Open Stack

Hi,

As I've started packaging Wallaby for Debian, I noticed that os-brick
has very inflated version dependencies:

$ diff -u ../requirements.txt requirements.txt
--- ../requirements.txt	2021-03-08 10:54:44.896134101 +0100
+++ requirements.txt	2021-03-08 10:54:48.848127942 +0100
@@ -2,17 +2,16 @@
 # of appearance. Changing the order has an impact on the overall
integration
 # process, which may cause wedges in the gate later.

-pbr!=2.1.0,>=5.4.1 # Apache-2.0
-eventlet>=0.25.1 # MIT
-oslo.concurrency>=3.26.0 # Apache-2.0
-oslo.context>=2.23.0 # Apache-2.0
-oslo.log>=3.44.0 # Apache-2.0
-oslo.i18n>=3.24.0 # Apache-2.0
-oslo.privsep>=1.32.0 # Apache-2.0
-oslo.serialization>=2.29.0 # Apache-2.0
-oslo.service!=1.28.1,>=1.24.0 # Apache-2.0
-oslo.utils>=3.34.0 # Apache-2.0
-requests>=2.14.2 # Apache-2.0
-six>=1.10.0 # MIT
-tenacity>=6.0.0 # Apache-2.0
-os-win>=3.0.0 # Apache-2.0
+pbr>=5.5.1 # Apache-2.0
+eventlet>=0.30.1 # MIT
+oslo.concurrency>=4.4.0 # Apache-2.0
+oslo.context>=3.1.1 # Apache-2.0
+oslo.log>=4.4.0 # Apache-2.0
+oslo.i18n>=5.0.1 # Apache-2.0
+oslo.privsep>=2.4.0 # Apache-2.0
+oslo.serialization>=4.1.0 # Apache-2.0
+oslo.service>=2.5.0 # Apache-2.0
+oslo.utils>=4.8.0 # Apache-2.0
+requests>=2.25.1 # Apache-2.0
+tenacity>=6.3.1 # Apache-2.0
+os-win>=5.4.0 # Apache-2.0

Some of the above is clearly abusing. For example, I don't think Cinder
really needs version 5.5.1 of PBR, and 5.5.0 should really be enough.

I've traced it back to:
https://review.opendev.org/c/openstack/os-brick/+/778807

If this is a consequence of the project stopping to test lower bounds of
requirements, then this has gone really insane, and the bad practice
must stop immediately to restore sanity, and we must revert. We're back
5 years ago where each projects was uselessly requiring the latest
version of everything for no reason... From a downstream package
maintainer perspective, this is a disaster move. Haven't we learned from
our mistakes?

Cheers,

Thomas Goirand (zigo)