Re: including EOL and vulnerable software in Fedora

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, Oct 8, 2016 at 11:42 PM, Nick Coghlan <ncoghlan@xxxxxxxxx> wrote:
> On 8 October 2016 at 23:13, Kevin Kofler <kevin.kofler@xxxxxxxxx> wrote:
>> These python[23][1-9] packages are entirely unnecessary and should go away
>> ASAP.
>
> They're not unnecessary for Python developers, as if you want to make
> sure you're not accidentally using any features from later versions of
> Python, the only way to reliably check that is to actually test your
> code on those older versions. Tools like "tox" make that relatively
> easy to do, but you still need a straightforward way to get hold of
> the old runtimes for tox to use. The addition of these packages to
> Fedora means that as soon as you do "dnf install tox", those runtimes
> are all brought in automatically via Recommends, rather than having to
> jump through multiple hoops to reconfigure your local package
> management.
>
> For the specific case of Python though, it would be better if the EOL
> upstream versions were built from the CentOS SRPMs (which *do* get
> security fixes) rather than directly from the upstream tarballs (in
> addition to Python 2.6 RPMs that mirror those in CentOS 6.x, it'd be
> nice to have the patched Python 2.7.5 release from CentOS 7.x readily
> available for compatibility testing as well).
>
> So +1 from me for the general premise of this thread - if we're going
> to include EOL software, that should be treated as a special case
> requiring approval from FESCo, and we should try to find a source for
> that software where it *isn't* EOL (even if that means inverting the
> traditional dependency flow between Fedora and RHEL/CentOS).
>
> However, I'm also a strong +1 for making tox work well by default in
> Fedora, and that means providing widely used Python runtime versions,
> even if they're officially EOL upstream and now only supported by
> redistributors.
>

Why in the main repository? Why not just put them in a COPR instead?
The main repository provides a very specific promise that I don't
think we can keep with these EOL packages (that the software is
trustable, useful, and dependable).


-- 
真実はいつも一つ!/ Always, there's only one truth!
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux