bugGNU Health - Bugs: bug #46996, vobject version name changed

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46996: vobject version name changed

Submitted by:  Luis Falcon <meanmicio>
Submitted on:  Thu 28 Jan 2016 12:06:39 PM UTC  
 
Category:  Installation Severity:  4 - Important
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  Luis Falcon <meanmicio>
Open/Closed:  Closed Release:  3.0.0
Module:  gnuhealth-setup

( Jump to the original submission)

Fri 29 Jan 2016 09:48:06 AM UTC, comment #6:

I think the argument about unreliable version schema is any way doomed by this precise bug.
Creating a "GNU Health security" that will check security for all the software stack sounds to me like impossible to achieve without a huge effort. For that, I think it is much better to rely on an existing project with such team (like Debian for example).
So for me if the goal to achieve is to have a reproducible setup as recommended installation, we should work with an existing distribution and provide packages for this one (or work with maintainer to provide it).

Cédric Krier <cedk>
Fri 29 Jan 2016 09:25:49 AM UTC, comment #5:

Hi !
Is not that simple. In the case of vobject, there was an issue with pypi and the package update, resulting in the hiding of the latest version. So if we would not have set the exact version, and just use the name of the package as you suggest, it would have installed an obsolete 0.6.6, instead of 0.8.2 . That would have resulted in a broken system.

Moreover, new versions also introduce bugs, so that's why we test the dependencies and general functioning for a specific dependency version a while before releasing the stable GNU Health version.

In addition, on Pypi there is no clear package numbering model (each package maintainer can choose the naming convention they want), which is problematic in order to just choose the latest patchset.

Because of that, the updated gnuhealth-setup includes the latest changes on the dependencies. At this point, the number of dependencies is limited (16), so it's feasible.

For Tryton and GNU Health modules, the GNU Health control update system checks and installs the latest patchlevel in both cases.

For the running system, we can send security advisories on updating specific python packages, postgreSQL and other components when required. That would be done by the GNU Health security team. Anyone that wants to become a member of this important task is most welcome, knowing though the responsibility and commitment associated to it.

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Fri 29 Jan 2016 07:12:31 AM UTC, comment #4:

Is not showing that it will be better to no pin exact package number but just real dependencies? Other point is that you could miss security update with pinning package version.

Cédric Krier <cedk>
Fri 29 Jan 2016 06:49:44 AM UTC, comment #3:

The vobject developers just released the vobject-0.8.2, reverting the issues it caused the latest version published a couple of days ago (renaming the package and removing the ez_setup dependency).

http://eventable.github.io/vobject/#release-history

gnuhealth-setup 3.0.2 includes these fixes, plus the update in relatorio to 0.6.2

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Thu 28 Jan 2016 12:47:40 PM UTC, comment #2:

The new version gnuhealth-setup 3.0.1 that fixes this issue is now available at GNU.

You can install the latest gnuhealth-setup tool in the same directory installation directory with the following command:

wget ftp://ftp.gnu.org/gnu/health/gnuhealth-setup-latest.tar.gz -O - | tar -xzv

Then just continue the installation with

./gnuhealth-setup install

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Thu 28 Jan 2016 12:09:24 PM UTC, comment #1:

Fixed on changeset 2376:6e74c0945df7

A new version of gnuhealth-setup with this fix will be available for download shortly.

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.
Thu 28 Jan 2016 12:06:39 PM UTC, original submission:

vobject (vCal / iCal module) name has changed on pypi , from vobject-0.8.1c to vobject-0.8.1c-dist . Additionally, ez_setup module is required on this version.

This makes the gnuhealth-setup abort when downloading vobject.

Luis Falcon <meanmicio>
Project AdministratorIn charge of this item.

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by cedk (Posted a comment)
  • -email is unavailable- added by meanmicio (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-01-28 meanmicio StatusConfirmed => Fixed
        ReleaseNone => 3.0.0
    2016-01-28 meanmicio Open/ClosedOpen => Closed

    Back to the top


    Powered by Savane 3.3