Updating Python in Fedora 24
by Tomas Orsava
Hi!
I'm planning to update Python in Fedora 24 from version 3.5.1 to 3.5.2 [0].
It transpired that Python 3.5 made a rather unfortunate change of making
the `os.urandom()` function blocking by default, which is causing
problems during the boot process. [1] This was thankfully reverted in
Python 3.5.2.
After a discussion on #fedora-python, the consensus is to update Python
in F24 rather than backport the specific patches. As a bonus, Python
3.5.2 brings with it a lot of unrelated bugfixes as well [0].
If you have a serious reason against updating Python in F24, speak now
or forever hold your peace.
[0] https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1383060
Yours aye,
Tomas Orsava
7 years, 6 months
- 1
- 0
Re: including EOL and vulnerable software in Fedora
by Zbigniew Jędrzejewski-Szmek
On Fri, Oct 07, 2016 at 06:43:10PM +0200, Dominik 'Rathann' Mierzejewski wrote:
> Dear All,
> I was made aware that EOL software with known security bugs that will
> not be fixed upstream (due to EOL status) was reviewed and accepted into
> Fedora recently. This came on the back of the FPC ticket [1] asking to
> make some changes in the Python Packaging Guidelines. I did go back and
> re-read our current guidelines and found that we don't have any policy
> on that. As a result, I opened a FESCo ticket [2] with the aim of
> establishing a clear policy on how to treat EOL software with known
> security vulnerabilities.
A parallel could be drawn between previous python versions and
previous C standards, like c89, c90, c99, etc. One could say that they
are obsolete, but it is still very convenient to be able to add
CFLAGS=-ansi. The difference is that gcc has this built in, while
python does not have compatibility with previous "standards", so the
only way to test with previous versions is to run those previous
versions. It's damn useful for testing, and it's much more convenient
to do it through dnf install than through
virtualization/containers/cloud/hand-compilation/copr/other-nonstandard-things.
So from my side, a vote for
1. labelling old pythons very clearly as such,
2. allowing people to install them using dnf.
Zbyszek
7 years, 6 months
- 1
- 0