[gentoo-dev] Last rites: =app-doc/python-docs-3.8*, =dev-lang/python-3.8*

[gentoo-dev] Last rites: =app-doc/python-docs-3.8*, =dev-lang/python-3.8*

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 253 bytes --]

# Michał Górny <mgorny@gentoo.org> (2025-06-03)
# Vulnerable EOL version of CPython.  Security backports require
# too much effort.  Removal on 2025-07-03.
=app-doc/python-docs-3.8*
=dev-lang/python-3.8*

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 512 bytes --]

Re: [gentoo-dev] Last rites: =app-doc/python-docs-3.8*, =dev-lang/python-3.8*

[Eli Schwartz]

[-- Attachment #1.1: Type: text/plain, Size: 919 bytes --]

On 6/3/25 1:24 PM, Michał Górny wrote:
> # Michał Górny <mgorny@gentoo.org> (2025-06-03)
> # Vulnerable EOL version of CPython.  Security backports require
> # too much effort.  Removal on 2025-07-03.
> =app-doc/python-docs-3.8*
> =dev-lang/python-3.8*


IMO it's quite interesting to have old pythons available for reasons not
related to running a stable system with them. It's not a valid eclass
target, even. Anyone going out of their way to build and run it knows
what they are getting into. I've used it myself for research purposes
and found it very helpful to have old baselines, and the alternatives
aren't pretty -- either pyenv or Ubuntu+deadsnakes.

If we just need to make absolutely sure no one uses it by accident, I'd
rather do what we do for sys-libs/glibc and sys-devel/gcc and have a
permanent mask without planned removal, at least for the interpreter.


-- 
Eli Schwartz

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]

Re: [gentoo-dev] Last rites: =app-doc/python-docs-3.8*, =dev-lang/python-3.8*

[Jay Faulkner]

On 6/3/25 7:53 PM, Eli Schwartz wrote:
> On 6/3/25 1:24 PM, Michał Górny wrote:
>> # Michał Górny <mgorny@gentoo.org> (2025-06-03)
>> # Vulnerable EOL version of CPython.  Security backports require
>> # too much effort.  Removal on 2025-07-03.
>> =app-doc/python-docs-3.8*
>> =dev-lang/python-3.8*
>
> IMO it's quite interesting to have old pythons available for reasons not
> related to running a stable system with them. It's not a valid eclass
> target, even. Anyone going out of their way to build and run it knows
> what they are getting into. I've used it myself for research purposes
> and found it very helpful to have old baselines, and the alternatives
> aren't pretty -- either pyenv or Ubuntu+deadsnakes.

While I generally agree with the usefulness of this as a python 
developer running gentoo, traditionally I've fetched and overlayed old 
ebuilds when needed. Maybe we should just have a old-pythons unofficial 
overlay for folks like us?


-JayF

Re: [gentoo-dev] Last rites: =app-doc/python-docs-3.8*, =dev-lang/python-3.8*

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1201 bytes --]

On Tue, 2025-06-03 at 22:53 -0400, Eli Schwartz wrote:
> On 6/3/25 1:24 PM, Michał Górny wrote:
> > # Michał Górny <mgorny@gentoo.org> (2025-06-03)
> > # Vulnerable EOL version of CPython.  Security backports require
> > # too much effort.  Removal on 2025-07-03.
> > =app-doc/python-docs-3.8*
> > =dev-lang/python-3.8*
> 
> 
> IMO it's quite interesting to have old pythons available for reasons not
> related to running a stable system with them. It's not a valid eclass
> target, even. Anyone going out of their way to build and run it knows
> what they are getting into. I've used it myself for research purposes
> and found it very helpful to have old baselines, and the alternatives
> aren't pretty -- either pyenv or Ubuntu+deadsnakes.
> 
> If we just need to make absolutely sure no one uses it by accident, I'd
> rather do what we do for sys-libs/glibc and sys-devel/gcc and have a
> permanent mask without planned removal, at least for the interpreter.
> 

Well, I don't mind keeping them forever masked.  Though I would really
preferred if someone backported the security patches from 3.9 to keep
this working properly.

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 512 bytes --]

Re: [gentoo-dev] Last rites: =app-doc/python-docs-3.8*, =dev-lang/python-3.8*

[Ionen Wolkens]

[-- Attachment #1: Type: text/plain, Size: 1533 bytes --]

On Wed, Jun 04, 2025 at 06:28:42AM -0700, Jay Faulkner wrote:
> 
> On 6/3/25 7:53 PM, Eli Schwartz wrote:
> > On 6/3/25 1:24 PM, Michał Górny wrote:
> >> # Michał Górny <mgorny@gentoo.org> (2025-06-03)
> >> # Vulnerable EOL version of CPython.  Security backports require
> >> # too much effort.  Removal on 2025-07-03.
> >> =app-doc/python-docs-3.8*
> >> =dev-lang/python-3.8*
> >
> > IMO it's quite interesting to have old pythons available for reasons not
> > related to running a stable system with them. It's not a valid eclass
> > target, even. Anyone going out of their way to build and run it knows
> > what they are getting into. I've used it myself for research purposes
> > and found it very helpful to have old baselines, and the alternatives
> > aren't pretty -- either pyenv or Ubuntu+deadsnakes.
> 
> While I generally agree with the usefulness of this as a python 
> developer running gentoo, traditionally I've fetched and overlayed old 
> ebuilds when needed. Maybe we should just have a old-pythons unofficial 
> overlay for folks like us?

If someone wants to maintain it, sure.. but just lazy ebuild copies
without maintenance will just end up broken sooner or later. These kind
of "I want to keep old versions" overlays often end up becoming stinky.

If we opt to keep the in-tree (even masked) it also means someone needs
to keep these in working condition and it adds to the workload -- albeit
being able to ignore security issues w/ mask would simplify things.
-- 
ionen

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]