[openstack-dev] Requests + urllib3 + distro packages

Thomas Goirand zigo at debian.org
Wed Oct 14 22:23:20 UTC 2015

On 10/13/2015 09:41 AM, Cory Benfield wrote:
>> On 13 Oct 2015, at 07:42, Thomas Goirand <zigo at debian.org> wrote:
>> In this particular case (ie: a difficult upstream which makes it
>> impossible to have the same result with pip and system packages)
> I don’t know how carefully you’ve followed this email trail

I did read carefully.

> but the “difficult upstream”

I do understand that you don't like being called this way, though this
is still the reality. Vendorizing still inflicting some major pain to a
lot of your users:
- This thread one of the demonstration of it.
- You having to contact downstream distros is another.
- The unbundling work inflicted to downstream package maintainers is a
3rd another.

So like it or not, it is a fact that it is difficult to work with
requests because of the way it is released upstream.

> has had a policy in place for six months
> that ensures that you can have the same result with pip and
> system packages. For six months we have only updated to versions
> of urllib3 that are actually released, and therefore that are
> definitely available from pip (and potentially available from
> the distribution).
> The reason this has not been working is because the distributions,
> when they unbundle us, have not been populating their setup.py to
> reflect the dependency: only their own metadata. We’ve been in
> contact with them, and this change is being made in the
> distributions we have relationships with.

Though you could have avoid all of this pain if you were not bundling.
Isn't all of this make you re-think your vendorizing policy? Or still
not? I'm asking because I still didn't read your answer about the
important question: since you aren't using specially crafted versions of
urllib3 anymore, and now only using official releases, what's the reason
that keeps you vendorizing? Not trying to convince you here, just trying
to understand.


Thomas Goirand (zigo)

More information about the OpenStack-dev mailing list