Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.maint.python > #13944
| Path | csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod |
|---|---|
| From | Gregor Riepl <onitake@gmail.com> |
| Newsgroups | linux.debian.maint.python |
| Subject | Re: Advice wanted: handling weird vendoring situation |
| Date | Sun, 13 Feb 2022 12:10:02 +0100 |
| Message-ID | <DQkVs-1vNG-27@gated-at.bofh.it> (permalink) |
| References | <DOjK9-fzz-1@gated-at.bofh.it> <DOsNr-lBo-5@gated-at.bofh.it> <DP02J-FXm-1@gated-at.bofh.it> <DQ87T-1nFR-3@gated-at.bofh.it> |
| X-Mailbox-Line | From debian-python-request@lists.debian.org Sun Feb 13 11:08:01 2022 |
| Old-Return-Path | <onitake@gmail.com> |
| X-Amavis-Spam-Status | No, score=-7.19 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, LDO_WHITELIST=-5, MURPHY_DRUGS_REL8=0.02, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no |
| X-Policyd-Weight | NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-ej1-x634.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 |
| X-Gm-Message-State | AOAM5328nW4H83qepRGZWZJbzsfnxr+bOTMJUFxifmZym723ioDi4Y6n zfRpC993MCDrkKGpE1K/tQj13BP0A3c= |
| X-Google-SMTP-Source | ABdhPJzw1tsIPJDBTYV3PlNQJJmNf42hHOqkZyMinRGbLrDp2QvYBlBQ8SRyM1+2Lfc1vJk9qLcwBQ== |
| X-Received | by 2002:a17:906:6a93:: with SMTP id p19mr7874196ejr.711.1644750468057; Sun, 13 Feb 2022 03:07:48 -0800 (PST) |
| MIME-Version | 1.0 |
| User-Agent | Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.5.1 |
| Content-Language | en-US |
| Content-Type | text/plain; charset=UTF-8 |
| Content-Transfer-Encoding | 7bit |
| X-Mailing-List | <debian-python@lists.debian.org> archive/latest/19757 |
| List-ID | <debian-python.lists.debian.org> |
| List-URL | <https://lists.debian.org/debian-python/> |
| List-Archive | https://lists.debian.org/msgid-search/68433f29-a5df-a4d5-0ffb-e1d0a61d561f@gmail.com |
| Approved | robomod@news.nic.it |
| Lines | 22 |
| Organization | linux.* mail to news gateway |
| Sender | robomod@news.nic.it |
| X-Original-Cc | debian-python@lists.debian.org |
| X-Original-Date | Sun, 13 Feb 2022 12:07:44 +0100 |
| X-Original-Message-ID | <68433f29-a5df-a4d5-0ffb-e1d0a61d561f@gmail.com> |
| X-Original-References | <YgGOwKenQDWOKGOC@d-and-j.net> <YgIV6US1LavT+KXS@d-and-j.net> <50892c15-3ea6-3f8a-106f-7b223e292325@gmail.com> <YgglyV6ynJ8KjQPv@d-and-j.net> |
| Xref | csiph.com linux.debian.maint.python:13944 |
Show key headers only | View raw
> So the solution I'm currently in the process of trying is to copy the > version from the oldest supported Python version at Debian package > build time. We'll see how this goes.... > >> Perhaps they have a maintenance script for updating the vendored >> dependencies? You could use that to find out how to reverse the changes, >> or start from a clean slate? > > Unlikely; some of their vendored dependencies date back to Python 2.5! In that case, I think this is the issue that must be solved first: Ensuring that their code is compatible with the *latest* published version, and vendoring the system version at build time. Not a good solution, since it will still leave the system vulnerable when one of the dependencies gets a security update, but better than shipping a static version that might have numerous issues and will no longer receive any patches. The alternative would be that they take full responsibility for their vendored code, but then it will be much harder to detect when they're affected by a vulnerability.
Back to linux.debian.maint.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Advice wanted: handling weird vendoring situation Julian Gilbey <julian@d-and-j.net> - 2022-02-07 22:30 +0100
Re: Advice wanted: handling weird vendoring situation Julian Gilbey <julian@d-and-j.net> - 2022-02-08 08:10 +0100
Re: Advice wanted: handling weird vendoring situation Gregor Riepl <onitake@gmail.com> - 2022-02-09 19:40 +0100
Re: Advice wanted: handling weird vendoring situation Julian Gilbey <julian@d-and-j.net> - 2022-02-12 22:30 +0100
Re: Advice wanted: handling weird vendoring situation Gregor Riepl <onitake@gmail.com> - 2022-02-13 12:10 +0100
Re: Advice wanted: handling weird vendoring situation Julian Gilbey <julian@d-and-j.net> - 2022-02-16 17:30 +0100
csiph-web