Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #13239 > unrolled thread

python3.5 + oldstable dilemma

Back to article view | Back to linux.debian.maint.python

Contents

  python3.5 + oldstable dilemma "Bailey, Josh" <josh@vandervecken.com> - 2021-03-01 04:20 +0100
    Re: python3.5 + oldstable dilemma Jeremy Stanley <fungi@yuggoth.org> - 2021-03-01 14:20 +0100
    Re: python3.5 + oldstable dilemma Giacomo Catenazzi <cate@debian.org> - 2021-03-01 15:30 +0100

#13239 — python3.5 + oldstable dilemma

[Multipart message — attachments visible in raw view] — view raw

Hi all,

I'm a maintainer for a python based SDN network controller, FAUCET. One of
the platforms we've been supporting to-date is python3.5/oldstable.

Of course, now, python3.5 is EOL. To some degree we can keep building our
package under python3.5, but now not all of our dependencies (like pyyaml)
build or are even released for 3.5 anymore. That's an issue as there are
security vulnerabilities that are now difficult to address.

Given that oldstable will be around until 2022, does that mean python3 as
python3.5 will live on in oldstable until then? I can understand the case
for not adding a newer python3 version, but also OTOH addressing security
vulnerabilities over the LTS window will probably only get harder.

Any advice appreciated,

[toc] | [next] | [standalone]

#13241

[Multipart message — attachments visible in raw view] — view raw

On 2021-03-01 16:15:38 +1300 (+1300), Bailey, Josh wrote:
> I'm a maintainer for a python based SDN network controller, FAUCET. One of
> the platforms we've been supporting to-date is python3.5/oldstable.
> 
> Of course, now, python3.5 is EOL. To some degree we can keep building our
> package under python3.5, but now not all of our dependencies (like pyyaml)
> build or are even released for 3.5 anymore. That's an issue as there are
> security vulnerabilities that are now difficult to address.
> 
> Given that oldstable will be around until 2022, does that mean python3 as
> python3.5 will live on in oldstable until then? I can understand the case
> for not adding a newer python3 version, but also OTOH addressing security
> vulnerabilities over the LTS window will probably only get harder.
> 
> Any advice appreciated,

If you're going to use the python3 packaged in oldstable, then can't
you use the libraries (e.g. python3-yaml) packaged in oldstable as
well and take advantage of whatever security fixes are backported by
the package maintainers/security team?
-- 
Jeremy Stanley

[toc] | [prev] | [next] | [standalone]

#13242

On 01.03.2021 04:15, Bailey, Josh wrote:
> I'm a maintainer for a python based SDN network controller, FAUCET. One 
> of the platforms we've been supporting to-date is python3.5/oldstable.
> 
> Of course, now, python3.5 is EOL. To some degree we can keep building 
> our package under python3.5, but now not all of our dependencies (like 
> pyyaml) build or are even released for 3.5 anymore. That's an issue as 
> there are security vulnerabilities that are now difficult to address.
> 
> Given that oldstable will be around until 2022, does that mean python3 
> as python3.5 will live on in oldstable until then? I can understand the 
> case for not adding a newer python3 version, but also OTOH addressing 
> security vulnerabilities over the LTS window will probably only get harder.

Probably Debian can support Python 3.5 and some Debian packages until 
official support of LTS ends, but there is no guarantee. I expect good 
chances for Python, less for many python packages: the support is always 
as "best effort" and it depends on availability of people which know the 
old version code. For some packages it may be too difficult to find a 
way to correct a bug (e.g. if upstream changed design/architecture to 
solve the problem). And support quality changes: LTS may prioritize 
important packages/network server (vulnerabilities) instead of generic 
packages.

Debian checks about new vulnerabilities, but vulnerabilities on old 
versions may not be reported anymore.

So, try to upgrade if you can (upgrading from 3.5 should not be so 
difficult) and/or try to implement mitigation measures (stricter 
firewalls, stricter database access, proxy access, run on a special 
purpose virtual machine, etc.).

ciao
     cate

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.maint.python

csiph-web