4 ms·

A package with no active developer gets removed unless someone takes up the role of maintaining it. Since python software foundation will stop developing it th

by belorn 7y ago

A package with no active developer gets removed unless someone takes up the role of maintaining it. Since python software foundation will stop developing it there is no upstream support after 2020. In theory a new upstream for python 2 could pop up, and there is speculation that Redhat might do it, but Debian do not want to become the new upstream for python 2. If they included python 2 in next release they would have to support it for as long as next release get support. What will happen instead is that they will keep supporting python 2 in older releases but when those support periods are over then its over.

wyldfire 7y ago
> there is speculation that Redhat might do it If they're going to do it, for the sake of the community they should announce that soon. Even if they don't plan on taking up the responsibility until the middle or end of 2020 it might be something that distros and companies would consider when making their plans.
- diminoten 7y ago
  They did and they have. I won't link to it because I strongly disagree with their decision to do so, but if you care about this you can find it.
mjw1007 7y ago
The normal thing in Debian is for a maintainer who wants to step down to orphan the package so that other maintainers get the chance to pick it up. It seems perfectly reasonable for the Debian Python team to decide they no longer want Python 2 getting in their way. But I think they should have done more to check whether someone else wants to take over. There's nothing terribly wrong with packaging mature software that doesn't have an active upstream. Realistically nobody cares about any remaining bugs in Python 2 being fixed; the work involved would basically be making sure it still compiles with newer versions of GCC.
- Beltiras 7y ago
  There are 5 CVEs for 2.7 so far in 2019 [1]. [1]: https://www.cvedetails.com/vulnerability-list/vendor_id-10210/product_id-18230/version_id-92056/year-2019/Python-Python-2.7.html https://www.cvedetails.com/vulnerability-list/vendor_id-1021...
  - mjw1007 7y ago
    Yes, I think whoever ends up taking over Python 2 maintenance would be well advised to stub out the https support immediately, and maybe a bit later do the same for all support for network requests. In particular, you don't want to have to worry about building against openssl. I think the vast majority of cases where people have a good reason to carry on using Python 2 won't need that.
peterwwillis 7y ago
Is there any evidence that people are regularly checking whether software has been abandoned, and those packages removed? It seems more plausible to me that this was an excuse to replace the default 'python' with Python 3.

by belorn 7y ago

wyldfire 7y ago

> there is speculation that Redhat might do it If they're going to do it, for the sake of the community they should announce that soon. Even if they don't plan on taking up the responsibility until the middle or end of 2020 it might be something that distros and companies would consider when making their plans.

diminoten 7y ago
They did and they have. I won't link to it because I strongly disagree with their decision to do so, but if you care about this you can find it.

mjw1007 7y ago

The normal thing in Debian is for a maintainer who wants to step down to orphan the package so that other maintainers get the chance to pick it up. It seems perfectly reasonable for the Debian Python team to decide they no longer want Python 2 getting in their way. But I think they should have done more to check whether someone else wants to take over. There's nothing terribly wrong with packaging mature software that doesn't have an active upstream. Realistically nobody cares about any remaining bugs in Python 2 being fixed; the work involved would basically be making sure it still compiles with newer versions of GCC.

Beltiras 7y ago
There are 5 CVEs for 2.7 so far in 2019 [1]. [1]: https://www.cvedetails.com/vulnerability-list/vendor_id-10210/product_id-18230/version_id-92056/year-2019/Python-Python-2.7.html https://www.cvedetails.com/vulnerability-list/vendor_id-1021...
- mjw1007 7y ago
  Yes, I think whoever ends up taking over Python 2 maintenance would be well advised to stub out the https support immediately, and maybe a bit later do the same for all support for network requests. In particular, you don't want to have to worry about building against openssl. I think the vast majority of cases where people have a good reason to carry on using Python 2 won't need that.

peterwwillis 7y ago

Is there any evidence that people are regularly checking whether software has been abandoned, and those packages removed? It seems more plausible to me that this was an excuse to replace the default 'python' with Python 3.