3 ms·

Are you a Python developer? How do you deal with the Ubuntu versions being different than the PyPI versions?

necovek 7y ago
Are you a Python developer?[1] How do you deal with your project depending on an older version of a package with pip? Basically, it's just like that (but instead of specifying your version in requires.txt/setup.py, you just install a package with a particular version). You've got an older library version that gets automatic security updates but does not break backwards compatibility (or it's a bug in the distro). Ubuntu/Debian packages manage dependencies as well, so for anything you install from the "archive" (distribution's repository), you get compatible dependencies as well, so you can further reduce number of packages you need to pull in with pip. It's a bit of a bother if you've got two sources of dependencies, but if you can get free security updates and no backwards compatibility breakage for 5 years (Ubuntu LTS guarantee for packages in main), it's a small price to pay (though it certainly depends on the use case as well). And luckily, Python + PyPI are _not_ JavaScript + NPM: with Python, you get a large standard library, and as you do not always need the latest and greatest of everything, you will not have hundreds, if not thousands of dependencies that you get with JS+NPM. [1] Your first tongue-in-cheek question is, imho, totally inappropriate. If I misunderstood and it was not meant in a sarcastic way, I apologize for attempting to return the favour. :) Even then, your second question is totally valid and should have been sufficient if you honestly care.
- Godel_unicode 7y ago
  With requirements.txt, pyproject.toml/poetry, or pipenv depending on who the audience is, what conventions already exist in that community, and whether I need non-python dependencies as well. Friends don't let friends use setup.py (except sometimes you need to). The Ubuntu versions of Flask, pymongo, and elastic are all out of date in the 18.04 (LTS) repos. Many are also out of date (although not as much) in all Canonical repos. Flask at least is missing security patches (bad) or the version number is misleading because they silently backported the fix (almost worse) in LTS. I've had backwards compatibility broken repeatedly by upgrading Canonical LTS versions of elastic and also numpy. It's actually happened so often that the set of tests in my CI that test with Ubuntu packages is named "what did they break this time" and can't fail the build. I asked if you're a Python developer as it's my experience that sysadmins often think about this problem from the perspective of "use the repos, one less thing for me to manage" and developers think of it from the perspective of "I need the version of Flask that comes from PyPI, since that's what other devs will/have use(d)". I have very seldom encountered Python developers who use the distro-provided packages, and usually when I have it's because they didn't know about pip/PyPI. I apologise that the ambiguity caused offense, words are hard on computers :partyparrot:

Are you a Python developer?[1] How do you deal with your project depending on an older version of a package with pip? Basically, it's just like that (but instead of specifying your version in requires.txt/setup.py, you just install a package with a particular version). You've got an older library version that gets automatic security updates but does not break backwards compatibility (or it's a bug in the distro). Ubuntu/Debian packages manage dependencies as well, so for anything you install from the "archive" (distribution's repository), you get compatible dependencies as well, so you can further reduce number of packages you need to pull in with pip. It's a bit of a bother if you've got two sources of dependencies, but if you can get free security updates and no backwards compatibility breakage for 5 years (Ubuntu LTS guarantee for packages in main), it's a small price to pay (though it certainly depends on the use case as well). And luckily, Python + PyPI are _not_ JavaScript + NPM: with Python, you get a large standard library, and as you do not always need the latest and greatest of everything, you will not have hundreds, if not thousands of dependencies that you get with JS+NPM. [1] Your first tongue-in-cheek question is, imho, totally inappropriate. If I misunderstood and it was not meant in a sarcastic way, I apologize for attempting to return the favour. :) Even then, your second question is totally valid and should have been sufficient if you honestly care.

Godel_unicode 7y ago
With requirements.txt, pyproject.toml/poetry, or pipenv depending on who the audience is, what conventions already exist in that community, and whether I need non-python dependencies as well. Friends don't let friends use setup.py (except sometimes you need to). The Ubuntu versions of Flask, pymongo, and elastic are all out of date in the 18.04 (LTS) repos. Many are also out of date (although not as much) in all Canonical repos. Flask at least is missing security patches (bad) or the version number is misleading because they silently backported the fix (almost worse) in LTS. I've had backwards compatibility broken repeatedly by upgrading Canonical LTS versions of elastic and also numpy. It's actually happened so often that the set of tests in my CI that test with Ubuntu packages is named "what did they break this time" and can't fail the build. I asked if you're a Python developer as it's my experience that sysadmins often think about this problem from the perspective of "use the repos, one less thing for me to manage" and developers think of it from the perspective of "I need the version of Flask that comes from PyPI, since that's what other devs will/have use(d)". I have very seldom encountered Python developers who use the distro-provided packages, and usually when I have it's because they didn't know about pip/PyPI. I apologise that the ambiguity caused offense, words are hard on computers :partyparrot: