Dne 11. 07. 23 v 12:47 Miro Hrončok napsal(a):
On 11. 07. 23 12:39, Miro Hrončok wrote:
> On 10. 07. 23 10:38, Vít Ondruch wrote:
>> Hi,
>>
>> I have recently installed Fedora Rawhide via netinstall and there
>> are some questionable packages installed by default, such as:
>>
>> ...
>> libxcrypt-compat
>> ...
>>
>> and I wonder what is the mechanism, which pulls these in?
>
> $ rpm -q --recommends python-pip-wheel
> (libcrypt.so.1 if python3(x86-32))
> (libcrypt.so.1()(64bit) if python3(x86-64))
>
> The comment in spec:
>
> # Some manylinux1 wheels need libcrypt.so.1.
> # Manylinux1, a common (as of 2019) platform tag for binary wheels,
> relies
> # on a glibc version that included ancient crypto functions, which were
> # moved to libxcrypt and then removed in:
> #
>
https://fedoraproject.org/wiki/Changes/FullyRemoveDeprecatedAndUnsafeFunc...
> # The manylinux1 standard assumed glibc would keep ABI compatibility,
> # but that's only the case if libcrypt.so.1 (libxcrypt-compat) is
> around.
> # This should be solved in the next manylinux standard (but it may be
> # a long time until manylinux1 is phased out).
> # See:
https://github.com/pypa/manylinux/issues/305
> # Note that manylinux is only applicable to x86 (both 32 and 64 bits)
Interesting.
I am not crypto expert, but it seems fishy to me, that while we had a
change to remove some deprecated algorithms, they are pulled in via
different means.
Also, not being Python expert, I wonder under what conditions are such
"manylinux" packages installed? Is it for some `pip install` scenarios?
In any case, I appreciate you have opened this discussion in the right
venue!
Vít