From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp0 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id EFzINITzAWDHHgAA0tVLHw (envelope-from ) for ; Fri, 15 Jan 2021 19:56:52 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp0 with LMTPS id QM+NMITzAWC8VQAA1q6Kng (envelope-from ) for ; Fri, 15 Jan 2021 19:56:52 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 03AE29404CC for ; Fri, 15 Jan 2021 19:56:52 +0000 (UTC) Received: from localhost ([::1]:39404 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1l0VDF-0000zB-UT for larch@yhetil.org; Fri, 15 Jan 2021 14:56:49 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:43792) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1l0VCx-0000yG-On for help-guix@gnu.org; Fri, 15 Jan 2021 14:56:32 -0500 Received: from wout2-smtp.messagingengine.com ([64.147.123.25]:48003) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1l0VCt-0000nR-1K for help-guix@gnu.org; Fri, 15 Jan 2021 14:56:30 -0500 Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.west.internal (Postfix) with ESMTP id 61F33FB3; Fri, 15 Jan 2021 14:56:24 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute3.internal (MEProxy); Fri, 15 Jan 2021 14:56:24 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:to:subject:message-id:references:mime-version :content-type:in-reply-to; s=mesmtp; bh=wVk1qPTGxzA6yKDu2A3ni8Eb dSnbnHfqLqfIiaoUeXI=; b=h4whC7Zgm0Xa+iLWf82/C0SKOVYvcdGzePqojF1D TkomfbVStn4eHOPZa/pSAa5UJFx5lYwYaN4MFB9OHND/8CIttzm6t8+DXMkvVyDy 7BjP/lWwv6ibwCDLhz6G8ModeF4aDZK09+Prqi34aP4YcE6gaRQjLyVRcX0n7eif FMQ= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=wVk1qP TGxzA6yKDu2A3ni8EbdSnbnHfqLqfIiaoUeXI=; b=htqSNh7ZZ8hOcDFjiFXDHY VzUCm3VKdhRA8j4rLFmWkO4HNXuOCyS0MpzYC3u22MKJViArvDP/ZBPc2XA2N5TT fcYN4YYRUlV3OCrz0SURJau4Rh8qN8GOke6ZVIi/bUyU3hcFat9T9WgSpiXUlHU9 K8QMYTFQYc/SDxmtVMO2mSlOOOUqSzHlNJFN/af3+dj03kGnRvKvHIfcZtk9pwbt KsrylPjUSzEz9PqSUhQAJPgAm87eBrYlLaeMOmZzav/Y3MRDBKV4WChEb3I7hg5K XISgNFinJFa4GCyudHv2ADGTmsSNQNe0/iQSr3dQyB+OoOFFLzUKWdZAoo/483dQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrtddvgddutdejucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpeffhffvuffkfhggtggujgesghdtre ertddtjeenucfhrhhomhepnfgvohcuhfgrmhhulhgrrhhiuceolhgvohesfhgrmhhulhgr rhhirdhnrghmvgeqnecuggftrfgrthhtvghrnhepjedujeetleevveduudelgeevgedvge euieelkeettdekvdffvdehveehleevtdevnecuffhomhgrihhnpehphihthhhonhdrohhr ghenucfkphepuddttddruddurdduieelrdduudeknecuvehluhhsthgvrhfuihiivgeptd enucfrrghrrghmpehmrghilhhfrhhomheplhgvohesfhgrmhhulhgrrhhirdhnrghmvg X-ME-Proxy: Received: from localhost (pool-100-11-169-118.phlapa.fios.verizon.net [100.11.169.118]) by mail.messagingengine.com (Postfix) with ESMTPA id AF21F108005B; Fri, 15 Jan 2021 14:56:23 -0500 (EST) Date: Fri, 15 Jan 2021 14:56:21 -0500 From: Leo Famulari To: zimoun , help-guix Subject: Re: Does Guix provide security support for Python2? For how long? Message-ID: References: <87ft325gws.fsf@disroot.org> <87czy65dbi.fsf@disroot.