[openstack-dev] Please do *NOT* use "vendorized" versions of anything (here: glanceclient using requests.packages.urllib3)
Thomas Goirand
zigo at debian.org
Thu Sep 18 11:54:16 UTC 2014
On 09/18/2014 10:43 AM, Donald Stufft wrote:
>>> Obviously we can work with the requests team to figure out the best
>>> approach.
>>
>> There's only a single approach that works: have the requests upstream
>> authors to stop embedding foreign code, and use the dependency instead.
>
> There are legitimate reasons for a project to vendor things.
Yes, there's lot of reasons. But so fare, I haven't read about any valid
one.
> Linux distributions are not the end be all of distribution models and
> they don’t get to dictate to upstream.
Well, distributions is where the final user is, and where software gets
consumed. Our priority should be the end users.
> Generally I agree that requests should not vendor urllib3
Unfortunately, it doesn't seem requests upstream agree, so we can only
deal with the issue. This means not using requests.packages.*.
> You’re going to get very strange incompatibility problems
> if you try to mis requests.packages.urllib3 and urllib3 in one codebase
> and if you’re using requests at all it’s going to be expecting to use
> the embedded copy of urllib3.
I'm well aware of this. As I wrote, I already had to deal with issues
like that, and I'm expecting even more in the future.
Thomas Goirand (zigo)
More information about the OpenStack-dev
mailing list