3 ms·

What is a “major version bump”? Before you answer, consider that the library doesn’t use semantic versioning. Before this all blew up, the versioning scheme was

What is a “major version bump”? Before you answer, consider that the library doesn’t use semantic versioning. Before this all blew up, the versioning scheme was this[1]: > Given a version cryptography X.Y.Z, > - X.Y is a decimal number that is incremented for potentially-backwards-incompatible releases. > - - This increases like a standard decimal. In other words, 0.9 is the ninth release, and 1.0 is the tenth (not 0.10). The dividing decimal point can effectively be ignored. > - Z is an integer that is incremented for backward-compatible releases. The system has since changed, but it continues not to be semantic versioning. (It’s effectively the same, in fact, but protects against dependents who think it is semantic.) By that scheme, it was already a “major” (signifying potential backwards-incompatibility) release. [1]: https://cryptography.io/en/latest/api-stability.html#previous-scheme https://cryptography.io/en/latest/api-stability.html#previou...

AaronFriel 6y ago
This reads to me like an argument for semantic versioning, because otherwise I need to internalize the rules of every package and know that some will break compatibility on the Y, some on the Z, ... Etc.
- chrisoverzero 6y ago
  You know, I had that thought while writing it. I wouldn’t want to force any particular versioning scheme on any particular developer, but maybe the “SemVer façade” versioning scheme they switched to is the best compromise. It has defensive value, at least. Then again, PEP 440 has nothing to say about the semantics of versioning, only requiring: [N!]N(.N)*[{a|b|rc}N][.postN][.devN] PyPA themselves describe various expected versioning schemes, but listing Semantic as preferred[1]. If I squint, I can fit `cryptography`’s previous scheme into “Hybrid”. The biggest lesson I take from this is that if your version scheme isn’t SemVer, work hard to make it look obviously different from SemVer. [1]: https://packaging.python.org/guides/distributing-packages-using-setuptools/#choosing-a-versioning-scheme https://packaging.python.org/guides/distributing-packages-us...
  - detaro 6y ago
    Would SemVer even strictly require a jump here? They didn't change what's usually thought of as the API of the library (i.e. if I don't compile it myself I don't really notice the change?), and that's what SemVer uses: "MAJOR version when they make incompatible API changes,"
    - chrisoverzero 6y ago
      Also a great point! I can’t think of a clean alternative other than coming full-circle back to the “developer advocacy” solution, with its clear problems. Someone smarter than I am probably has it in the palm of their hand, though.
    - AaronFriel 6y ago
      Yes, see https://news.ycombinator.com/item?id=26298805 https://news.ycombinator.com/item?id=26298805
      - detaro 6y ago
        On the other hand, from what I understand they do ship precompiled wheels for many platforms, just missed one lots of people use in their CI setups (Alpine, which uses musl and thus isn't compatible with other Linux wheels - personally I think that's an odd choice but whatever, people do it)? Easy to imagine that many more people compiled it than they expected.
- M2Ys4U 6y ago
  Even SemVer doesn't help here, as changing the build toolchain isn't generally considered an API breakage (after all, the resulting binaries are API compatible)
  - AaronFriel 6y ago
    Changing the build toolchain/requirements in such a significant way does seem like a major version break, as it could break downstream consumers attempting to install the package. Because the build toolchain is "visible", that is, pip isn't just downloading a prebuilt binary every time, I think breaking changes that could cause CI systems or user installs to fail is part of the API contract. Think of what major distributions or software packages do when they want to deprecate support for certain platforms - those are major bumps that typically only occur on incrementing the most significant component of the version. Hypothetical: suppose the the authors changed setup.py so that it only built on Red Hat Enterprise Linux(tm) version 6. Again, they could do that, it wouldn't change the runtime API. And on all other distributions or installers, it would error. Would that be a major semver change? Of course it would be. The API contract has to include everything from packaging to use.

AaronFriel 6y ago

This reads to me like an argument for semantic versioning, because otherwise I need to internalize the rules of every package and know that some will break compatibility on the Y, some on the Z, ... Etc.

chrisoverzero 6y ago
You know, I had that thought while writing it. I wouldn’t want to force any particular versioning scheme on any particular developer, but maybe the “SemVer façade” versioning scheme they switched to is the best compromise. It has defensive value, at least. Then again, PEP 440 has nothing to say about the semantics of versioning, only requiring: [N!]N(.N)*[{a|b|rc}N][.postN][.devN] PyPA themselves describe various expected versioning schemes, but listing Semantic as preferred[1]. If I squint, I can fit `cryptography`’s previous scheme into “Hybrid”. The biggest lesson I take from this is that if your version scheme isn’t SemVer, work hard to make it look obviously different from SemVer. [1]: https://packaging.python.org/guides/distributing-packages-using-setuptools/#choosing-a-versioning-scheme https://packaging.python.org/guides/distributing-packages-us...
- detaro 6y ago
  Would SemVer even strictly require a jump here? They didn't change what's usually thought of as the API of the library (i.e. if I don't compile it myself I don't really notice the change?), and that's what SemVer uses: "MAJOR version when they make incompatible API changes,"
  - chrisoverzero 6y ago
    Also a great point! I can’t think of a clean alternative other than coming full-circle back to the “developer advocacy” solution, with its clear problems. Someone smarter than I am probably has it in the palm of their hand, though.
  - AaronFriel 6y ago
    Yes, see https://news.ycombinator.com/item?id=26298805 https://news.ycombinator.com/item?id=26298805
    - detaro 6y ago
      On the other hand, from what I understand they do ship precompiled wheels for many platforms, just missed one lots of people use in their CI setups (Alpine, which uses musl and thus isn't compatible with other Linux wheels - personally I think that's an odd choice but whatever, people do it)? Easy to imagine that many more people compiled it than they expected.
M2Ys4U 6y ago
Even SemVer doesn't help here, as changing the build toolchain isn't generally considered an API breakage (after all, the resulting binaries are API compatible)
- AaronFriel 6y ago
  Changing the build toolchain/requirements in such a significant way does seem like a major version break, as it could break downstream consumers attempting to install the package. Because the build toolchain is "visible", that is, pip isn't just downloading a prebuilt binary every time, I think breaking changes that could cause CI systems or user installs to fail is part of the API contract. Think of what major distributions or software packages do when they want to deprecate support for certain platforms - those are major bumps that typically only occur on incrementing the most significant component of the version. Hypothetical: suppose the the authors changed setup.py so that it only built on Red Hat Enterprise Linux(tm) version 6. Again, they could do that, it wouldn't change the runtime API. And on all other distributions or installers, it would error. Would that be a major semver change? Of course it would be. The API contract has to include everything from packaging to use.