Re: including EOL and vulnerable software in Fedora

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 10/10/2016 06:18 PM, Kevin Kofler wrote:
Charalampos Stratakis wrote:
tox is THE main reason for multiple interpreters in Fedora.

So no the comments are not contradictory but it seems there is a lack of
(technical) understanding of the actual situation here, but I may be wrong
here, so please correct me if you think so.

tox is not just any package, so maybe it is not stressed out I guess from
the original descriptions.

If no package is allowed to require the old Pythons (and IMHO, "Recommends:"
is "require"),

This is the source of the apparent contradiction. For me, "Recommends" and "Requires" are two different things. "Requires" means that the dependency is required for proper operation. In this case, that would usually mean the library is built for a particular version of Python. "Recommends" means that people usually want to install the packages together. Specifically, "tox" is a tool for testing Python code across multiple Python versions. Without a few different interpreters, it would be useless, but no single interpreter is required for it. And since many people use it to test across various versions, it makes sense to install those by default.


that also applies to tox. If tox is allowed to recommend the
old Pythons, that invalidates the claim that they will never be dragged in
as dependencies.

Sorry for the brevity in that claim. The old Pythons should not being dragged in as deps, *except* for development tools specifically meant for testing on alternate Pythons, where "alternate" almost always means "old".


In an earlier mail:
On 10/10/2016 04:14 PM, Kevin Kofler wrote:
Petr Viktorin wrote:
I would also like to point out that if you have these suffixed Python
versions installed, some build scripts may be accidentally picking up
those instead of the recommended default versions of Python.

Do you mean Fedora build scripts here?

I mean build scripts in upstream tarballs, which can also end up in our
packages (and cause problems when building outside of mock), but which can
also be used directly by people.


Okay, let's go back to the use case here: a developer wants to test on various versions of Python. If that's not the case, they wouldn't install tox, since tox is a tool that only tests code on various versions of Python.

The alternative to packaging those Pythons in Fedora is putting them in some COPR. I believe this would send a bad message. If we want to make Fedora friendly for Python developers, we should make cross-version testing officially supported, and as easy as possible. "Bring your own Python from somewhere" does not give Fedora any advantage over any other OS. But either way, main repos or COPR, if a developer wants to test against multiple Pythons and follows the recommended steps, the old Pythons might get picked up by build scripts. I don't see an alternative that would prevent this.


The alternative to Recommending lots of Python versions from Tox is letting people install them manually. This, again, makes the experience worse – people just want to start testing, and we want them to be able to do that by just installing the testing tool and running it.



--
Petr Viktorin
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux