import xmlrpc doesn't appears to get us xmlrpc.client. pre-defused code had the latter.

Rather than simply wrap monkey_patch() in a try, it would be better to note that it's not available during the earlier import and make this simply a conditional

-    server = xmlrpc.xmlrpc_client.ServerProxy(
+    server = xmlrpc.client.ServerProxy(

For whatever reason, defusedxml.xmlrpc does not have a client global. It still uses the old name. The have their own py2/3 import wrapper and assign to xmlrpc_client for both cases.

Perhaps something like this?

@@ -50,6 +50,7 @@ try:
 except ImportError:
     import xmlrpc  # nosec B411, we don't always have non-stdlib libraries
+    import xmlrpc.client
     defusedxml_enabled = False
 import six    # noqa: F401, needed for imported code
@@ -61,6 +62,9 @@ KOJIKAMID = True
 if defusedxml_enabled:
     # patching xmlrpc to protect against XML related attacks
     xmlrpc.monkey_patch()
+    xmlrpc_client = xmlrpc.xmlrpc_client
+else:
+    xmlrpc_client = xmlrpc.client

And then use xmlrpc_client in our calls.

Alternately, we could probably just import xmlrpc.client directly and rely on monkey_patch to fix the underlying libs (the client class should be the same object either way).

simplified a bit

:thumbsup:

Commit 83b4fb5a fixes this pull-request