[Pulp-dev] pulp-owned pypi packages that pulp did not author

[Daniel Alley]

Reposting my response from the other thread:

Hi Evengi,

In the case of createrepo_c and libsolv, the upstream merged all of the
build script changes that were necessary to enable producing Python
packages, so in that sense the packages we are producing are completely
unmodified.  However, the RPM team isn't particularly interested in
maintaining Python packages, and so they gave us permission to maintain the
packages ourselves.  I've forgotten in what medium that discussion took
place so I'm not sure where even to look for a record of it.  Nonetheless I
actually have a PR open against both projects which would automate the
entire packaging and release process for Python packages with Github
Actions, so that they could become the official owners/maintainers without
actually needing to do any work (hopefully).

https://github.com/rpm-software-management/createrepo_c/pull/207
https://github.com/rpm-software-management/libcomps/pull/69

However you may notice that those PRs have been sitting for a while :)  In
any case we'd definitely love to transfer ownership back to them, and I've
been trying to facilitate that process a little bit (with the PRs) but I
don't really want to push on them too hard to do so.

With respect to libsolv it's a little more complicated. As far as I can
tell the upstream is just not interested at all and would probably not
accept the changes into upstream regardless of whether we made the release
process automated.  I asked multiple times if they were interested and got
essentially no response.

https://github.com/openSUSE/libsolv/issues/228

+ some discussion on IRC

Feb 24 10:14:47 <dalley> hello Igor, do you have any opinion on this?
> https://github.com/openSUSE/libsolv/issues/228#issuecomment-589915584
> Feb 24 10:18:24 <ignatenkobrain> Well, I don't see any reason to publish
> libsolv to pypi :)
>

On Tue, Jul 14, 2020 at 9:31 AM Evgeni Golov <evgeni at redhat.com> wrote:

> Hi pulp-dev,
>
> While packaging pulp3 (more precisely pulp-rpm), I stumbled over the
> fact that the "pulp" pypi user has uploaded "solv", "libcomps" and
> "createrepo-c" without being the real author. To make matters worse,
> the uploads don't 100% represent the original artifacts released by
> the respective upstreams as they don't release python packages but
> classic tarballs. In the case of "solv" this lead to an interesting
> bug: solv upstream does not build a python egg, but your package did,
> and then as the pulp-rpm egg has "solv" as a dependency, it won't load on
> a system that uses the "real solv" without the egg. We patched that
> out in packaging, but it remains ugly.
>
> I kinda understand why Pulp did that, this way you can rely on "pip"
> to install everything for a working pulp-rpm environment, but I think
> we/you shouldn't do that and instead either persuade (and help!) the real
> upstreams to publish their stuff to PyPI or bite the bullet and accept
> that pip is not able to install everything needed for a working
> environment.
>
> Thanks!
> Evgeni
>
> --
> Beste Grüße/Kind regards,
>
> Evgeni Golov
> Senior Software Engineer
> ________________________________________________________________________
> Red Hat GmbH, http://www.de.redhat.com/, Sitz: Grasbrunn,
> Handelsregister: Amtsgericht München, HRB 153243,
> Geschäftsführer: Charles Cachera, Laurie Krebs, Michael O'Neill, Thomas
> Savage
>
>
> _______________________________________________
> Pulp-dev mailing list
> Pulp-dev at redhat.com
> https://www.redhat.com/mailman/listinfo/pulp-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/pulp-dev/attachments/20200714/8e6a4ad9/attachment.htm>