Bug 171681 - Zope + Python 2.4= UNSUPPORTED
Zope + Python 2.4= UNSUPPORTED
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: zope (Show other bugs)
4
All Linux
medium Severity medium
: ---
: ---
Assigned To: Aurelien Bompard
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-10-25 04:02 EDT by Andreas Jung
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-10-25 09:52:35 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Andreas Jung 2005-10-25 04:02:27 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b5) Gecko/20051006 Firefox/1.4.1

Description of problem:
The Zope RPMs use Python 2.4.X.

Python 2.4.X was never an approved Python to be used with Zope 2.8.X.

Multiple Zope documentation including doc/INSTALL.txt states *CLEARLY*
that Python 2.3.5 is the only supported Python version but *not* Python 2.4.

There are some known reasons and security issues with using Python 2.4 and Zope 2.8.X.

Python 2.4 will be supported with Zope 2.9 but not for Zope 2.8

If you install Zope 2.8 with Python 2.4 you install *UNSUPPORTED* software version with some *SECURITY* risk and the risk of software malfunction!!!!

As Zope 2 release manager it is annoying that the package maintainers obviously don't read or can not read existing documentation. It is annoying getting
help requests from people installing and running such lousy packages.

Please do your homework. We (the Zope 2 developers) did our homework.




Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1.
2.
3.
  

Additional info:
Comment 1 Aurelien Bompard 2005-10-25 04:26:54 EDT
No need to be aggressive.

There is no python 2.3 for Fedora Core 4. Zope just uses the same python as the
rest of the system.

I am not maintaining a whole separate version of python just for Zope (well, not
alone, so if somebody wants to do that, fine).
Comment 2 Andreas Jung 2005-10-25 04:40:26 EDT
If you don't want to maintain Zope 2.8 with Python 2.3.5 then you should better
remove any related zope package from FC.

You have to document and inform the end-user that the package uses an
unsupported software combination that is possibly valuable to security problems
otherwise I can only consider such a behavior as irresponsible.

I consider this packaging policy as totally counterproductive for Zope and its
community. We have to deal all day long with requests from people installing
such packages. It is annonying for the people asking and it is annoying for the
people trying to help since you are wasting their time.

If you can't get your packages right in the future I consider adding code to
Zope 2 to avoid running with any unsupported Python version....your choice...
Comment 3 Aurelien Bompard 2005-10-25 05:04:45 EDT
Removing the Zope package from FC4 will not make a python 2.3 package appear out
of thin air. Since the Zope project does not ship binary Zope package with
included python as it used to, there is no way to run Zope on FC4 on a supported
version of python, with or without the rpm.
The package is not the problem here, you would have the exact same problem with
people installing the Zope tarball from zope.org on an FC4 system.

I'll add a warning about the fact that python 2.4 is unsupported with Zope 2.8,
and that people using the package should not file bug reports.

Again, I did not willingly make Zope run on python 2.4. It is just the version
of python that the rest of the distribution uses.

> If you can't get your packages right in the future I consider adding code to
> Zope 2 to avoid running with any unsupported Python version....your choice...

Is that a theat ? This is getting ridiculous, please calm down.
Comment 4 Andreas Jung 2005-10-25 05:21:05 EDT
(In reply to comment #3)
> 
> I'll add a warning about the fact that python 2.4 is unsupported with Zope 2.8,
> and that people using the package should not file bug reports.
> 
> Again, I did not willingly make Zope run on python 2.4. It is just the version
> of python that the rest of the distribution uses.

The configure script explictely tells you that Python 2.4 is not a supported 
Python version. If you ignore such a warning I can not take you serious as
package maintainer.

> 
> > If you can't get your packages right in the future I consider adding code to
> > Zope 2 to avoid running with any unsupported Python version....your choice...
> 
> Is that a theat ? This is getting ridiculous, please calm down.

No, this is just a solution to prevent people from running unsupported software
with possibly security related issues. In case of a security related issue this
falls back to the Zope community and to me as release manager. Since I am in
charge for Zope 2 it is my intent that people run an approved, reliable and
securee software. What you are packaging or shipping  is unapproved. As I said
earlier: either consider the software recommendations or don't ship Zope with FC
or document this issue clear enough. There is nothing about a thread - this just
my legitamte fight against unproper packaging. 


Comment 5 Aurelien Bompard 2005-10-25 05:30:56 EDT
OK, I understand your point, and I totally agree that it would be a lot better
if Zope could run on python 2.3 on FC4. Except, it is not possible at the
moment, with or witout a Zope RPM.
Let's say I never packaged Zope for FC4. People downloading the Zope tarball on
zope.org and installing on FC4 will *have* to run it on python 2.4, since there
is  no other version of python for this distribution.
The only difference is that they would get a warning, and I will add that
warning to the RPM.
What else could I do ?
Comment 6 Andreas Jung 2005-10-25 05:38:16 EDT
As I stated earler: when you run "configure" of Zope it does definitely complain
about the Python version. It says "No suitable Python vesion found. You should
install python version 2.3.5 before continuing". The configure script contains a
list of optimal and acceptable Python versions but Python 2.4.X is not part of
the configuration - for good reasons as explained. So the end-user running Zope
with Python2.4 must explictly override the configuration --with-python. All Zope
2.8 annocunements on the web page, mailinglists and the doc/INSTALL.txt say:
don't use Python 2.4, it's not supported...so I assume that the user should be
informed enough...the documentation also explains the reasons why not to use
Python 2.4.
If a user installs a binary package as the FC4 RPMs he does not get this
information...so the user can not be aware of any risk.

Comment 7 Aurelien Bompard 2005-10-25 06:18:04 EDT
OK, I'll add the warning. I'll add it in the RPM's description, and on the
default index_html too.
Does this sound OK to you ? Any other idea ?
Comment 8 Michael Schwendt 2005-10-25 09:05:19 EDT
Not to pour gasoline into a smouldering fire, but...

> some *SECURITY* risk and the risk of software malfunction!!!!

> We have to deal all day long with requests from people installing
> such packages. It is annonying for the people asking and it is
> annoying for the people trying to help since you are wasting their time.

...please be so kind and link any known incidents where the official
Fedora Extras packages of Zope in combination with the official
Python packages of Fedora Core have caused problems, which resulted
in users seeking for help via your project resources. Thank you.
Comment 9 Aurelien Bompard 2005-10-25 09:52:35 EDT
Warning added in release 2
Comment 10 Andreas Jung 2005-10-25 12:23:00 EDT
Thanks, this sounds like a good idea.
Comment 11 Aurelien Bompard 2005-10-25 13:03:27 EDT
I've added a message in red and in bold on the default page (zope-quickstart),
warning the user that they run an unsupported combination of zope and python,
and that they should not file bugreports or ask for support on zope.org.
Thanks for pointing this out.
Comment 12 Kevin Kofler 2005-10-27 19:11:12 EDT
> If you can't get your packages right in the future I consider adding code to
> Zope 2 to avoid running with any unsupported Python version....your choice...

IMHO, all this would most likely lead to is your code getting patched out as 
was done with the KDE anti-GCC-4.0.0 check. (In the KDE case, the GCC bug they 
were trying to protect users from was fixed in Fedora with an extra patch 
though, so the situation's a bit different.)
Comment 13 Aurelien Bompard 2005-10-28 02:21:02 EDT
This bug has been resolved in the best way we could think of, *please* don't
bring up a useless discussion about who's got the more power.
Comment 14 Gianluca Cecchi 2006-03-10 18:19:10 EST
Hi Aurelien.
As I'm starting with Zope+Plone in upcoming FC5, I installed them from Fedora
Extras repository (zope-2.8.5-1.fc5 and plone-2.1.2-1.fc5) and after starting
zope I suddenly arrived here ;-)
I noticed that:
- python version in FC5 is going to be 2.4.2-3.2.1
- On 24.02.2006 Zope 2.9.1 was released with these notes:
"Support Python versions:
Zope 2.9 requires Python 2.4.2 (Python 2.4.1 is still acceptable). 
Older Python versions are no longer supported."
See http://www.zope.org/Products/Zope/2.9.1/Zope-2_9_1-released

So the problem seems to automagically near to be solved... 
I would like to contribute with initial packaging, but perhaps you could be at
release date. Let me know if I can help: I'm going to do some tests this week end.
Thanks for your attention.
Gianluca
Comment 15 Aurelien Bompard 2006-03-11 12:05:23 EST
Replying off-bugzilla, no need to bother Andreas with this.

Note You need to log in before you can comment on or make changes to this bug.