search

chevah / pythia

Chevah's Python 3 distribution
MIT License
4 stars 2 forks source link

Host upstream packages. #33

Open dumol opened 2 years ago

dumol commented 2 years ago

For the long term, we should make sure we have full contol over pythia dependencies.

This mean, keeping copies of things like libffi on bin.chevah.com and have chevahbs script download them from bin.chevah.com

_Originally posted by @adiroiban in https://github.com/chevah/pythia/pull/32#discussion_r857625420_

dumol commented 1 year ago

An interesting thing I've noticed today… While trying to generate a Linux arm64 package for the 3b1a8ba revision of Pythia currently used in our server repo, the build failed because of a checksum error for zlib version 1.2.11.

Turns out that particular version was pulled out from the upstream server because of vulnerabilities, and curl was downloading an HTML file instead.

If it were hosted on our side, we wouldn't have known. I say +1 for still downloading packages from upstream, they know best when something should definitely not be used any longer.

adiroiban commented 1 year ago

Yes... the problem is for legacy version, we might need even old versions

In terms of library versions, we should have separate dedicated checks like we have for python.

The thing is that we are in business and customers are paying our salary to make sure we are able to help them with all their needs, including legacy systems.

We have many customers using SFTPPlus over separate leased private fibers and with everything over VPN... so no public access.

I think this that it's very important to make sure we have everything on our servers