Update python / django

[ghost]

Hello,

I attended Code4Lib 2018 where this application was introduced during a workshop, and I am currently evaluating this application for deployment and use within my organization. Having looked at the repository and documentation, I have a few questions regarding the state of the application.

I noticed the application is currently running under Django 1.8 LTS. This version won't be receiving extended security updates past April 2018[1]. I haven't seen any GitHub issues, pull requests, branches, wiki entries, etc. addressing an upgrade path for the application. There was a mention in issue #243, but that was dismissed.

I also noticed the application is running under Python 2.7, with no mention of migration to Python 3 (which Django 2.0+ only supports).

I very much like this project and its demonstration during Code4Lib 2018, but I am hesitant to recommend deploying it to my organization if the authoring organization does not have plans for migrating off of EOL software. The Development Roadmap, Backlog, Issues/Milestones, etc. don't mention any plans for support into 2018.

Can someone from this project elaborate on the future of this project?

Thank you.

[1] https://www.djangoproject.com/download Under "Supported Versions"

[justinlittman]

Hello @peterdimou!

That is a completely valid concern and thank you for raising it. We don't currently have any plans, though I imagine it would one of the goals if/when we pursue an additional grant for work on SFM.

In the meantime, running SFM in Docker containers mitigates some of the issues with running older software versions. Within both Docker and python, we have explicitly pinned the versions of all software. As part of fixing defects, we have on occasion upgraded individual dependencies. Overall, this approach has kept SFM very stable.

I'm happy to discuss this more.

[ghost]

Hi Justin,

Thank you for taking the time to address my question. It’s unfortunate to hear that an upgrade to the EOL dependencies isn’t something that’s being currently addressed for SFM. While docker will help with ease of deployment and some degree of application isolation, it won’t cover any CVEs that are discovered in the older dependencies and would put our user data at risk.

I appreciate your work on the project and I look forward to revisiting it in the future if/when your organization decides to pursue additional grants to continue work on the application.

Best Regards, Peter

[justinlittman]

Supervisord master supports python 3. However, there has not been a version released with python 3 supports.

[justinlittman]

IA warc library does not support python 3. Hence, #732 is necessary.

[justinlittman]

Minor tweaks required to warcprox for python 3. These are in version 0.3.6.