Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Early CouchDB build may contain wrong openssl #478

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

pepijndevos
Copy link

The build of CouchDB bundles OpenSSL, so it could happen that at compile time OpenSSL 3 was used, but a runtime dependency forces OpenSSL 1.1.1
The latest build has the OpenSSL migration and is built for both, but earlier builds may fail if anything depends on OpenSSL 1.1.1
Windows is not affected because it ships binaries. OSX might be affected but I have no way to test this.

Guidelines for marking packages as broken:

  • We prefer to patch the repo data (see here)
    instead of marking packages as broken. This alternative workflow makes environments more reproducible.
  • Packages with requirements/metadata that are too strict but otherwise work are
    not technically broken and should not be marked as such.
  • Packages with missing metadata can be marked as broken on a temporary basis
    but should be patched in the repo data and be marked unbroken later.
  • In some cases where the number of users of a package is small or it is used by
    the maintainers only, we can allow packages to be marked broken more liberally.
  • We (conda-forge/core) try to make a decision on these requests within 24 hours.

What will happen when a package is marked broken?

  • Our bots will add the broken label to the package. The main label will remain on the package and this is normal.
  • Our bots will rebuild our repodata patches to remove this package from the repodata.
  • In a few hours after the anaconda.org CDN picks up the new patches, you will no longer be able to install the package from the main channel.

Checklist:

  • Make sure your package is in the right spot (broken/* for adding the
    broken label, not_broken/* for removing the broken label, or token_reset/*
    for token resets)
  • Added a description of the problem with the package in the PR description.
  • Added links to any relevant issues/PRs in the PR description.
  • Pinged the team for the package for their input.

The build of CouchDB bundles OpenSSL, so it could happen that at compile time OpenSSL 3 was used, but a runtime dependency forces OpenSSL 1.1.1
The latest build has the OpenSSL migration and is built for both, but earlier builds may fail if anything depends on OpenSSL 1.1.1
Windows is not affected because it ships binaries. OSX might be affected but I have no way to test this.
@pepijndevos pepijndevos requested a review from a team as a code owner September 2, 2022 11:06
@wolfv
Copy link
Member

wolfv commented Sep 2, 2022

you should add OSX as well, I think

osx wasn't built for 0 and 1
@pepijndevos
Copy link
Author

Makes sense, and there is only one build

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants