Re: Several questionable packages installed on fresh system

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




Dne 11. 07. 23 v 12:47 Miro Hrončok napsal(a):
On 11. 07. 23 12:39, Miro Hrončok wrote:
On 10. 07. 23 10:38, Vít Ondruch wrote:
Hi,

I have recently installed Fedora Rawhide via netinstall and there are some questionable packages installed by default, such as:

...
libxcrypt-compat
...

and I wonder what is the mechanism, which pulls these in?

$ rpm -q --recommends python-pip-wheel
(libcrypt.so.1 if python3(x86-32))
(libcrypt.so.1()(64bit) if python3(x86-64))

The comment in spec:

# Some manylinux1 wheels need libcrypt.so.1.
# Manylinux1, a common (as of 2019) platform tag for binary wheels, relies
# on a glibc version that included ancient crypto functions, which were
# moved to libxcrypt and then removed in:
# https://fedoraproject.org/wiki/Changes/FullyRemoveDeprecatedAndUnsafeFunctionsFromLibcrypt
# The manylinux1 standard assumed glibc would keep ABI compatibility,
# but that's only the case if libcrypt.so.1 (libxcrypt-compat) is around.
# This should be solved in the next manylinux standard (but it may be
# a long time until manylinux1 is phased out).
# See: https://github.com/pypa/manylinux/issues/305
# Note that manylinux is only applicable to x86 (both 32 and 64 bits)


Interesting.

I am not crypto expert, but it seems fishy to me, that while we had a change to remove some deprecated algorithms, they are pulled in via different means.

Also, not being Python expert, I wonder under what conditions are such "manylinux" packages installed? Is it for some `pip install` scenarios?



I wonder if manylinux1 is still applicable to Python 3.12. Will check.

https://discuss.python.org/t/is-it-safe-to-assume-that-manylinux1-and-python-3-12-will-never-be-combined/29455



In any case, I appreciate you have opened this discussion in the right venue!


Vít

Attachment: OpenPGP_signature
Description: OpenPGP digital signature

_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux