Dear python devel,
I just noticed that since Fedora 28, package python2-firewall is no longer available and while I know that python2 packages nobody seems to rely on are being gradually removed nowadays, I wonder why exactly was this particular package removed.
The problem here is that without python2 module for firewalld, one can't use an ansible playbook to reconfigure firewall on Fedora machine:
https://bugzilla.redhat.com/show_bug.cgi?id=1575428
And while switching to python3[2] may solve this particular problem, I don't think it's a reasonable solution from Fedora perspective, which:
* packages Ansible so that it runs on python 2 * provides Firewalld to manage firewall by default
Decision to drop python2-firewall then looks little weird, as it breaks the general expectation that ansible playbook using firewalld module is able to reconfigure firewall on a fedora machine. Moreover other python2 modules which some ansible modules are using such as python2-libselinux or python2-dnf are still available, and dropping python2-firewall doesn't look very consistent. That said, these python2 subpackages will not be installed by default[3].
The other problem here is that it's not easy to spot such problem, as this kind of dependency is not visible via rpm requirements (see eg. BZ 1505082 for explanation :). Maintainer dropping his python2 subpackage could very easily miss this.
What do you think? Do we want to continue dropping python2 modules and encourage people to reconfigure ansible to run under python 3 while shipping ansible with python 2 or do we want to keep python2 modules used by ansible available, even thouhg this is not easy to track right now?
And don't get me wrong, I'm a fan of switching to python3 and I agree that helping ansible guys with python 3 testing and porting is good for Fedora. I just don't think that dropping random packages from distribution so that random modules doesn't work with default ansible is a good way to do it.
[1] https://src.fedoraproject.org/rpms/firewalld/c/40f23213c95db820a0d725e42a6d5... [2] http://docs.ansible.com/ansible/latest/reference_appendices/python_3_support... [3] https://fedoramagazine.org/getting-ansible-working-fedora-23/
On Wed, May 23, 2018 at 10:51:33PM +0200, Martin Bukatovic wrote:
https://bugzilla.redhat.com/show_bug.cgi?id=1575428
And while switching to python3[2] may solve this particular problem, I
By this I mean using `ansible_python_interpreter=/usr/bin/python3` as described upstream.
That said, I need to play with this a bit more as it doesn't work for me after 1st try when I use it for local configuration.
On 23.5.2018 22:51, Martin Bukatovic wrote:
What do you think? Do we want to continue dropping python2 modules and encourage people to reconfigure ansible to run under python 3 while shipping ansible with python 2 or do we want to keep python2 modules used by ansible available, even thouhg this is not easy to track right now?
I think that we can drop them from Fedora 29, where Ansible switches to Python 3:
https://fedoraproject.org/wiki/Changes/Ansible_python3_default
Removal from Fedora 28 was indeed a bad move, however, as said, the maintainer here probably had no idea that it may break Ansible, since the dependency is not tracked.
Do we need to reintroduce it?
On Wed, May 23, 2018 at 4:52 PM Miro Hrončok mhroncok@redhat.com wrote:
On 23.5.2018 22:51, Martin Bukatovic wrote:
What do you think? Do we want to continue dropping python2 modules and encourage people to reconfigure ansible to run under python 3 while shipping ansible with python 2 or do we want to keep python2 modules used by ansible available, even thouhg this is not easy to track right now?
I think that we can drop them from Fedora 29, where Ansible switches to Python 3:
https://fedoraproject.org/wiki/Changes/Ansible_python3_default
Removal from Fedora 28 was indeed a bad move, however, as said, the maintainer here probably had no idea that it may break Ansible, since the dependency is not tracked.
+1 - Once Fedora 29 lands, I think that makes sense.
Do we need to reintroduce it?
I think from a Fedora user perspective, it would be nice to reintroduce it for Fedora 28 just because Ansible is still shipping python2 by default. Retiring python2-firewall in Fedora 29 makes sense given the impending change to Ansible being python3 only. However from an upstream Ansible perspective, if there is a strong case not to re-introduce it in Fedora then I don't have a hard preference because it's relatively easy to direct users to the module documentation informing them of the change and the need to use python3 mode (which is now even more clear on the specific issue thanks to the results of the bugzilla referenced previously in this thread).
-AdamM
-- Miro Hrončok -- Phone: +420777974800 IRC: mhroncok _______________________________________________ python-devel mailing list -- python-devel@lists.fedoraproject.org To unsubscribe send an email to python-devel-leave@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproje...
On Wed, May 23, 2018 at 10:06:08PM -0500, Adam Miller wrote:
Do we need to reintroduce it?
I think from a Fedora user perspective, it would be nice to reintroduce it for Fedora 28 just because Ansible is still shipping python2 by default. Retiring python2-firewall in Fedora 29 makes sense given the impending change to Ansible being python3 only. However from an upstream Ansible perspective, if there is a strong case not to re-introduce it in Fedora then I don't have a hard preference because it's relatively easy to direct users to the module documentation informing them of the change and the need to use python3 mode (which is now even more clear on the specific issue thanks to the results of the bugzilla referenced previously in this thread).
I agree that the proposed workaround is actually nicer. Instead of installing python2-firewall package on managed fedora machines, one would just tweak ansible_python_interpreter variable without installing anything on managed machines (firewalld requires python3-firewall, so it will be already there). Moreover ansible already supports python3 upstream and Fedora seems to plan to do the switch in next release, which is quite coold and I was not fully aware about it.
From this point of view, reintroduction is not necessary.
Another good thing about upcoming python3 switch is that we don't have to worry about dropping python2 subpackages required by ansible, but not tracked in requirements, by mistake.
That said, the main (and now the only) reason for reintroduction of python2-firewall subpackage is to prevent distrupting people who solved the issue with firewalld ansible module in the past[1] and now it stops working wihtout any announcement. And obviously the reintroduction would help only people who haven't upgraded (or reconfiugred firewalld) yet.
[1] eg. my role https://github.com/marbu/fedora-post-install/blob/cef286937a4e577e092750f6c7...
python-devel@lists.fedoraproject.org
-
Adam Miller -
Martin Bukatovic -
Miro Hrončok