Re: including EOL and vulnerable software in Fedora

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 8 October 2016 at 23:13, Kevin Kofler <kevin.kofler@xxxxxxxxx> wrote:
> These python[23][1-9] packages are entirely unnecessary and should go away
> ASAP.

They're not unnecessary for Python developers, as if you want to make
sure you're not accidentally using any features from later versions of
Python, the only way to reliably check that is to actually test your
code on those older versions. Tools like "tox" make that relatively
easy to do, but you still need a straightforward way to get hold of
the old runtimes for tox to use. The addition of these packages to
Fedora means that as soon as you do "dnf install tox", those runtimes
are all brought in automatically via Recommends, rather than having to
jump through multiple hoops to reconfigure your local package
management.

For the specific case of Python though, it would be better if the EOL
upstream versions were built from the CentOS SRPMs (which *do* get
security fixes) rather than directly from the upstream tarballs (in
addition to Python 2.6 RPMs that mirror those in CentOS 6.x, it'd be
nice to have the patched Python 2.7.5 release from CentOS 7.x readily
available for compatibility testing as well).

So +1 from me for the general premise of this thread - if we're going
to include EOL software, that should be treated as a special case
requiring approval from FESCo, and we should try to find a source for
that software where it *isn't* EOL (even if that means inverting the
traditional dependency flow between Fedora and RHEL/CentOS).

However, I'm also a strong +1 for making tox work well by default in
Fedora, and that means providing widely used Python runtime versions,
even if they're officially EOL upstream and now only supported by
redistributors.

Cheers,
Nick.

-- 
Nick Coghlan   |   ncoghlan@xxxxxxxxx   |   Brisbane, Australia
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux