Re: including EOL and vulnerable software in Fedora

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 10/09/2016 05:39 PM, Kevin Kofler wrote:
Nick Coghlan wrote:
They're not unnecessary for Python developers, as if you want to make
sure you're not accidentally using any features from later versions of
Python, the only way to reliably check that is to actually test your
code on those older versions. Tools like "tox" make that relatively
easy to do, but you still need a straightforward way to get hold of
the old runtimes for tox to use. The addition of these packages to
Fedora means that as soon as you do "dnf install tox", those runtimes
are all brought in automatically via Recommends, rather than having to
jump through multiple hoops to reconfigure your local package
management.

That contradicts churchyard's claim in the FESCo tracker:
| These packages are not intended to be used as dependencies for other
| packages (such as we have some "compat" packages when another package
| needs an older version of a library), hence we want to stop people from
| requiring them, see ​https://fedorahosted.org/fpc/ticket/650 - as a result
| no software in Fedora will ever run on those.

Indeed, there's a disconnect here. The old Pythons are intended for *upstream* development/testing.

If you're developing for Fedora, the old Pythons are not for you.
They're for people who are developing cross-platform libraries, which for some reason need backwards compatibility: usually for deployment elsewhere (old RHEL, old Debian – I've even seen people that need an old Python for Symbian phones, though that's older than we can support in Fedora). And if you're developing a cross-platform library, you don't *want* your dependencies to come form RPMs. They need to be installable from PyPI (the Python-specific package repository) so you can use them on any distro. So, the older Pythons should come with virtualenv & Pip, but a RPM ecosystem around them would be useless.

The people this is for want to develop compatible libraries for Python. They don't really care for the OS underneath. But having the old Pythons easily installable provides an incentive for them to choose Fedora.

The resulting upstream libraries can then be packaged as RPMs with Fedora's normal Python.


I would also like to point out that if you have these suffixed Python
versions installed, some build scripts may be accidentally picking up those
instead of the recommended default versions of Python.

Do you mean Fedora build scripts here?


--
Petr Viktorin
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux