DevHeads.net

SCL packages in CentOS 7 that are expired and EOL

Hi all

I just had a glance at the various repos installed by centos-release-scl
on CentOS 7 and a large number of the packages available in the CentOS
version of this repo are both old and out of date and more importantly,
EOL. They should be removed from our repos ASAP.

I know we had/have a policy of cleaning these repos up at point release
times but it's quite apparent that we have missed all of these for a
number of point releases from 7.3 onwards. Thus I propose we make an
exception for these and remove them anyway, regardless of point release
time or not. A lot of them should have been gone for 3 years already.

The following are all dead as per
<a href="https://access.redhat.com/support/policy/updates/rhscl" title="https://access.redhat.com/support/policy/updates/rhscl">https://access.redhat.com/support/policy/updates/rhscl</a> - some of them
deader than others.

devtoolset-3 - Oct 2016
devtoolset-4 - Nov 2017
devtoolset-6 - Nov 2018
git19 - Oct 2016
mariadb-5.5 - Oct 2016
maven30 - Oct 2016
mogodb24 - Oct 2016
mysql55 - Oct 2016
nginx16 - Oct 2016
nodejs010 - Oct 2016
perl516 - Oct 2016
php54 - Oct 2016
php55 - Oct 2016
postgresql92  - Oct 2016
python33 - Oct 2016
rh-git29 - Nov 2018
rh-mariadb100 - Apr 2018
rh-mongodb26 - Apr 2018
rh-mongodb30upg - Apr 2018
rh-mysql56 - Apr 2018
rh-nginx18 - Nov 2018
rh-nodejs4 - May 2018
rh-passenger40 - Apr 2018
rh-perl520 - Apr 2018
rh-postgresql94 - Apr 2018
rh-python34 - Apr 2018
rh-ror41 - Apr 2018
rh-ruby22 - Apr 2018
rh-thermostat16 - Oct 2016
rh-varnish4 - Nov 2018
ror40 - Oct 2016
ruby193 - Oct 2016
ruby200 - Oct 2016
rust-toolset-7 - ???
sclo-python34 - Apr 2018
thermostat1 - Oct 2016
v8314 - Apr 2018

The following go EOL this month:
====================
rh-mariadb101 - May 2019
rh-maven33 - May 2019
rh-mongodb32 - May 2019
rh-nodejs6 - May 2019
rh-postgresql95 - May 2019
rh-python35 - May 2019
rh-ror42 - May 2019
rh-ruby23 - May 2019
sclo-python35 - May 2019
sclo-ror42 - May 2019

These are not mentioned on the above page but could be part of other
SCLs that are still current (maybe!)

rh-eclipse46*
sclo-cassandra3 - ????
sclo-git212 - ???
sclo-git25 - ???
go-toolset - no expiration date given
libasan[2,3,4,5] libcilkrts, liblsan, libmpx, libtsan, libubsab[1] - ????
llvm-toolset-7 - part of devtoolset-7?
sclo-subversion19 - ???
sclo-vagrant1 - ???

Trevor

Comments

Re: SCL packages in CentOS 7 that are expired and

By Fabian Arrotin at 05/14/2019 - 02:05

On 13/05/2019 20:47, Trevor Hemsley via CentOS-devel wrote:
Thanks a lot for the list Trevor,

Now I'd like to have official comment from the SCLo SIG about a clean-up
and sending announce about this too.

Re: SCL packages in CentOS 7 that are expired and

By Tru Huynh at 05/14/2019 - 03:17

On Tue, May 14, 2019 at 08:05:33AM +0200, Fabian Arrotin wrote:
+1

Although I agree that devtoolset-n n<=6 are no longer supported
(no bug fix/obsolete) I would rather keep them as some user might have
built software stacks (HPC people?) on those and they "need" to keep them running.

For public facing software framework, nginx/redis/php/... +1

Cheers

Tru

Re: SCL packages in CentOS 7 that are expired and

By Nico Kadel-Garcia at 05/14/2019 - 03:49

On Tue, May 14, 2019 at 3:17 AM Tru Huynh < ... at centos dot org> wrote:
I've done things like that. And picking and choosing which obsolete
parts to clear out is awkward. If they're still in the RHEL channels
upstream, I'd encourage keeping them, even if those components are
obsolete and deprecated. I've certainly seen people running versions
of MySQL, for example, that are extremely obsolete because they
couldn't choose a migration technique. And the tendency of EPEL to
discard all but the current versions has been the bane of my "we need
to keep the binaries and sources available" existence.

Re: SCL packages in CentOS 7 that are expired and

By Carl T. Miller at 05/14/2019 - 11:19

Nico Kadel-Garcia wrote:
Agreed. There have been several times I've been burned when
"yum history undo last" failed because epel had removed the
most recent previous version. Keep up the good work!

c

Re: SCL packages in CentOS 7 that are expired and

By =?ISO-8859-2?Q?... at 05/14/2019 - 07:57

As the person in charge of maintaining updates for the rh-* SCLs,
I can say that I'm not shipping/caring about these once they are marked
as EOL; so from my POV, they can be removed if it is not desirable to
have them in the repositories.

That being said, there is a possibility that a inter-SCL dependency will
break, as have happened last summer with rh-ror42 (maintained at the
time) and rh-nodejs4 (EOL). Since upstream does not remove the
unmaintained packages from the repos, such dependencies won't be
discovered until someone does remove them.

Basically, I'm in favor of removing the EOL SCLs, but it might break
non-EOL collections, which will take some time to fix.

Re: SCL packages in CentOS 7 that are expired and

By Stephen John Smoogen at 05/14/2019 - 08:40

Is there a way to archive these versus remove them? That way people who are
looking for them would know that they are EOL but they could make their own
copy and maintain it themselves?

Re: SCL packages in CentOS 7 that are expired and

By Brian Stinson v... at 05/14/2019 - 11:36

On 14/05/2019 13:40, Stephen John Smoogen wrote:
Standard practice in the past has been to move expired things to
vault.centos.org - for example
<a href="http://vault.centos.org/centos/7.5.1804/sclo/x86_64/sclo/" title="http://vault.centos.org/centos/7.5.1804/sclo/x86_64/sclo/">http://vault.centos.org/centos/7.5.1804/sclo/x86_64/sclo/</a>

Trevor

Re: SCL packages in CentOS 7 that are expired and

By Nico Kadel-Garcia at 05/14/2019 - 11:46

On Tue, May 14, 2019 at 11:37 AM Trevor Hemsley via CentOS-devel
<centos- ... at centos dot org> wrote:
That repository is for is source, not binaries. Pulling things *out*
of either binary or source repositories is a dangerous practice. It
would save space on the mirrors, but it can leave active, used RPM's
very difficult for the clients using them to recover even for analysis
and comparison to the newer versions.

Re: SCL packages in CentOS 7 that are expired and

By John R. Dennison at 05/14/2019 - 12:00

On Tue, May 14, 2019 at 11:46:45AM -0400, Nico Kadel-Garcia wrote:
I presume, then that you didn't actually look at the contents? I see
_many_, _many_ binary rpms.

John

Re: SCL packages in CentOS 7 that are expired and

By Nico Kadel-Garcia at 05/14/2019 - 12:12

On Tue, May 14, 2019 at 12:00 PM John R. Dennison < ... at gerdesas dot com> wrote:
I was looking at a higher level in vault.centos.org. You're right.

OK, that addresses my legacy access concerns, and there is a
"repodata" there to support yum access as needed. Yeah, I'd be on
board with migrating the obsolete components to that repo.

Re: SCL packages in CentOS 7 that are expired and

By John R. Dennison at 05/14/2019 - 12:55

On Tue, May 14, 2019 at 12:12:09PM -0400, Nico Kadel-Garcia wrote:
Awesome. Now that the project has your approval it can proceed, this is
great news!

John

Re: SCL packages in CentOS 7 that are expired and

By Phil Perry at 05/14/2019 - 17:26

On 14/05/2019 17:55, John R. Dennison wrote:
John,

I had hoped that the days of these kind of facetious comments in open
source communities were well and truly behind us and that we had entered
an era where we could all demonstrate respect towards each other and
contribute in a positive and constructive manner. Please, let us not
return to the ways of the past.

Regards,

Phil

Re: SCL packages in CentOS 7 that are expired and

By Nico Kadel-Garcia at 05/15/2019 - 03:37

On Tue, May 14, 2019 at 5:26 PM Phil Perry < ... at elrepo dot org> wrote:
I'd merely taken that as slightly exasperated mocking that I'd taken
so long to convince, not as a personal denigration.

John, I'd meant "Yeah, I'd be on board" as a friendly acknowledgement
that this would address my legacy software access concerns, not a
claim that it needs my personal approval.

Now, with all that in mind: Should there be some kind of comment.
Should there be some kind of acknowledgement in the CentOS-Vault repo
along with a pointer to such a repository of "these are so dangerously
obsolete that we've overridden RHEL's publication of the original sclo
channel and decided to shut these elsewhere"? What would such a
channel be called? Would its contents be left permanently in the
"obsolete" channel?

Re: SCL packages in CentOS 7 that are expired and

By =?ISO-8859-2?Q?... at 05/30/2019 - 10:08

Hi again,
there are few recent bugs kind-of related to this discussion: [1,2].
The short version of both bugs is that some EOL-ed packages contain
packaging mistakes, which can break non-SCL installation when the SCL
repository is enables. As these are EOL, the fix is either to remove
them from the repo, or to patch them "downstream". From my PoV, I would
prefer moving them to the Vault.

Nico Kadel-Garcia wrote:
The last time something similar was discussed, I have tried to add
repository files for SCLo Vault into the centos-release-scl package;
then I was told this is a bad idea (i.e. vault is not mirrored, and
definitely cannot withstand traffic similar to mirrors). I guess the
proper course of action is to document this somewhere, and point people
to that documentation. Also, announcement on CentOS-announce would
probably be in order.

[1]: <a href="https://bugs.centos.org/view.php?id=16037" title="https://bugs.centos.org/view.php?id=16037">https://bugs.centos.org/view.php?id=16037</a>
[2]: <a href="https://bugs.centos.org/view.php?id=16125" title="https://bugs.centos.org/view.php?id=16125">https://bugs.centos.org/view.php?id=16125</a>

Re: SCL packages in CentOS 7 that are expired and

By Brian Stinson v... at 05/14/2019 - 12:47

JFYI: /etc/yum.repos.d/CentOS-Vault.repo ...

Re: SCL packages in CentOS 7 that are expired and

By Brian Stinson v... at 05/14/2019 - 11:30

In the past such stuff was moved to vault.centos.org. The reason to do this at point releases?

Re: SCL packages in CentOS 7 that are expired and

By Nico Kadel-Garcia at 05/13/2019 - 17:11

By “dead”, do you mean the upstream RHEL channel is entirely disabled? Or just unmaintained?

Sent from my iPhone

Re: SCL packages in CentOS 7 that are expired and

By Brian Stinson v... at 05/13/2019 - 17:16

I mean that the EOL date is past - see
<a href="https://access.redhat.com/support/policy/updates/rhscl" title="https://access.redhat.com/support/policy/updates/rhscl">https://access.redhat.com/support/policy/updates/rhscl</a> - sometimes by as
much as 3 years. That means those packages are unmaintained and
dangerous.  I reckon there are more than 5000 packages there that fall
under this.

yum --disablerepo=\* --enablerepo=centos-sclo-rh,centos-sclo-sclo
devtoolset-3* devtoolset-4* devtoolset-6* git19* mariadb-5.5* maven30*
mogodb24* mysql55* nginx16* nodejs010* perl516* php54* php55*
postgresql92* python33* rh-git29* rh-mariadb100* rh-mongodb26*
rh-mongodb30upg* rh-mysql56* rh-nginx18* rh-nodejs4* rh-passenger40*
rh-perl520* rh-postgresql94* rh-python34* rh-ror41* rh-ruby22*
rh-thermostat16* rh-varnish4* ror40* ruby193* ruby200* rust-toolset-7*
sclo-python34* thermostat1* v8314* rh-mariadb101* rh-maven33*
rh-mongodb32* rh-nodejs6* rh-postgresql95* rh-python35* rh-ror42*
rh-ruby23* sclo-python35* sclo-ror42* rh-eclipse46* sclo-cassandra3*
sclo-git212* sclo-git25* go-toolset* libasan* libcilkrts* liblsan*
libmpx* libtsan* libubsab* llvm-toolset-7* sclo-subversion19*
sclo-vagrant1* | wc -l
5361

Yes, that has some blank lines in there and maybe some other stuff
inflating that count but it still ends up with 5000 unmaintained and EOL
packages.

We should not be making these publicly available. It only encourages
people to use them!

Trevor

On 13/05/2019 22:11, Nico Kadel-Garcia wrote:

Re: SCL packages in CentOS 7 that are expired and

By Nico Kadel-Garcia at 05/13/2019 - 17:13

Sorry, I meant packages in the channel, not the channel itself!

Sent from my iPhone