Open Stack

See the discussion @ https://review.openstack.org/#/c/70750/

I think this is not an acceptable change for the stable branch. We
promise a "safe source of fixes", which means seamless upgrades that do
not require extra actions for followers of the stable branch. IMHO
replacing a library dependency by another library requires extra actions
to be taken on the deployer side (making sure you have the new
dependency packaged / present), so it's out of line.

Now I hear the pressure from the distributions which have already ripped
out oauth2 -- the change is indeed harmless and desirable for them. But
I still think we'd break our promise for a safe source of fixes to every
user of the stablebranch if we accepted that patch.

In that case it seems fair for distributions which want to replace
oauth2 with a safer alternative to carry a specific patch.

Thoughts ? Do we have past examples of introducing new deps in stable
branch updates ?

-- 
Thierry Carrez (ttx)