[openstack-dev] Please do *NOT* use "vendorized" versions of anything (here: glanceclient using requests.packages.urllib3)

Thomas Goirand zigo at debian.org
Thu Sep 18 11:54:16 UTC 2014


On 09/18/2014 10:43 AM, Donald Stufft wrote:
>>> Obviously we can work with the requests team to figure out the best
>>> approach.
>>
>> There's only a single approach that works: have the requests upstream
>> authors to stop embedding foreign code, and use the dependency instead.
> 
> There are legitimate reasons for a project to vendor things.

Yes, there's lot of reasons. But so fare, I haven't read about any valid
one.

> Linux distributions are not the end be all of distribution models and
> they don’t get to dictate to upstream.

Well, distributions is where the final user is, and where software gets
consumed. Our priority should be the end users.

> Generally I agree that requests should not vendor urllib3

Unfortunately, it doesn't seem requests upstream agree, so we can only
deal with the issue. This means not using requests.packages.*.

>           You’re going to get very strange incompatibility problems
> if you try to mis requests.packages.urllib3 and urllib3 in one codebase
> and if you’re using requests at all it’s going to be expecting to use
> the embedded copy of urllib3.

I'm well aware of this. As I wrote, I already had to deal with issues
like that, and I'm expecting even more in the future.

Thomas Goirand (zigo)




More information about the OpenStack-dev mailing list