Groups > linux.debian.maint.python > #13242

Re: python3.5 + oldstable dilemma

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Giacomo Catenazzi <cate@debian.org>
Newsgroups	linux.debian.maint.python
Subject	Re: python3.5 + oldstable dilemma
Date	Mon, 01 Mar 2021 15:30:01 +0100
Message-ID	<BNRIB-7Tq-11@gated-at.bofh.it> (permalink)
References	<BNHge-1AW-5@gated-at.bofh.it>
X-Mailbox-Line	From debian-python-request@lists.debian.org Mon Mar 1 14:27:02 2021
Old-Return-Path	<cate@debian.org>
X-Amavis-Spam-Status	No, score=-6.502 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FOURLA=0.1, KHOP_HELO_FCRDNS=0.399, LDO_WHITELIST=-5, NICE_REPLY_A=-0.001] autolearn=ham autolearn_force=no
X-Policyd-Weight	using cached result; rate: -4.6
X-Greylist	delayed 358 seconds by postgrey-1.36 at bendel; Mon, 01 Mar 2021 14:26:50 UTC
User-Agent	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.7.1
MIME-Version	1.0
Content-Type	text/plain; charset=utf-8; format=flowed
Content-Language	en-US
Content-Transfer-Encoding	8bit
X-Mailing-List	<debian-python@lists.debian.org> archive/latest/19026
List-ID	<debian-python.lists.debian.org>
List-URL	<https://lists.debian.org/debian-python/>
List-Archive	https://lists.debian.org/msgid-search/fe557faa-e8a5-783c-3179-2b03f553fb9b@debian.org
Approved	robomod@news.nic.it
Lines	34
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Mon, 1 Mar 2021 15:20:50 +0100
X-Original-Message-ID	<fe557faa-e8a5-783c-3179-2b03f553fb9b@debian.org>
X-Original-References	<CAAFBucA6-0Lu3C-h92u+X6Ggr1aRHKRFV0w4qts-XHbX99qFRA@mail.gmail.com>
Xref	csiph.com linux.debian.maint.python:13242

Show key headers only | View raw

On 01.03.2021 04:15, Bailey, Josh wrote:
> I'm a maintainer for a python based SDN network controller, FAUCET. One 
> of the platforms we've been supporting to-date is python3.5/oldstable.
> 
> Of course, now, python3.5 is EOL. To some degree we can keep building 
> our package under python3.5, but now not all of our dependencies (like 
> pyyaml) build or are even released for 3.5 anymore. That's an issue as 
> there are security vulnerabilities that are now difficult to address.
> 
> Given that oldstable will be around until 2022, does that mean python3 
> as python3.5 will live on in oldstable until then? I can understand the 
> case for not adding a newer python3 version, but also OTOH addressing 
> security vulnerabilities over the LTS window will probably only get harder.

Probably Debian can support Python 3.5 and some Debian packages until 
official support of LTS ends, but there is no guarantee. I expect good 
chances for Python, less for many python packages: the support is always 
as "best effort" and it depends on availability of people which know the 
old version code. For some packages it may be too difficult to find a 
way to correct a bug (e.g. if upstream changed design/architecture to 
solve the problem). And support quality changes: LTS may prioritize 
important packages/network server (vulnerabilities) instead of generic 
packages.

Debian checks about new vulnerabilities, but vulnerabilities on old 
versions may not be reported anymore.

So, try to upgrade if you can (upgrading from 3.5 should not be so 
difficult) and/or try to implement mitigation measures (stricter 
firewalls, stricter database access, proxy access, run on a special 
purpose virtual machine, etc.).

ciao
     cate

Back to linux.debian.maint.python | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

python3.5 + oldstable dilemma "Bailey, Josh" <josh@vandervecken.com> - 2021-03-01 04:20 +0100
  Re: python3.5 + oldstable dilemma Jeremy Stanley <fungi@yuggoth.org> - 2021-03-01 14:20 +0100
  Re: python3.5 + oldstable dilemma Giacomo Catenazzi <cate@debian.org> - 2021-03-01 15:30 +0100

csiph-web