{"action":"created","issue":{"url":"https://api.github.com/repos/privacyidea/privacyidea/issues/1127","repository_url":"https://api.github.com/repos/privacyidea/privacyidea","labels_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/1127/labels{/name}","comments_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/1127/comments","events_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/1127/events","html_url":"https://github.com/privacyidea/privacyidea/issues/1127","id":341824869,"node_id":"MDU6SXNzdWUzNDE4MjQ4Njk=","number":1127,"title":"Deterministic installations with pinned dependencies","user":{"login":"fredreichbier","id":28243,"node_id":"MDQ6VXNlcjI4MjQz","avatar_url":"https://avatars2.githubusercontent.com/u/28243?v=4","gravatar_id":"","url":"https://api.github.com/users/fredreichbier","html_url":"https://github.com/fredreichbier","followers_url":"https://api.github.com/users/fredreichbier/followers","following_url":"https://api.github.com/users/fredreichbier/following{/other_user}","gists_url":"https://api.github.com/users/fredreichbier/gists{/gist_id}","starred_url":"https://api.github.com/users/fredreichbier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fredreichbier/subscriptions","organizations_url":"https://api.github.com/users/fredreichbier/orgs","repos_url":"https://api.github.com/users/fredreichbier/repos","events_url":"https://api.github.com/users/fredreichbier/events{/privacy}","received_events_url":"https://api.github.com/users/fredreichbier/received_events","type":"User","site_admin":false},"labels":[{"id":136313426,"node_id":"MDU6TGFiZWwxMzYzMTM0MjY=","url":"https://api.github.com/repos/privacyidea/privacyidea/labels/idea%20!","name":"idea !","color":"009800","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2018-07-17T08:52:52Z","updated_at":"2018-08-22T08:09:08Z","closed_at":null,"author_association":"MEMBER","body":"Currently, this is just an idea and I would be interested in your opinions :-)\r\n\r\nThere are currently three ways to install privacyIDEA (please correct me if I'm wrong):\r\n* via native distribution packages, currently only Ubuntu\r\n* via distribution packages using virtualenv (e.g. centos and debian-virtualenv)\r\n* manually in a virtualenv via ``pip install privacyidea``\r\n\r\nIn the past, we often had problems when there were new versions of dependencies which were incompatible with our codebase (e.g. ldap3/pyasn #912).\r\n\r\nThis can still happen, e.g. assume there is a dependency ``X`` which releases a new version ``1.1`` today that is incompatible with privacyIDEA 2.22. Then, all users who use ``pip install privacyidea`` today to install privacyIDEA 2.22 will get the newest version ``1.1`` of dependency ``X``, which will cause problems, and will need to manually downgrade ``X`` to get a working installation. We can react by putting ``X<1.1`` in our ``setup.py``, but this requires us to make a new release.\r\n\r\nIn case of Ubuntu packages, the package repositories don't get updated too often, so the risk of incompatible new versions is pretty low here. The risk is higher for virtualenv packages and pip installations, because ``privacyidea-pip-update`` will upgrade all installed dependencies to their latest versions by default (though we can still explicitly exclude versions in ``setup.py``).\r\n\r\nSo it might be nice to have \"deterministic\" installations in the sense that all versions of dependencies installed on user's machines are pinned and known to work with our current stable version.\r\n\r\nCurrently, I'm not sure how to do that nicely: Putting pinned dependencies in ``setup.py`` is [discouraged](https://packaging.python.org/discussions/install-requires-vs-requirements/#install-requires). ``requirements.txt`` contains pinned versions, but ``pip install privacyidea`` installs dependencies from setup.py, not requirement.txt.\r\n\r\nWhat do you think? :)"},"comment":{"url":"https://api.github.com/repos/privacyidea/privacyidea/issues/comments/414949120","html_url":"https://github.com/privacyidea/privacyidea/issues/1127#issuecomment-414949120","issue_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/1127","id":414949120,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNDk0OTEyMA==","user":{"login":"fredreichbier","id":28243,"node_id":"MDQ6VXNlcjI4MjQz","avatar_url":"https://avatars2.githubusercontent.com/u/28243?v=4","gravatar_id":"","url":"https://api.github.com/users/fredreichbier","html_url":"https://github.com/fredreichbier","followers_url":"https://api.github.com/users/fredreichbier/followers","following_url":"https://api.github.com/users/fredreichbier/following{/other_user}","gists_url":"https://api.github.com/users/fredreichbier/gists{/gist_id}","starred_url":"https://api.github.com/users/fredreichbier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fredreichbier/subscriptions","organizations_url":"https://api.github.com/users/fredreichbier/orgs","repos_url":"https://api.github.com/users/fredreichbier/repos","events_url":"https://api.github.com/users/fredreichbier/events{/privacy}","received_events_url":"https://api.github.com/users/fredreichbier/received_events","type":"User","site_admin":false},"created_at":"2018-08-22T08:09:08Z","updated_at":"2018-08-22T08:09:08Z","author_association":"MEMBER","body":"A periodic CI job that pulls the latest versions of all dependencies and runs our tests sounds like a good idea to me!\r\n\r\nStill, I think in the long run it would be a good idea to better \"equalize\" the various installation methods. Also because for the virtualenv-based distribution packages, we already have the responsibility to check if the installed versions have any security issues :-/"}}
{"actor":{"display_login":"fredreichbier"}}