Dne 11. 07. 23 v 12:47 Miro Hrončok napsal(a):
On 11. 07. 23 12:39, Miro Hrončok wrote:On 10. 07. 23 10:38, Vít Ondruch wrote:Hi,I have recently installed Fedora Rawhide via netinstall and there are some questionable packages installed by default, such as:... libxcrypt-compat ... and I wonder what is the mechanism, which pulls these in?$ rpm -q --recommends python-pip-wheel (libcrypt.so.1 if python3(x86-32)) (libcrypt.so.1()(64bit) if python3(x86-64)) The comment in spec: # Some manylinux1 wheels need libcrypt.so.1.# Manylinux1, a common (as of 2019) platform tag for binary wheels, relies# on a glibc version that included ancient crypto functions, which were # moved to libxcrypt and then removed in:# https://fedoraproject.org/wiki/Changes/FullyRemoveDeprecatedAndUnsafeFunctionsFromLibcrypt# The manylinux1 standard assumed glibc would keep ABI compatibility,# but that's only the case if libcrypt.so.1 (libxcrypt-compat) is around.# This should be solved in the next manylinux standard (but it may be # a long time until manylinux1 is phased out). # See: https://github.com/pypa/manylinux/issues/305 # Note that manylinux is only applicable to x86 (both 32 and 64 bits)
Interesting.I am not crypto expert, but it seems fishy to me, that while we had a change to remove some deprecated algorithms, they are pulled in via different means.
Also, not being Python expert, I wonder under what conditions are such "manylinux" packages installed? Is it for some `pip install` scenarios?
I wonder if manylinux1 is still applicable to Python 3.12. Will check.https://discuss.python.org/t/is-it-safe-to-assume-that-manylinux1-and-python-3-12-will-never-be-combined/29455
In any case, I appreciate you have opened this discussion in the right venue!
Vít
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature
_______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
