facing, but this bug has already been reported.  Please review the information and solution in bug 124373.  We are marking this bug as a duplicate.'''
 
-for num in sys.argv[1:]:
-    print '%s ...' % (num)
-    bug = Bug(num)
+# TODO: Switch to argparse
+def respond_to_duplicate_bugs(*bugs)
+    Bug = Connector.ConnectBug()
+    Bug.authentication = os.path.expanduser('~/.plb_cookies')
+    reply = '''Thanks for your report. We appreciate the difficulties you are facing, but this bug has already been reported.  Please review the information and solution in bug 124373.  We are marking this bug as a duplicate.'''
+    for bug in bugs:
+        print('%s ...' % (num))
+        bug = Bug(num)
 
-    comment = Bug.NewComment(text=reply)
-    bug.comments.add(comment)
+        comment = Bug.NewComment(text=reply)
+        bug.comments.add(comment)
 
-    bug.status = 'Invalid'
-    bug.private = False
-    bug.security = False
-    if not 'ubuntu-bugs' in bug.subscribers['directly']:
-        bug.subscribers.add("ubuntu-bugs")
-    if 'ubuntu-security' in bug.subscribers['directly']:
-        bug.subscribers.remove("ubuntu-security")
+        bug.status = 'Invalid'
+        bug.private = False
+        bug.security = False
+        if not 'ubuntu-bugs' in bug.subscribers['directly']:
+            bug.subscribers.add("ubuntu-bugs")
+        if 'ubuntu-security' in bug.subscribers['directly']:
+            bug.subscribers.remove("ubuntu-security")
 
-    bug.duplicate_of = 124373
+        bug.duplicate_of = 124373
 
-    bug.commit(force_changes=True, ignore_lp_errors=False)
+        bug.commit(force_changes=True, ignore_lp_errors=False)
+
+
+if __name__ == "__main__":
+    respond_to_duplicate_bugs(*sys.argv[1:])
 \ No newline at end of file
diff --git a/p-l-p/is-private.py b/p-l-p/is-private.py
index d29045b..0333f51 100755
--- a/p-l-p/is-private.py
+++ b/p-l-p/is-private.py
@@ -1,33 +1,61 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
 # Change lp_user to self below... (3 times)
-import sys
+from __future__ import absolute_import, print_function
 import os
+import sys
 import launchpadbugs.connector as Connector
-import configobj
 
-config = configobj.ConfigObj(os.path.expanduser('~/.ubuntu-cve-tracker.conf'))
-Bug = Connector.ConnectBug()
-Bug.authentication = os.path.join(config['plb_authentication'])
-lp_user = config['plb_user']
+if sys.version_info[0] == 2:
+    from ConfigParser import SafeConfigParser as ConfigParser
+    from cStringIO import StringIO
+else:
+    from configparser import ConfigParser
+    from io import StringIO
 
-for num in sys.argv[1:]:
-    print '%s ... ' % (num)
-    bug = Bug(num)
+UCT_PATH = os.path.expanduser('~/.ubuntu-cve-tracker.conf')
 
-    if not lp_user in bug.subscriptions:
-        bug.subscribers.add(lp_user)
-        bug.commit(force_changes=True, ignore_lp_errors=False)
 
-    if bug.security:
-        bug.security = False
+def get_config():
+    # replace configobj functionality to avoid the extra dependency
+    config_content = StringIO()
+    config_content.write("[dummy_section]\n")
+    with open(UCT_PATH, "r") as fh:
+        config_content.write(fh.read())
+    config_content.seek(0)
+    parser = ConfigParser()
+    read_file_func = getattr(parser, "read_file", getattr(parser, "readfp", None))
+    if read_file_func is not None:
+        read_file_func(config_content)
+    return {k: v for k, v in parser.items("dummy_section")}
+
+
+def make_bugs_private(*bugs):
+    for num in bugs:
+        config = get_config()
+        Bug = Connector.ConnectBug()
+        Bug.authentication = os.path.join(config['plb_authentication'])
+        lp_user = config['plb_user']
+        print('%s ... ' % (num))
+        bug = Bug(num)
+
+        if not lp_user in bug.subscriptions:
+            bug.subscribers.add(lp_user)
+            bug.commit(force_changes=True, ignore_lp_errors=False)
+
+        if bug.security:
+            bug.security = False
+            bug.commit(force_changes=True, ignore_lp_errors=False)
+
+        bug = Bug(num)
+        if 'ubuntu-security' in bug.subscriptions:
+            bug.subscribers.remove("ubuntu-security")
+
+        bug.subscribers.remove(lp_user)
         bug.commit(force_changes=True, ignore_lp_errors=False)
 
-    bug = Bug(num)
-    if 'ubuntu-security' in bug.subscriptions:
-        bug.subscribers.remove("ubuntu-security")
 
-    bug.subscribers.remove(lp_user)
-    bug.commit(force_changes=True, ignore_lp_errors=False)
+if __name__ == "__main__":
+    make_bugs_private(*sys.argv[1:])
 \ No newline at end of file
diff --git a/p-l-p/is-support.py b/p-l-p/is-support.py
index 0dd199f..e2b9eee 100755
--- a/p-l-p/is-support.py
+++ b/p-l-p/is-support.py
@@ -1,25 +1,31 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
-import sys
+from __future__ import absolute_import, print_function
 import os
+import sys
 import launchpadbugs.connector as Connector
 
-Bug = Connector.ConnectBug()
-Bug.authentication = os.path.join(os.environ['HOME'], '.cookies.sqlite')
+def close_non_bug_reports(*bugs):
+    Bug = Connector.ConnectBug()
+    Bug.authentication = os.path.join(os.environ['HOME'], '.cookies.sqlite')
+
+    for num in bugs:
+        bug = Bug(num)
+
+        if 'ubuntu-bugs' not in bug.subscriptions:
+            bug.subscribers.add("ubuntu-bugs")
 
-for num in sys.argv[1:]:
-    bug = Bug(num)
+        comment = Bug.NewComment(text='Thanks for your comments. This does not appear to be a bug report and we are closing it. We appreciate the difficulties you are facing, but it would make more sense to raise your question in the support tracker.   Please visit https://answers.launchpad.net/ubuntu/+addquestion', subject='')
+        bug.comments.add(comment)
+        bug.status = 'Invalid'
+        bug.private = False
+        bug.security = False
 
-    if 'ubuntu-bugs' not in bug.subscriptions:
-        bug.subscribers.add("ubuntu-bugs")
+        bug.subscribers.remove("ubuntu-security")
+        bug.commit(force_changes=True, ignore_lp_errors=False)
 
-    comment = Bug.NewComment(text='Thanks for your comments. This does not appear to be a bug report and we are closing it. We appreciate the difficulties you are facing, but it would make more sense to raise your question in the support tracker.   Please visit https://answers.launchpad.net/ubuntu/+addquestion', subject='')
-    bug.comments.add(comment)
-    bug.status = 'Invalid'
-    bug.private = False
-    bug.security = False
 
-    bug.subscribers.remove("ubuntu-security")
-    bug.commit(force_changes=True, ignore_lp_errors=False)
+if __name__ == "__main__":
+    close_non_bug_reports(*sys.argv[1:])
 \ No newline at end of file
diff --git a/p-l-p/not-a-bug.py b/p-l-p/not-a-bug.py
index ad185ff..a7a30f9 100755
--- a/p-l-p/not-a-bug.py
+++ b/p-l-p/not-a-bug.py
@@ -1,41 +1,69 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
-import sys
+from __future__ import absolute_import, print_function
 import os
+import sys
 import launchpadbugs.connector as Connector
-import configobj
 
-config = configobj.ConfigObj(os.path.expanduser('~/.ubuntu-cve-tracker.conf'))
-Bug = Connector.ConnectBug()
-Bug.authentication = os.path.join(config['plb_authentication'])
+if sys.version_info[0] == 2:
+    from ConfigParser import SafeConfigParser as ConfigParser
+    from cStringIO import StringIO
+else:
+    from configparser import ConfigParser
+    from io import StringIO
+
+UCT_PATH = os.path.expanduser('~/.ubuntu-cve-tracker.conf')
+
+
+def get_config():
+    # Replace configobj functionality to avoid the extra dependency
+    config_content = StringIO()
+    config_content.write("[dummy_section]\n")
+    with open(UCT_PATH, "r") as fh:
+        config_content.write(fh.read())
+    config_content.seek(0)
+    parser = ConfigParser()
+    read_file_func = getattr(parser, "read_file", getattr(parser, "readfp", None))
+    if read_file_func is not None:
+        read_file_func(config_content)
+    return {k: v for k, v in parser.items("dummy_section")}
+
+
+def flag_non_bugs(*bugs):
+    Bug = Connector.ConnectBug()
+    Bug.authentication = os.path.join(get_config()['plb_authentication'])
+
+    for num in bugs:
+        bug = Bug(num)
+
+        try:
+            bug.subscribers.add("ubuntu-bugs")
+            changed = True
+        except:
+            pass
 
-for num in sys.argv[1:]:
-    bug = Bug(num)
+        comment = Bug.NewComment(text='''Thank you for using Ubuntu and taking the time to report a bug. Your report should contain, at a minimum, the following information so we can better find the source of the bug and work to resolve it.
 
-    try:
-        bug.subscribers.add("ubuntu-bugs")
-        changed = True
-    except:
-        pass
+    Submitting the bug about the proper source package is essential. For help see https://wiki.ubuntu.com/Bugs/FindRightPackage . Additionally, in the report please include:
 
-    comment = Bug.NewComment(text='''Thank you for using Ubuntu and taking the time to report a bug. Your report should contain, at a minimum, the following information so we can better find the source of the bug and work to resolve it.
+    1) The release of Ubuntu you are using, via 'cat /etc/lsb-release' or System -> About Ubuntu.
+    2) The version of the package you are using, via 'dpkg -l PKGNAME | cat' or by checking in Synaptic.
+    3) What happened and what you expected to happen.
 
-Submitting the bug about the proper source package is essential. For help see https://wiki.ubuntu.com/Bugs/FindRightPackage . Additionally, in the report please include:
+    The Ubuntu community has also created debugging procedures for a wide variety of packages at https://wiki.ubuntu.com/DebuggingProcedures . Following the debugging instructions for the affected package will make your bug report much more complete. Thanks!''', subject='')
+        bug.comments.add(comment)
+        bug.status = 'Invalid'
+        bug.private = False
+        bug.security = False
 
-1) The release of Ubuntu you are using, via 'cat /etc/lsb-release' or System -> About Ubuntu.
-2) The version of the package you are using, via 'dpkg -l PKGNAME | cat' or by checking in Synaptic.
-3) What happened and what you expected to happen.
+        try:
+            bug.subscribers.remove("ubuntu-security")
+        except:
+            pass
+        bug.commit(force_changes=True, ignore_lp_errors=False)
 
-The Ubuntu community has also created debugging procedures for a wide variety of packages at https://wiki.ubuntu.com/DebuggingProcedures . Following the debugging instructions for the affected package will make your bug report much more complete. Thanks!''', subject='')
-    bug.comments.add(comment)
-    bug.status = 'Invalid'
-    bug.private = False
-    bug.security = False
 
-    try:
-        bug.subscribers.remove("ubuntu-security")
-    except:
-        pass
-    bug.commit(force_changes=True, ignore_lp_errors=False)
+if __name__ == "__main__":
+    flag_non_bugs(*sys.argv[1:])
 \ No newline at end of file
diff --git a/p-l-p/not-private.py b/p-l-p/not-private.py
index 289052f..4abc231 100755
--- a/p-l-p/not-private.py
+++ b/p-l-p/not-private.py
@@ -1,13 +1,14 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
+from __future__ import absolute_import, print_function
 import sys
 import os
 import launchpadbugs.connector as Connector
 
-print "This script is obsoleted by launchpadlib/not-private. Please use it instead."
-print "Continuing..."
+print("This script is obsoleted by launchpadlib/not-private. Please use it instead.")
+print("Continuing...")
 
 Bug = Connector.ConnectBug()
 Bug.authentication = os.path.join(os.environ['HOME'], '.cookies.sqlite')
diff --git a/p-l-p/not-security-in-dups.py b/p-l-p/not-security-in-dups.py
index 4046c74..e9a1ced 100755
--- a/p-l-p/not-security-in-dups.py
+++ b/p-l-p/not-security-in-dups.py
@@ -1,7 +1,8 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
+from __future__ import absolute_import, print_function
 import sys
 import os
 import launchpadbugs.connector as Connector
@@ -10,7 +11,7 @@ Bug = Connector.ConnectBug()
 Bug.authentication = os.path.join(os.environ['HOME'], '.cookies.sqlite')
 
 def not_security(num):
-    print '%s ...' % (num),
+    print('%s ...' % (num), end=' ')
     bug = Bug(num)
 
     changed = False
@@ -28,13 +29,15 @@ def not_security(num):
         changed = True
     if changed:
         bug.commit(force_changes=True, ignore_lp_errors=False)
-        print 'updated'
+        print('updated')
     else:
-        print 'skipped'
+        print('skipped')
     return bug
 
-for num in sys.argv[1:]:
-    bug = not_security(num)
 
-    for num in bug.duplicates:
-        not_security(num)
+if __name__ == "__main__":
+    for num in sys.argv[1:]:
+        bug = not_security(num)
+
+        for num in bug.duplicates:
+            not_security(num)
diff --git a/p-l-p/not-security-without-comment.py b/p-l-p/not-security-without-comment.py
index e890308..3dad01b 100755
--- a/p-l-p/not-security-without-comment.py
+++ b/p-l-p/not-security-without-comment.py
@@ -1,29 +1,57 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv3
-import sys
+from __future__ import absolute_import, print_function
 import os
+import sys
 import launchpadbugs.connector as Connector
-import configobj
 
-config = configobj.ConfigObj(os.path.expanduser('~/.ubuntu-cve-tracker.conf'))
-Bug = Connector.ConnectBug()
-Bug.authentication = os.path.join(config['plb_authentication'])
+if sys.version_info[0] == 2:
+    from ConfigParser import SafeConfigParser as ConfigParser
+    from cStringIO import StringIO
+else:
+    from configparser import ConfigParser
+    from io import StringIO
+
+UCT_PATH = os.path.expanduser('~/.ubuntu-cve-tracker.conf')
+
+
+def get_config():
+    config_content = StringIO()
+    config_content.write("[dummy_section]\n")
+    with open(UCT_PATH, "r") as fh:
+        config_content.write(fh.read())
+    config_content.seek(0)
+    parser = ConfigParser()
+    read_file_func = getattr(parser, "read_file", getattr(parser, "readfp", None))
+    if read_file_func is not None:
+        read_file_func(config_content)
+    return {k: v for k, v in parser.items("dummy_section")}
+
+
+def remove_security_without_comment(*bugs):
+    Bug = Connector.ConnectBug()
+    config = get_config()
+    Bug.authentication = os.path.join(config['plb_authentication'])
+
+    for num in bugs:
+        print('%s ...' % (num))
+        bug = Bug(num)
+
+        bug.private = False
+        bug.security = False
 
-for num in sys.argv[1:]:
-    print '%s ...' % (num)
-    bug = Bug(num)
+        try:
+            bug.subscribers.add("ubuntu-bugs")
+        except:
+            print("ubuntu-bugs already subscribed", file=sys.stderr)
 
-    bug.private = False
-    bug.security = False
+        try:
+            bug.subscribers.remove("ubuntu-security")
+        except:
+            pass
+        bug.commit(force_changes=True, ignore_lp_errors=False)
 
-    try:
-        bug.subscribers.add("ubuntu-bugs")
-    except:
-        print >>sys.stderr, "ubuntu-bugs already subscribed"
 
-    try:
-        bug.subscribers.remove("ubuntu-security")
-    except:
-        pass
-    bug.commit(force_changes=True, ignore_lp_errors=False)
+if __name__ == "__main__":
+    remove_security_without_comment(*sys.argv[1:])
 \ No newline at end of file
diff --git a/p-l-p/not-security.py b/p-l-p/not-security.py
index 4108e82..c909518 100755
--- a/p-l-p/not-security.py
+++ b/p-l-p/not-security.py
@@ -1,31 +1,60 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv3
+from __future__ import absolute_import, print_function
 import sys
 import os
 import launchpadbugs.connector as Connector
-import configobj
 
-config = configobj.ConfigObj(os.path.expanduser('~/.ubuntu-cve-tracker.conf'))
-Bug = Connector.ConnectBug()
-Bug.authentication = os.path.join(config['plb_authentication'])
+if sys.version_info[0] == 2:
+    from ConfigParser import SafeConfigParser as ConfigParser
+    from cStringIO import StringIO
+else:
+    from configparser import ConfigParser
+    from io import StringIO
 
-for num in sys.argv[1:]:
-    bug = Bug(num)
+UCT_PATH = os.path.expanduser('~/.ubuntu-cve-tracker.conf')
 
-    comment = Bug.NewComment(text='Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug.  I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.', subject='')
-    bug.comments.add(comment)
-    bug.private = False
-    bug.security = False
 
-    try:
-        bug.subscribers.add("ubuntu-bugs")
-    except:
-        pass
+def get_config():
+    # replace configobj functionality to avoid extra dependency
+    config_content = StringIO()
+    config_content.write("[dummy_section]\n")
+    with open(UCT_PATH, "r") as fh:
+        config_content.write(fh.read())
+    config_content.seek(0)
+    parser = ConfigParser()
+    read_file_func = getattr(parser, "read_file", getattr(parser, "readfp", None))
+    if read_file_func is not None:
+        read_file_func(config_content)
+    return {k: v for k, v in parser.items("dummy_section")}
 
-    try:
-        bug.subscribtions.remove("ubuntu-security")
-    except:
-        pass
 
-    bug.commit(force_changes=True, ignore_lp_errors=False)
+def remove_security(*bugs):
+    Bug = Connector.ConnectBug()
+    config = get_config()
+    Bug.authentication = os.path.join(config['plb_authentication'])
+
+    for num in bugs:
+        bug = Bug(num)
+
+        comment = Bug.NewComment(text='Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug.  I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.', subject='')
+        bug.comments.add(comment)
+        bug.private = False
+        bug.security = False
+
+        try:
+            bug.subscribers.add("ubuntu-bugs")
+        except:
+            pass
+
+        try:
+            bug.subscribtions.remove("ubuntu-security")
+        except:
+            pass
+
+        bug.commit(force_changes=True, ignore_lp_errors=False)
+
+
+if __name__ == "__main__":
+    remove_security(*sys.argv[1:])
 \ No newline at end of file
diff --git a/p-l-p/reassign.py b/p-l-p/reassign.py
index d2d18f3..6690cec 100755
--- a/p-l-p/reassign.py
+++ b/p-l-p/reassign.py
@@ -1,7 +1,8 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
+from __future__ import absolute_import, print_function
 import sys
 import os, os
 import launchpadbugs.connector as Connector
@@ -22,26 +23,27 @@ if assignee == 'None':
     assignee = None
 
 for num in sys.argv[5:]:
-    bug = Bug(num)
+        bug = Bug(num)
 
-    for info in bug.get_infotable():
-        if info.target and info.target.lower() != 'ubuntu':
-            print 'skipping target "%s"' % (info.target)
-            continue
-        if info.targeted_to == 'Intrepid' or info.targeted_to == None or info.status == 'Fix Released' or info.status == 'Incomplete' or info.status == 'Invalid':
-            print 'skipping (targeted_to:%s status:%s)' % (info.targeted_to,info.status)
-            continue
-        if info.affects == pkg:
-            if status != "-" and info.status != status:
-                print '%s: status => %s' % (info.targeted_to,status)
-                info.status = status
-            if importance != "-" and info.importance != importance:
-                print '%s: status => %s' % (info.targeted_to,importance)
-                info.importance = importance
-            if assignee != "-" and info.assignee != assignee:
-                print '%s: assignee => %s' % (info.targeted_to,assignee)
-                info.assignee = assignee
-        else:
-            print 'skipping affects "%s"' % (info.affects)
+        for info in bug.get_infotable():
+            if info.target and info.target.lower() != 'ubuntu':
+                print('skipping target "%s"' % (info.target))
+                continue
+            if info.targeted_to == 'Intrepid' or info.targeted_to == None or info.status == 'Fix Released' or info.status == 'Incomplete' or info.status == 'Invalid':
+                print('skipping (targeted_to:%s status:%s)' % (info.targeted_to,info.status))
+                continue
+            if info.affects == pkg:
+                if status != "-" and info.status != status:
+                    print('%s: status => %s' % (info.targeted_to,status))
+                    info.status = status
+                if importance != "-" and info.importance != importance:
+                    print('%s: status => %s' % (info.targeted_to,importance))
+                    info.importance = importance
+                if assignee != "-" and info.assignee != assignee:
+                    print('%s: assignee => %s' % (info.targeted_to,assignee))
+                    info.assignee = assignee
+            else:
+                print('skipping affects "%s"' % (info.affects))
+
+        bug.commit(force_changes=True, ignore_lp_errors=False)
 
-    bug.commit(force_changes=True, ignore_lp_errors=False)
diff --git a/p-l-p/requires-trojaned-account.py b/p-l-p/requires-trojaned-account.py
index 3619b04..0970eee 100755
--- a/p-l-p/requires-trojaned-account.py
+++ b/p-l-p/requires-trojaned-account.py
@@ -1,7 +1,8 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
+from __future__ import absolute_import, print_function
 import sys, os
 import launchpadbugs.connector as Connector
 
diff --git a/p-l-p/set-package.py b/p-l-p/set-package.py
index def815c..1a62e14 100755
--- a/p-l-p/set-package.py
+++ b/p-l-p/set-package.py
@@ -1,4 +1,5 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
+from __future__ import absolute_import, print_function
 import sys, os
 import launchpadbugs.connector as Connector
 
@@ -6,7 +7,7 @@ Bug = Connector.ConnectBug()
 Bug.authentication = os.path.expanduser('~/.plb_cookies')
 
 if len(sys.argv) < 2:
-    print 'Usage: set-package.py PKG bug [bug ...]'
+    print('Usage: set-package.py PKG bug [bug ...]')
     sys.exit(1)
 
 pkg = sys.argv[1]
diff --git a/p-l-p/sub-security.py b/p-l-p/sub-security.py
index decca39..5259438 100755
--- a/p-l-p/sub-security.py
+++ b/p-l-p/sub-security.py
@@ -1,26 +1,33 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
 # Change 'keescook' to self below... (3 times)
+from __future__ import absolute_import, print_function
 import sys, os
 import launchpadbugs.connector as Connector
 
 Bug = Connector.ConnectBug()
 Bug.authentication = os.path.expanduser('~/.plb_cookies')
 
-for num in sys.argv[1:]:
-    print '%s ... ' % (num)
-    try:
-        bug = Bug(num)
-    except:
-        print 'private'
-        continue
 
-    if not bug.security:
-        continue
+def subscribe_ubuntu_security(*bugs)
+    for num in bugs:
+        print('%s ... ' % (num))
+        try:
+            bug = Bug(num)
+        except:
+            print('private')
+            continue
 
-    if not 'ubuntu-security' in bug.subscriptions['directly']:
-        bug.subscribers.add("ubuntu-security")
+        if not bug.security:
+            continue
 
-    bug.commit(force_changes=True, ignore_lp_errors=False)
+        if not 'ubuntu-security' in bug.subscriptions['directly']:
+            bug.subscribers.add("ubuntu-security")
+
+        bug.commit(force_changes=True, ignore_lp_errors=False)
+
+
+if __name__ == "__main__":
+    subscribe_ubuntu_security(*sys.argv[1:])
 \ No newline at end of file
diff --git a/p-l-p/tag.py b/p-l-p/tag.py
index 466e46b..2a59136 100755
--- a/p-l-p/tag.py
+++ b/p-l-p/tag.py
@@ -2,6 +2,7 @@
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
+from __future__ import absolute_import, print_function
 import sys, os
 import launchpadbugs.connector as Connector
 
@@ -9,14 +10,14 @@ Bug = Connector.ConnectBug()
 Bug.authentication = os.path.expanduser('~/.plb_cookies')
 
 if len(sys.argv) < 3:
-    print 'Usage: tag.py [+|-]TAG bug [bug ...]'
+    print('Usage: tag.py [+|-]TAG bug [bug ...]')
     sys.exit(1)
 
 tag = sys.argv[1]
 state = tag[0]
 tag = tag[1:]
 if state not in ['-','+']:
-    print 'Tag must start with - or +'
+    print('Tag must start with - or +')
     sys.exit(1)
 
 for num in sys.argv[2:]:
diff --git a/p-l-p/unsub-in-dups.py b/p-l-p/unsub-in-dups.py
index 24a2d97..cc6eb4c 100755
--- a/p-l-p/unsub-in-dups.py
+++ b/p-l-p/unsub-in-dups.py
@@ -1,8 +1,9 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # Copyright (C) 2007 Canonical, Ltd.  Kees Cook <[e-mail]>
 # License: GPLv2
 # Change the cookie path below...
 # Change 'keescook' below... (twice)
+from __future__ import absolute_import, print_function
 import sys, os
 import launchpadbugs.connector as Connector
 
@@ -12,7 +13,7 @@ Bug = Connector.ConnectBug()
 Bug.authentication = os.path.expanduser('~/.plb_cookies')
 
 def not_security(num):
-    print '%s ...' % (num),
+    print('%s ...' % (num), end=' ')
     bug = Bug(num)
 
     changed = False
@@ -22,9 +23,9 @@ def not_security(num):
 
     if changed:
         bug.commit(force_changes=True, ignore_lp_errors=False)
-        print 'updated'
+        print('updated')
     else:
-        print 'skipped'
+        print('skipped')
     return bug
 
 for num in sys.argv[2:]:
diff --git a/package-tools/debcompare b/package-tools/debcompare
index 5a3eac7..21e5538 100755
--- a/package-tools/debcompare
+++ b/package-tools/debcompare
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 
 # Name:        debcompare
 # Description: Compares different versions of binary packages
@@ -16,7 +16,7 @@
 #
 # License: GPLv3
 #
-from __future__ import print_function
+from __future__ import absolute_import, print_function
 
 import difflib
 import os
@@ -82,10 +82,9 @@ class DebFile:
         '''Gets the symbols of the file specified'''
 
         symbols = []
-        report = subprocess.check_output(["nm", "-DC", filename])
+        report = subprocess.check_output(["nm", "-DC", filename], universal_newlines=True)
 
         for line in report.splitlines():
-            line = line.decode()
             if line[0] == ' ':
                 # no address prefix, just take everything
                 symbol_entry = line.strip().split(maxsplit=2)[0:]
@@ -652,29 +651,35 @@ def compare_debs(old_deb, new_deb):
                  new_deb.jarfiles, new_deb.files_dir)
 
 
-if len(sys.argv) < 3:
-    print_usage()
-    sys.exit(1)
+if __name__ == "__main__":
+    # * Code that is unguarded by this check will run if the file is ever
+    # * used in an import statement, even if we only plan to use or import
+    # * one function from this file. Guarding code behind this check means
+    # * it only runs when the file is invoked directly (i.e. ./myfile.py)
+    # * or via the interpreter, i.e. python myfile.py
+    if len(sys.argv) < 3:
+        print_usage()
+        sys.exit(1)
 
-oldfile = os.path.abspath(sys.argv[1])
-newfile = os.path.abspath(sys.argv[2])
+    oldfile = os.path.abspath(sys.argv[1])
+    newfile = os.path.abspath(sys.argv[2])
 
-if not os.path.isfile(oldfile) or not os.path.isfile(newfile):
-    print_usage()
-    sys.exit(1)
+    if not os.path.isfile(oldfile) or not os.path.isfile(newfile):
+        print_usage()
+        sys.exit(1)
 
-check_required_tools()
+    check_required_tools()
 
-old_deb = DebFile(oldfile)
-new_deb = DebFile(newfile)
+    old_deb = DebFile(oldfile)
+    new_deb = DebFile(newfile)
 
-compare_debs(old_deb, new_deb)
+    compare_debs(old_deb, new_deb)
 
-# Clean up temp dirs
-if old_deb.temp_dir and os.path.exists(old_deb.temp_dir):
-    shutil.rmtree(old_deb.temp_dir, ignore_errors=True)
-if new_deb.temp_dir and os.path.exists(new_deb.temp_dir):
-    shutil.rmtree(new_deb.temp_dir, ignore_errors=True)
+    # Clean up temp dirs
+    if old_deb.temp_dir and os.path.exists(old_deb.temp_dir):
+        shutil.rmtree(old_deb.temp_dir, ignore_errors=True)
+    if new_deb.temp_dir and os.path.exists(new_deb.temp_dir):
+        shutil.rmtree(new_deb.temp_dir, ignore_errors=True)
 
-print("\n\n--------------")
-print("End of report.")
+    print("\n\n--------------")
+    print("End of report.")
diff --git a/repo-tools/count-hardened-pkgs b/repo-tools/count-hardened-pkgs
index 60d860a..f5b75cf 100755
--- a/repo-tools/count-hardened-pkgs
+++ b/repo-tools/count-hardened-pkgs
@@ -1,9 +1,13 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 # 2012, Kees Cook <[e-mail]>
 
+from __future__ import absolute_import, print_function
 import time, tempfile, shutil, sys, os, stat, glob
-import cPickle as pickle
-from subprocess import *
+import subprocess
+if sys.version_info[0] == 2:
+    import cPickle as pickle
+else:
+    import pickle
 
 count_names = ['elf', 'fortify', 'stackprotector', 'relro', 'bindnow', 'pie']
 run_time = time.strftime("%Y%m%d")
@@ -23,26 +27,26 @@ class Archive():
         else:
             components = [component]
 
-        print "Loading %s ..." % (release)
+        print("Loading %s ..." % (release))
         for component in components:
-            print "\t%s ..." % (component)
+            print("\t%s ..." % (component))
             packages = os.path.join(base, 'dists', release, component,
                                           'binary-%s' % (arch), 'Packages')
             packages_xz = packages + ".xz"
             packages_bz2 = packages + ".bz2"
             packages_gz = packages + ".gz"
             if os.path.exists(packages):
-                cat = Popen(["cat", packages], stdout=PIPE)
+                cat = subprocess.Popen(["cat", packages], stdout=subprocess.PIPE)
             elif os.path.exists(packages_xz):
-                cat = Popen(["xzcat", packages_xz], stdout=PIPE)
+                cat = subprocess.Popen(["xzcat", packages_xz], stdout=subprocess.PIPE)
             elif os.path.exists(packages_bz2):
-                cat = Popen(["bzcat", packages_bz2], stdout=PIPE)
+                cat = subprocess.Popen(["bzcat", packages_bz2], stdout=subprocess.PIPE)
             elif os.path.exists(packages_gz):
-                cat = Popen(["zcat", packages_gz], stdout=PIPE)
+                cat = subprocess.Popen(["zcat", packages_gz], stdout=subprocess.PIPE)
             else:
-                raise ValueError, "Missing %s*" % (packages)
-            p = Popen(["grep-dctrl", "-s", "Package,Source,Filename", "."],
-                      stdin=cat.stdout, stdout=PIPE)
+                raise ValueError("Missing %s*" % (packages))
+            p = subprocess.Popen(["grep-dctrl", "-s", "Package,Source,Filename", "."],
+                      stdin=cat.stdout, stdout=subprocess.PIPE)
 
             pkg = ""
             src = ""
@@ -62,7 +66,7 @@ class Archive():
                     self.srcs[src].setdefault(pkg, line.split(' ')[1])
             cat.wait()
             if cat.returncode != 0:
-                raise ValueError, "cat %s: %d" % (packges, cat.returncode)
+                raise ValueError("cat %s: %d" % (packges, cat.returncode))
 
     def sources(self):
         return sorted(self.srcs)
@@ -77,7 +81,7 @@ class HardeningReporter():
     def __init__(self, cachedir):
         # Load version cache.
         self.pickle = os.path.join(cachedir, 'cache.pickle')
-        print "Loading package cache ..."
+        print("Loading package cache ...")
         try:
             self.seen = pickle.load(open(self.pickle, "rb"))
         except:
@@ -132,9 +136,15 @@ class HardeningReporter():
         tmpdir = tempfile.mkdtemp(prefix='unpack-%s-%s-' % (src, pkg))
 
         # Unpack.
-        print "\t\tUnpacking into %s ..." % (tmpdir)
-        if call(['dpkg-deb', '-x', deb, tmpdir]) != 0:
-            print >> sys.stderr, "Could not unpack '%s'!?" % (deb)
+        print("\t\tUnpacking into %s ..." % (tmpdir))
+        try:
+            # XXX: subprocess.call is less preferable compared with check_call
+            # XXX: when we are only interested in handling failure cases and
+            # XXX: not specific outputs and return codes -- by default we can
+            # XXX: do nothing, this does relevant checks for us
+            subprocess.check_call(['dpkg-deb', '-x', deb, tmpdir])
+        except subprocess.CalledProcessError:
+            print("Could not unpack '%s'!?" % (deb), file=sys.stderr)
             # Force this package to be ignored.
             seen[src][pkg]['counts']['elf'] = 0
             return seen[src][pkg]['counts']
@@ -164,7 +174,7 @@ class HardeningReporter():
         if len(elfs) > 0:
             #print elfs
             badpie = 0
-            p = Popen(['hardening-check'] + elfs, stdout=PIPE)
+            p = subprocess.Popen(['hardening-check'] + elfs, stdout=subprocess.PIPE)
             for line in p.stdout:
                 if 'Position Independent Executable: ' in line:
                     if ': yes' in line:
@@ -194,7 +204,7 @@ class HardeningReporter():
             shutil.rmtree(tmpdir, ignore_errors=False)
         except:
             # Fix insane unpacks.
-            call(['chmod', '-R', 'u+rwx', tmpdir])
+            subprocess.check_call(['chmod', '-R', 'u+rwx', tmpdir])
             shutil.rmtree(tmpdir, ignore_errors=True)
 
         # Finished scanning this src/pkg combo, store it.
@@ -207,7 +217,7 @@ class HardeningReporter():
 class CacheArchive():
     def __init__(self, srcs, reporter):
         self.cache, self.mapping = reporter.cache()
-        print "Mapping source packages ..."
+        print("Mapping source packages ...")
         self.bins = [x.strip() for x in open(srcs, "r").readlines()]
         self.srcs = dict()
         for pkg in self.bins:
@@ -225,22 +235,6 @@ class CacheArchive():
         return self.cache[src][pkg]['filename']
 
 
-release = None
-arch = None
-component = None
-try:
-    output = sys.argv[1]
-    mirror = sys.argv[2]
-    if len(sys.argv) > 3:
-        release = sys.argv[3]
-        arch = sys.argv[4]
-    if len(sys.argv) > 5:
-        component = sys.argv[5]
-except:
-    print 'Usage: %s OUTDIR [BINPKGLIST|MIRROR RELEASE ARCH [COMPONENT]]' % (sys.argv[0])
-    print 'Example: %s /tmp/info /var/cache/mirrors/debian unstable amd64 main' % (sys.argv[0])
-    sys.exit(1)
-
 def scan_archive(reporter, archive):
     # The master package feature counts
     counts = dict()
@@ -252,15 +246,15 @@ def scan_archive(reporter, archive):
         src_counts.setdefault('elf', 0)
         badpie = 0
 
-        print "Source: %s ..." % (src)
+        print("Source: %s ..." % (src))
         for pkg in archive.binary_packages(src):
             deb = archive.package_path(src, pkg)
-            print "\t%s (%s) ..." % (pkg, deb)
+            print("\t%s (%s) ..." % (pkg, deb))
             bin_counts = reporter.examine(src, pkg, deb)
             if bin_counts['elf'] == 0:
                 # Ignore this deb.
                 continue
-            print "\t\t%s" % (repr(bin_counts))
+            print("\t\t%s" % (repr(bin_counts)))
 
             # If we have a binary package with ELF and no PIE,
             # this means a non-PIE executable was found.
@@ -278,7 +272,7 @@ def scan_archive(reporter, archive):
             src_counts.setdefault('pie', 0)
             src_counts['pie'] = 0
 
-        print "\t%s" % (repr(src_counts))
+        print("\t%s" % (repr(src_counts)))
 
         # If at least 1 binary's ELF has the option, count it as in source,
         # except for PIE, which is handled above as lacking non-PIE.
@@ -286,23 +280,47 @@ def scan_archive(reporter, archive):
             for name in count_names:
                 if src_counts[name] > 0:
                     counts[name] += 1
-        print "%s\n" % (repr(counts))
+        print("%s\n" % (repr(counts)))
 
     return counts
 
 
-reporter = HardeningReporter(output)
-
-if release == None:
-    archive = CacheArchive(mirror, reporter)
-else:
-    print "Loading archive ..."
-    archive = Archive(mirror, release, arch, component)
-
-counts = scan_archive(reporter, archive)
-
-# Append graph data.
-for name in counts:
-    report = open(os.path.join(output, '%s.data' % (name)), "a")
-    report.write('%s %d\n' % (run_time, counts[name]))
-    report.close()
+if __name__ == "__main__":
+    # * Code that is unguarded by this check will run if the file is ever
+    # * used in an import statement, even if we only plan to use or import
+    # * one function from this file. Guarding code behind this check means
+    # * it only runs when the file is invoked directly (i.e. ./myfile.py)
+    # * or via the interpreter, i.e. python myfile.py
+    release = None
+    arch = None
+    component = None
+    # TODO: switch to argparse
+    try:
+        output = sys.argv[1]
+        mirror = sys.argv[2]
+        if len(sys.argv) > 3:
+            release = sys.argv[3]
+            arch = sys.argv[4]
+        if len(sys.argv) > 5:
+            component = sys.argv[5]
+    except:
+        print('Usage: %s OUTDIR [BINPKGLIST|MIRROR RELEASE ARCH [COMPONENT]]' % (sys.argv[0]))
+        print('Example: %s /tmp/info /var/cache/mirrors/debian unstable amd64 main' % (sys.argv[0]))
+        sys.exit(1)
+
+    reporter = HardeningReporter(output)
+
+    if release == None:
+        archive = CacheArchive(mirror, reporter)
+    else:
+        print("Loading archive ...")
+        archive = Archive(mirror, release, arch, component)
+
+    counts = scan_archive(reporter, archive)
+
+    # Append graph data.
+    for name in counts:
+        # * Open files in context managers to make sure file handles are
+        # * closed properly before the process is cleaned up
+        with open(os.path.join(output, '%s.data' % (name)), "a") as report:
+            report.write('%s %d\n' % (run_time, counts[name]))
diff --git a/repo-tools/count-hash-sources b/repo-tools/count-hash-sources
index 48e6c2d..de5fbf4 100755
--- a/repo-tools/count-hash-sources
+++ b/repo-tools/count-hash-sources
@@ -1,12 +1,20 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 
+from __future__ import absolute_import, print_function
 import deb822 # from python-debian
-import gzip
 import argparse
+import contextlib
+import gzip
+import io
 import os
 import re
 import sys
-import urllib2
+
+if sys.version_info[0] == 2:
+    from urllib2 import urlopen
+else:
+    from urllib.request import urlopen
+
 
 components = ['main', 'multiverse', 'restricted', 'universe']
 default_releases = ['precise', 'trusty', 'xenial', 'bionic', 'cosmic', 'disco']
@@ -16,22 +24,23 @@ def count_md5only_sources(sources_list):
     md5only = 0
     sha1only = 0
     langpack = 0
-    for src in deb822.Sources.iter_paragraphs(file(sources_list)):
-        count += 1
-        if not src.has_key('Checksums-Sha256'):
-            sha1only += 1
-            if not src.has_key('Checksums-Sha1'):
-                if re.match("language-pack-.*", src['Package']):
-                    langpack += 1
-                else:
-                    md5only += 1
-                #print src['Package']
-        if not src.has_key('Files'):
-            print "Bizarre, src package '%s' has no Files section" %(src['Package'])
+    with open(sources_list, "r") as sources_handle:
+        for src in deb822.Sources.iter_paragraphs(sources_handle):
+            count += 1
+            if 'Checksums-Sha256' not in src:
+                sha1only += 1
+                if 'Checksums-Sha1' not in src:
+                    if re.match("language-pack-.*", src['Package']):
+                        langpack += 1
+                    else:
+                        md5only += 1
+                    #print src['Package']
+            if 'Files' not in src:
+                print("Bizarre, src package '%s' has no Files section" %(src['Package']))
     return (count, md5only, sha1only, langpack)
 
 def download_release_files(release):
-    print "Downloading release files for %s" % release
+    print("Downloading release files for %s" % release)
 
     for component in components:
 
@@ -42,39 +51,43 @@ def download_release_files(release):
             continue
 
         url= "http://archive.ubuntu.com/ubuntu/dists/%s/%s/source/Sources.gz" % (release, component)
-        print "Downloading %s..." % url
-
-        # Download it
-        open_url = urllib2.urlopen(url)
-        output = open('Sources.gz','wb')
-        output.write(open_url.read())
-        output.close()
-
-        # Now uncompress it
-        f_in = gzip.open('Sources.gz', 'rb')
-        f_out = open(file_name, 'wb')
-        f_out.writelines(f_in)
-        f_out.close()
-        f_in.close()
-
-        os.unlink('Sources.gz')
-
-    print "Download completed."
-
-parser = argparse.ArgumentParser(description='Finds source packages with md5 only hash sums')
-parser.add_argument('-r', '--release', action='append', help="find sources in a specific release")
-args = parser.parse_args()
-
-if args.release:
-    releases = args.release
-else:
-    releases = default_releases
-
-for release in releases:
-    download_release_files(release)
-
-for release in releases:
-    for component in components:
-        (total, md5only, sha1only, langpack) = count_md5only_sources("%s-sources-%s" %(release, component))
-        print "%s %s: \ttotal: %d \tmd5only: %d\tsha1only: %d\tlangpacks: %d" %(release, component, total, md5only, sha1only, langpack)
-    print
+        print("Downloading %s..." % url)
+
+        # * Download compressed contents and write it to a buffer
+        compressed_contents = io.BytesIO()
+        with contextlib.closing(urlopen(url)) as response:
+            compressed_contents.write(response.read())
+        compressed_contents.seek(0)
+
+        # * Now lets unzip the buffer, decode it, clean up line endings and
+        # * write to a target file
+        with gzip.GzipFile(fileobj=compressed_contents, mode="rb") as f_in:
+            with open(file_name, "w") as f_out:
+                f_out.write(f_in.read().decode("utf-8").replace(r"\r\n", r"\n"))
+
+    print("Download completed.")
+
+
+if __name__ == "__main__":
+    # * Code that is unguarded by this check will run if the file is ever
+    # * used in an import statement, even if we only plan to use or import
+    # * one function from this file. Guarding code behind this check means
+    # * it only runs when the file is invoked directly (i.e. ./myfile.py)
+    # * or via the interpreter, i.e. python myfile.py
+    parser = argparse.ArgumentParser(description='Finds source packages with md5 only hash sums')
+    parser.add_argument('-r', '--release', action='append', help="find sources in a specific release")
+    args = parser.parse_args()
+
+    if args.release:
+        releases = args.release
+    else:
+        releases = default_releases
+
+    for release in releases:
+        download_release_files(release)
+
+    for release in releases:
+        for component in components:
+            total, md5only, sha1only, langpack = count_md5only_sources("%s-sources-%s" %(release, component))
+            print("%s %s: \ttotal: %d \tmd5only: %d\tsha1only: %d\tlangpacks: %d" %(release, component, total, md5only, sha1only, langpack))
+        print()
diff --git a/repo-tools/for-archive-tools/has-execstack b/repo-tools/for-archive-tools/has-execstack
index 4d53338..8453f2b 100755
--- a/repo-tools/for-archive-tools/has-execstack
+++ b/repo-tools/for-archive-tools/has-execstack
@@ -1,27 +1,42 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 # Copyright 2009 Canonical, Ltd
 # Author: Kees Cook <[e-mail]>
 # License: GPLv3
 #
 # Expects to be run via "unpack-search" within "for-archive"
 # Checks only ELF files for execstack, and reports anything non-exec or unknown
-import sys, subprocess
+from __future__ import absolute_import, print_function
+import os
+import subprocess
+import sys
 files = sys.argv[1:]
 if files[0] == '--':
     files.pop(0)
 if files[0] == '--':
     files.pop(0)
-devnull = open('/dev/null','w')
-for f in files:
-    #print >>sys.stderr, f
-    try:
-        ok = (open(f).read(4) == '\x7fELF')
-    except:
-        continue
-    if ok:
-        out = subprocess.Popen(['execstack','-q',f],stdout=subprocess.PIPE,stderr=devnull).communicate()[0]
-        for line in out.splitlines():
-            line = line.strip()
-            if line.startswith('- '):
+# * Here we use a context manager again to make sure the handle is closed
+with open('/dev/null','w') as devnull:
+    for f in files:
+        if not os.path.exists(f) and os.path.isfile(f):
+            continue
+        with open(f, "rb") as fh:
+            try:
+                ok = f.read(4) == b"\x7fELF"
+            except Exception:
                 continue
-            print line
+        if ok:
+            # * the .communicate() call returns a 2-tuple (stdout, stderr), so
+            # * we are implicitly throwing away stderr by assigning it to _
+            # * which is ignored in python
+            # * Note that we are using 'universal_newlines=True' which actually
+            # * tells the interpreter to give back unicode output rather than
+            # * bytes, so we will be equipped for moving back and forth between
+            # * python 2 and python 3
+            out, _ = subprocess.Popen(
+                ['execstack','-q',f], stdout=subprocess.PIPE, stderr=devnull,
+                universal_newlines=True
+            ).communicate()
+            for line in out.splitlines():
+                line = line.strip()
+                if not line.startswith('- '):
+                    print(line)
diff --git a/repo-tools/for-archive-tools/has-symbols b/repo-tools/for-archive-tools/has-symbols
index a48402c..a62af89 100755
--- a/repo-tools/for-archive-tools/has-symbols
+++ b/repo-tools/for-archive-tools/has-symbols
@@ -1,12 +1,15 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 # Copyright 2009 Canonical, Ltd
 # Author: Kees Cook <[e-mail]>
 # License: GPLv3
 #
 # Expects to be run via "unpack-search" within "for-archive"
 # Checks only ELF files for symbols, and reports anything referencing these symbols
-import sys, subprocess
+from __future__ import absolute_import, print_function
+import os
 import re
+import subprocess
+import sys
 
 symrx = re.compile(r'\*UND\*.*(_ZNSt6chrono12system_clock3nowEv|_ZNSt6chrono12steady_clock3nowEv)')
 #symrx = re.compile(r'\*UND\*.*(__fprintf_chk|__progname_full)')
@@ -16,17 +19,29 @@ if files[0] == '--':
     files.pop(0)
 if files[0] == '--':
     files.pop(0)
-devnull = open('/dev/null','w')
-for f in files:
-    #print >>sys.stderr, f
-    try:
-        ok = (open(f).read(4) == '\x7fELF')
-    except:
-        continue
-    if ok:
-        out = subprocess.Popen(['objdump','-T',f],stdout=subprocess.PIPE,stderr=devnull).communicate()[0]
-        for line in out.splitlines():
-            line = line.strip()
-            if not symrx.search(line):
+# * Here we use a context manager again to make sure the handle is closed
+with open('/dev/null','w') as devnull:
+    for f in files:
+        if not os.path.exists(f) and os.path.isfile(f):
+            continue
+        with open(f, "rb") as fh:
+            try:
+                ok = f.read(4) == b"\x7fELF"
+            except Exception:
                 continue
-            print line
+        if ok:
+            # * the .communicate() call returns a 2-tuple (stdout, stderr), so
+            # * we are implicitly throwing away stderr by assigning it to _
+            # * which is ignored in python
+            # * Note that we are using 'universal_newlines=True' which actually
+            # * tells the interpreter to give back unicode output rather than
+            # * bytes, so we will be equipped for moving back and forth between
+            # * python 2 and python 3
+            out, _ = subprocess.Popen(
+                ['objdump', '-T' ,f], stdout=subprocess.PIPE, stderr=devnull,
+                universal_newlines=True
+            ).communicate()
+            for line in out.splitlines():
+                line = line.strip()
+                if symrx.search(line):
+                    print(line)
 \ No newline at end of file
diff --git a/repo-tools/packages-support-status b/repo-tools/packages-support-status
index 9817a80..c0082f6 100755
--- a/repo-tools/packages-support-status
+++ b/repo-tools/packages-support-status
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 
 # Author: Marc Deslauriers <[e-mail]>
 # Copyright (C) 2012 Canonical Ltd.
@@ -12,17 +12,23 @@
 #
 # You can download the Release files for i386 with the --download command.
 #
-from __future__ import print_function
+from __future__ import absolute_import, print_function
 
+import contextlib
+import io
 import gzip
 import os
 import re
 import sys
-import urllib.error
-import urllib.parse
-import urllib.request
 from optparse import OptionParser
 
+if sys.version_info[0] == 2:
+    from urllib2 import urlopen
+else:
+    from urllib.request import urlopen
+
+# TODO: Switch to argparse
+
 components = ['main', 'multiverse', 'restricted', 'universe']
 
 def parse_package_files():
@@ -84,56 +90,59 @@ def download_release_files(release):
         url= "http://archive.ubuntu.com/ubuntu/dists/%s/%s/binary-i386/Packages.gz" % (release, component)
         print("Downloading %s..." % url)
 
-        # Download it
-        open_url = urllib.request.urlopen(url)
-        output = open('Packages.gz', 'wb')
-        output.write(open_url.read())
-        output.close()
-
-        # Now uncompress it
-        f_in = gzip.open('Packages.gz', 'rb')
-        f_out = open(file_name, 'wb')
-        f_out.writelines(f_in)
-        f_out.close()
-        f_in.close()
-
-        os.unlink('Packages.gz')
-
+        # * Download compressed contents and write it to a buffer
+        compressed_contents = io.BytesIO()
+        with contextlib.closing(urlopen(url)) as response:
+            compressed_contents.write(response.read())
+        compressed_contents.seek(0)
+
+        # * Now lets unzip the buffer, decode it, clean up line endings and
+        # * write to a target file
+        with gzip.GzipFile(fileobj=compressed_contents, mode="rb") as f_in:
+            with open(file_name, "w") as f_out:
+                f_out.write(f_in.read().decode("utf-8").replace(r"\r\n", r"\n"))
     print("Download completed.")
 
 def print_package(package, component, supported):
     print("%-50s %-12s %s" % (package, component, supported))
 
-parser = OptionParser()
-parser.add_option("", "--show-unsupported",
-                  action="append_const", dest="filter",
-                  const="Unsupported", help="Show unsupported packages")
-parser.add_option("", "--show-18m",
-                  action="append_const", dest="filter",
-                  const="18m", help="Show 18m supported packages")
-parser.add_option("", "--show-3y",
-                  action="append_const", dest="filter",
-                  const="3y", help="Show 3y supported packages")
-parser.add_option("", "--show-5y",
-                  action="append_const", dest="filter",
-                  const="5y", help="Show 5y supported packages")
-parser.add_option("", "--download", metavar="RELEASE",
-                  action="store", dest="download",
-                  help="Download release files for RELEASE in current directory")
-
-(options, args) = parser.parse_args()
-
-if options.download:
-    download_release_files(options.download)
-    sys.exit(0)
-
-packages = parse_package_files()
-all_packages = sorted(packages.keys())
-for package in all_packages:
-
-    if options.filter:
-        if packages[package]['supported'] not in options.filter:
-            continue
-
-    print_package(package, packages[package]['component'], packages[package]['supported'])
+
+if __name__ == "__main__":
+    # * Code that is unguarded by this check will run if the file is ever
+    # * used in an import statement, even if we only plan to use or import
+    # * one function from this file. Guarding code behind this check means
+    # * it only runs when the file is invoked directly (i.e. ./myfile.py)
+    # * or via the interpreter, i.e. python myfile.py
+    parser = OptionParser()
+    parser.add_option("", "--show-unsupported",
+                    action="append_const", dest="filter",
+                    const="Unsupported", help="Show unsupported packages")
+    parser.add_option("", "--show-18m",
+                    action="append_const", dest="filter",
+                    const="18m", help="Show 18m supported packages")
+    parser.add_option("", "--show-3y",
+                    action="append_const", dest="filter",
+                    const="3y", help="Show 3y supported packages")
+    parser.add_option("", "--show-5y",
+                    action="append_const", dest="filter",
+                    const="5y", help="Show 5y supported packages")
+    parser.add_option("", "--download", metavar="RELEASE",
+                    action="store", dest="download",
+                    help="Download release files for RELEASE in current directory")
+
+    (options, args) = parser.parse_args()
+
+    if options.download:
+        download_release_files(options.download)
+        sys.exit(0)
+
+    packages = parse_package_files()
+    all_packages = sorted(packages.keys())
+    for package in all_packages:
+
+        if options.filter:
+            if packages[package]['supported'] not in options.filter:
+                continue
+
+        print_package(package, packages[package]['component'], packages[package]['supported'])
 
diff --git a/repo-tools/universe-binaries-with-sources-in-main.py b/repo-tools/universe-binaries-with-sources-in-main.py
index 8c76793..ccd1a03 100755
--- a/repo-tools/universe-binaries-with-sources-in-main.py
+++ b/repo-tools/universe-binaries-with-sources-in-main.py
@@ -1,10 +1,12 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 
+from __future__ import absolute_import, print_function
 packages = "./universe/binary-i386/Packages"
 sources = "./main/source/Sources"
 
 # Get all the binaries in universe
-lines = open(packages).readlines()
+with open(packages, "r") as fh:
+    lines = fh.readlines()
 bins = {}
 for line in lines:
     line = line.strip()
@@ -12,6 +14,8 @@ for line in lines:
         bins[line.split()[1]] = True
 
 # then see if one of these binaries matches the Binary line in sources from main
+with open(sources, "r") as fh:
+    lines = fh.readlines()
 lines = open(sources).readlines()
 srcs = {}
 src = None
@@ -23,4 +27,4 @@ for line in lines:
         for b in line.partition(' ')[2].split(','):
             b = b.strip()
             if b in bins:
-                print "%s (src: %s)" % (b, src)
+                print("%s (src: %s)" % (b, src))
diff --git a/snaps/coverity-ubuntu-security/files/bin/refresh-auth-key b/snaps/coverity-ubuntu-security/files/bin/refresh-auth-key
index 88ac51a..9f6cf3c 100755
--- a/snaps/coverity-ubuntu-security/files/bin/refresh-auth-key
+++ b/snaps/coverity-ubuntu-security/files/bin/refresh-auth-key
@@ -1,5 +1,6 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 
+from __future__ import absolute_import, print_function
 import json
 import os
 import subprocess
diff --git a/utilities/build_failures.py b/utilities/build_failures.py
index 18a2896..d4df8cc 100755
--- a/utilities/build_failures.py
+++ b/utilities/build_failures.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+#!/usr/bin/env python3
 
 # This is a start of a script that looks for build failures on the
 # yaml version of the excuses page from
@@ -8,20 +8,26 @@
 # In particular, we're looking for failures due to gcc -pie by default
 # on amd64, where a build will succeed on i386 but fail on amd64
 
-from yaml import load, dump
+from __future__ import absolute_import, print_function
+from yaml import safe_load, safe_dump
 
-with open("update_excuses.yaml") as f:
-    data = load(f)
 
-source_entries = data['sources']
+def check_builds():
+    with open("update_excuses.yaml", "r") as f:
+        data = safe_load(f)
 
-for s in source_entries:
-    if 'missing-builds' in s.keys():
-        arches = s['missing-builds']['on-architectures']
-        if 'amd64' in arches and not 'i386' in arches:
-            for excuse in s['excuses']:
-                if excuse.startswith("missing build on") and '>amd64<' in excuse:
-                    url = excuse.split('"')[1]
-                    print('%s: %s' % (s['source'], url))
-            #print('%s' %s)
+    source_entries = data['sources']
 
+    for s in source_entries:
+        if 'missing-builds' in s:
+            arches = s['missing-builds']['on-architectures']
+            if 'amd64' in arches and 'i386' not in arches:
+                for excuse in s['excuses']:
+                    if excuse.startswith("missing build on") and '>amd64<' in excuse:
+                        url = excuse.split('"')[1]
+                        print('%s: %s' % (s['source'], url))
+                #print('%s' %s)
+
+
+if __name__ == "__main__":
+    check_builds()
 \ No newline at end of file
diff --git a/utilities/ceviche b/utilities/ceviche
index 546482b..4f7e3c5 100755
--- a/utilities/ceviche
+++ b/utilities/ceviche
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 
 # Author: Paulo Flabiano Smorigo <[e-mail]>
 # Copyright (C) 2020 Canonical Ltd.
@@ -7,17 +7,26 @@
 # Public License, Version 2 or later. See http://www.gnu.org/copyleft/gpl.html
 # for details.
 
+from __future__ import absolute_import, print_function
+import contextlib
 import curses
+import glob
 import json
 import optparse
 import os
-import pickle
 import re
 import subprocess
 import sys
 import time
-import urllib2
-import glob
+
+if sys.version_info[0] == 2:
+    from urllib2 import urlopen
+    import cPickle as pickle
+    raw_input = raw_input
+else:
+    from urllib.request import urlopen
+    import pickle
+    raw_input = input
 
 # cve_lib may not be in PYTHONPATH so try harder to find it
 try:
@@ -155,8 +164,11 @@ def main_screen(stdscr, opt, args):
         colors.append(["high", 197, -1])
         colors.append(["critical", 197, -1])
 
-    for i in range(0, len(colors)):
-        curses.init_pair(i + 1, colors[i][1], colors[i][2])
+    for i, color_triplet in enumerate(colors, start=1):
+        # * Range operations are slightly different between python 2 and 3
+        # * so should be avoided wherever possible
+        _, fg_color, bg_color = color_triplet
+        curses.init_pair(i, fg_color, bg_color)
 
     downloaded = []
     if os.path.isdir(DOWNLOAD_PATH):
@@ -519,6 +531,7 @@ def main_screen(stdscr, opt, args):
                 stdscr.addstr(x, columns_start - 7, "%6d" % item[COL_POP])
 
             y = columns_start
+            # check the status on each supported release
             for i in range(COL_REL, len(RELEASES) + COL_REL):
                 release_status = item[i]
                 if release_status == "needed" \
@@ -706,7 +719,7 @@ def run_command(stdscr, command, pause = False):
     os.system("bash -c \"%s\"" % command)
     if pause:
         try:
-            input("\nPress Enter to continue...")
+            raw_input("\nPress Enter to continue...")
         except:
             pass
     curses.reset_prog_mode()
@@ -755,7 +768,7 @@ def reload_persistent_data(stdscr, opt):
 
             column = COL_REL
             for release in RELEASES:
-                if release in table[cve][package].keys():
+                if release in table[cve][package]
                     item[column] = table[cve][package][release]
                 else:
                     item[column] = "---"
@@ -782,13 +795,13 @@ def load_persistent_data(stdscr, opt):
         return reload_persistent_data(stdscr, opt)
 
 def get_links(filename):
-    list = []
+    match_list = []
     with open(filename) as fh:
         for line in fh:
             match = re.search("(http|https|ftp)://[\w\-]+(\.[\w\-]+)+\S*", line)
             if match:
-                list.insert(len(list), match.group())
-    return list
+                match_list.append(match.group())
+    return match_list
 
 def is_patch(url):
     if re.search("(http|https|ftp)://.*\/(commit|hg\/rev)\/.*", url):
@@ -798,12 +811,10 @@ def is_patch(url):
 
 def save_patches(filename):
     cve = os.path.basename(filename)
-    links = []
-    for link in get_links(filename):
-        if is_patch(link):
-            links.insert(len(links), link)
-
-    links = list(dict.fromkeys(links)) # Remove duplicates
+    # * Use set comprehension to eliminate duplicates - creates a set which
+    # * by definition only contains unique elements, duplicates are discarded
+    # * then we just convert back to a list
+    links = list({link for link in get_links(filename) if is_patch(link)})
 
     try:
         message = "Saved:"
@@ -811,19 +822,22 @@ def save_patches(filename):
             link = links[0]
             link += ".patch" if link[-6:] != ".patch" else ""
 
-            filedata = urllib2.urlopen(link)
-            datatowrite = filedata.read()
+            with contextlib.closing(urlopen(link)) as response:
+                filedata = response.read()
+            # FIXME: Don't write full absolute paths directly to the filesystem
+            # XXX : Use NamedTemporaryFile / mkstemp to generate names
             tmpfile = '%s.patch' % cve
             message += " %s" % tmpfile
             with open('/tmp/' + tmpfile, 'wb') as f:
-                f.write(datatowrite)
+                f.write(filedata)
         elif len(links) > 1:
-            for i in range(0, len(links)):
-                filedata = urllib2.urlopen("%s.patch" % links[i])
-                datatowrite = filedata.read()
+            for i, link in enumerate(links):
+                url = "%s.patch" % link
+                with contextlib.closing(urlopen(url)) as response:
+                    filedata = response.read()
                 tmpfile = '%s-%d.patch' % (cve, i + 1)
                 with open('/tmp/' + tmpfile, 'wb') as f:
-                    f.write(datatowrite)
+                    f.write(filedata)
                 message += " %s" % tmpfile
         return message
     except:
@@ -832,7 +846,7 @@ def save_patches(filename):
 def git_filter(filter):
     returnlist = []
     p = subprocess.Popen(['git', '-C', PATH, 'status', '-s', '.'],
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True)
     out, err = p.communicate()
     for line in out.splitlines():
         l = line.split()
@@ -964,6 +978,7 @@ def parse_opts():
     return (opt, args)
 
 def main():
+    # TODO: Migrate to argparse
     (opt, args) = parse_opts()
     if not os.path.isdir(PATH):
         print("CVEs directory not found (%s)!" % PATH)
diff --git a/utilities/maildir2mbox.py b/utilities/maildir2mbox.py
index ef75c99..9abe155 100755
--- a/utilities/maildir2mbox.py
+++ b/utilities/maildir2mbox.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 #
 # Author: Jamie Strandboge <[e-mail]>
 # Copyright (C) 2005-2011 Canonical Ltd.
@@ -11,6 +11,7 @@
 # directories.
 #
 
+from __future__ import absolute_import, print_function
 import datetime
 import email
 import email.utils
@@ -25,20 +26,20 @@ import tempfile
 def debug(s):
     '''Print debug message'''
     if opt.debug:
-        print >>sys.stderr, "DEBUG: %s" % (s)
+        print("DEBUG: %s" % (s), file=sys.stderr)
 
 def get_date(s):
     '''Return a datetime.date object from string'''
     pat = re.compile(r'^\d\d\d\d-\d\d-\d\d$')
     d = None
     if not pat.match(s):
-        print >>sys.stderr, "date '%s' should be YYYY-MM-DD" % (s)
+        print("date '%s' should be YYYY-MM-DD" % (s), file=sys.stderr)
         return None
     t = s.split('-')
     try:
         d = datetime.date(int(t[0]), int(t[1]), int(t[2]))
     except:
-        print >>sys.stderr, "Invalid date '%s'" % (s)
+        print("Invalid date '%s'" % (s), file=sys.stderr)
         raise
 
     return d
@@ -64,16 +65,16 @@ parser.add_option("--end-date",
 (opt, args) = parser.parse_args()
 
 if not opt.folder:
-    print >>sys.stderr, "Must specify --folder"
+    print("Must specify --folder", file=sys.stderr)
     sys.exit(1)
 elif not opt.mbox:
-    print >>sys.stderr, "Must specify --mbox"
+    print("Must specify --mbox", file=sys.stderr)
     sys.exit(1)
 elif not os.path.isdir(opt.folder):
-    print >>sys.stderr, "'%s' does not exist" % opt.folder
+    print("'%s' does not exist" % opt.folder, file=sys.stderr)
     sys.exit(1)
 elif os.path.exists(opt.mbox):
-    print >>sys.stderr, "'%s' already exists" % opt.mbox
+    print("'%s' already exists" % opt.mbox, file=sys.stderr)
     sys.exit(1)
 
 start = None
@@ -114,7 +115,7 @@ for message in src_maildir:
             debug("Skipping: 'Subject: %s' (%s is after %s)" % (message['subject'], msg_date, start))
             continue
 
-    if message.has_key('subject') and message.has_key('date'):
+    if 'subject' in message and 'date' in message:
         debug("Processing '%s: Subject: %s'" % (message['date'], message['subject']))
 
     try:
diff --git a/utilities/mugshot b/utilities/mugshot
index 9f063ea..55dc6ff 100755
--- a/utilities/mugshot
+++ b/utilities/mugshot
@@ -1,9 +1,9 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 # Author: Kees Cook <[e-mail]>
 # Copyright (C) 2010 Canonical, Ltd.
 # License: GPLv3
 
-from __future__ import print_function
+from __future__ import absolute_import, print_function
 import sys
 import optparse
 import httplib2