Path: csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod From: Giacomo Catenazzi Newsgroups: linux.debian.maint.python Subject: Re: python3.5 + oldstable dilemma Date: Mon, 01 Mar 2021 15:30:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Mon Mar 1 14:27:02 2021 Old-Return-Path: X-Amavis-Spam-Status: No, score=-6.502 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FOURLA=0.1, KHOP_HELO_FCRDNS=0.399, LDO_WHITELIST=-5, NICE_REPLY_A=-0.001] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -4.6 X-Greylist: delayed 358 seconds by postgrey-1.36 at bendel; Mon, 01 Mar 2021 14:26:50 UTC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.7.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Mailing-List: archive/latest/19026 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/fe557faa-e8a5-783c-3179-2b03f553fb9b@debian.org Approved: robomod@news.nic.it Lines: 34 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Mon, 1 Mar 2021 15:20:50 +0100 X-Original-Message-ID: X-Original-References: Xref: csiph.com linux.debian.maint.python:13242 On 01.03.2021 04:15, Bailey, Josh wrote: > I'm a maintainer for a python based SDN network controller, FAUCET. One > of the platforms we've been supporting to-date is python3.5/oldstable. > > Of course, now, python3.5 is EOL. To some degree we can keep building > our package under python3.5, but now not all of our dependencies (like > pyyaml) build or are even released for 3.5 anymore. That's an issue as > there are security vulnerabilities that are now difficult to address. > > Given that oldstable will be around until 2022, does that mean python3 > as python3.5 will live on in oldstable until then? I can understand the > case for not adding a newer python3 version, but also OTOH addressing > security vulnerabilities over the LTS window will probably only get harder. Probably Debian can support Python 3.5 and some Debian packages until official support of LTS ends, but there is no guarantee. I expect good chances for Python, less for many python packages: the support is always as "best effort" and it depends on availability of people which know the old version code. For some packages it may be too difficult to find a way to correct a bug (e.g. if upstream changed design/architecture to solve the problem). And support quality changes: LTS may prioritize important packages/network server (vulnerabilities) instead of generic packages. Debian checks about new vulnerabilities, but vulnerabilities on old versions may not be reported anymore. So, try to upgrade if you can (upgrading from 3.5 should not be so difficult) and/or try to implement mitigation measures (stricter firewalls, stricter database access, proxy access, run on a special purpose virtual machine, etc.). ciao cate