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="0ybYX9st56BdIgTV" Content-Disposition: inline In-Reply-To: <87czy65dbi.fsf@disroot.org> Received-SPF: pass client-ip=64.147.123.25; envelope-from=leo@famulari.name; helo=wout2-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: help-guix@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-guix-bounces+larch=yhetil.org@gnu.org Sender: "Help-Guix" X-Migadu-Flow: FLOW_IN X-Migadu-Spam-Score: -3.66 Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=famulari.name header.s=mesmtp header.b=h4whC7Zg; dkim=pass header.d=messagingengine.com header.s=fm1 header.b=htqSNh7Z; dmarc=none; spf=pass (aspmx1.migadu.com: domain of help-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=help-guix-bounces@gnu.org X-Migadu-Queue-Id: 03AE29404CC X-Spam-Score: -3.66 X-Migadu-Scanner: scn1.migadu.com X-TUID: 0Z/O1r/zeboZ --0ybYX9st56BdIgTV Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jan 15, 2021 at 02:18:09PM -0300, Jorge P. de Morais Neto wrote: > Em [2021-01-15 sex 18:07:40+0100], zimoun escreveu: >=20 > > As far as I know, Guix provides the security support that upstream > > releases. >=20 > I too suppose so in general. But I would like a more authoritative > answer for the specific case of Python2. And, in fact, this should be > publicly documented---in the manual or in the website, as well as the > description of the python2 package and maybe also in the description of > all python2-.* packages. Because Python 2 is not supported upstream =E2=80=94 at =E2=80=94 we do not offer any security support for it. If some other organization began supporting it, we might consider switching to that source. But for now, the plan is to remove Python 2 =66rom Guix before very long. In general, Guix provides no security support for packages besides what upstream provides. There may be exceptions but they are exceptional. I don't agree that we should specifically document how much we support certain packages. For every package, the best we can offer is what the upstream developers provide. Guix is a distributor, and therefore we do not do software development of packages. Regarding offlineimap, if they do not port the software to Python 3, I recommend switching to mbsync, from the isync package. --0ybYX9st56BdIgTV Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAmAB82IACgkQJkb6MLrK fwhtYQ/9Hi4RGALGUL9lMa3hhodgW6z2ekDmtgjz/ZmrswEfOrfkMA6kUVhczD9y isbD1cSjDw9EBNPxtrK2gi02UxbEKT26w5l0/qQtZCObgyChKNc3Q2AHXYO/OREP xnpFzf54sbGXY6cO+L5/eYFIHEfMiDFZrV+lfhs559bgRGjSfHZoDb6pC+fn9PLu lzbXxdOeT1d9jMtsGBdq7ma6+JLLxvOK7mxgwjkRifxOHilzY1/wmRuacDsTvrb5 opYYMudNVzhRDD66edPX0EcZlmE6oqmlUM93IlzymoR2gqS0QcLpGcALrwXizerh QgzWUTOh3quIKP2jUVGzq2AnezizCy1tE3s7MU1+YxmruzlFnFthuLVs93tXKKZv 5y/ysIqQXMbnI8PAA0oHFpeZ/DovO9TNy2rOypLibWkhqx7MZnSyye0GO0IeXyuK n4qJHSWHw2mcOuYO4RZTlL/h4xCbk+1QsP0wQrglW3kGTLcu8UEqWMLMPCw3pvOf tG1d77eYwh8S9Qt8ceVG5wa/JedK0PTvO4NIggd11gzb5DGKoQJ5Nw1GWBl5tlar Gi9St8x8Iy5C2Jzj2WwPEAqd/NjjDs+fa8eo9vv8va8e7RccWoz/wynS5dgICk1q dRLG1tUkRmKt0jLbPd9wTswxUx0VWA3zGQEAoUNYUZMFEtbFufU= =2rXJ -----END PGP SIGNATURE----- --0ybYX9st56BdIgTV--