Mailing-List: contact cloudstack-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: cloudstack-dev@incubator.apache.org
Received-SPF: pass (nike.apache.org: domain of sudha.ponnaganti@citrix.com
 designates 66.165.176.89 as permitted sender)
From: Sudha Ponnaganti <sudha.ponnaganti@citrix.com>
To: "cloudstack-dev@incubator.apache.org"
	<cloudstack-dev@incubator.apache.org>
Date: Sun, 3 Feb 2013 22:12:37 -0800
Subject: RE: [DISCUSS] Packaging in 4.1
Thread-Topic: [DISCUSS] Packaging in 4.1
Thread-Index: Ac4CdRi0EpV5ZcVYToWcUlBXr7V1uwAKUPew
Message-ID: 
 <7914B38A4445B34AA16EB9F1352942F1012F15861558@SJCPMAILBOX01.citrite.net>
References: <6DE00C9FDF08A34683DF71786C70EBF02F69715B@SBPOMB402.sbp.lan>
 <CANLSSBX-q1=v4YXd+c4kruetYvtTfosXhBuwOUGf7phODOG_Jw@mail.gmail.com>
 <CAKprHVYj2Jb9A6YrdjJZ3RDhGVPO8Zhr_H=Oq+mSOE5AqFOFOw@mail.gmail.com>
 <CANLSSBXsdtHYQntGQXLeoFZ7BeP46iyvua-7iBSu4v_5_KofiQ@mail.gmail.com>
 <CAKprHVbwavU-zb74pVVi2j=PKoYWo3SDA6=kP1eEDcuZOSx+Dw@mail.gmail.com>
 <CANLSSBXyPegiDRjmYSn3UPtuRzfoKjf1xxCatYv8ocWO2h2_Pw@mail.gmail.com>
 <CAKprHVZhoA6y3z+AWghSwtH1im32+gVHJZOQ-iRSm3+r4-eb1Q@mail.gmail.com>
 <CANLSSBXffHZv06dkRcQ3SM9h28zR+h9NXT7Gepb2G1n98B33Sw@mail.gmail.com>
In-Reply-To: 
 <CANLSSBXffHZv06dkRcQ3SM9h28zR+h9NXT7Gepb2G1n98B33Sw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Wanted to check when would this be implemented?? Several QA folks depend on=
 the packages and need this working.=20
We have been still building using waf but today that is also not working as=
 some references are removed.=20

Is it possible to accelerate this process or leave old way of packaging in =
place till you are done with the new changes

Thanks
/sudha

-----Original Message-----
From: rohityadav89@gmail.com [mailto:rohityadav89@gmail.com] On Behalf Of R=
ohit Yadav
Sent: Sunday, February 03, 2013 5:14 PM
To: cloudstack-dev@incubator.apache.org
Subject: Re: [DISCUSS] Packaging in 4.1

On Mon, Feb 4, 2013 at 4:41 AM, David Nalley <david@gnsa.us> wrote:
> On Sun, Feb 3, 2013 at 3:58 PM, Rohit Yadav <bhaisaab@apache.org> wrote:
>> On Sun, Feb 3, 2013 at 3:07 PM, David Nalley <david@gnsa.us> wrote:
>> ...
>>>
>>> So EL6 has pygments 1.1.1 - you require 1.5, so in some ways it's=20
>>> worth than clint (clint is in EPEL, but no new version of pygments=20
>>> in
>>> EPEL/CentOS-Extras/CentOS-Plus)
>>
>> I want people to use pip to install the cli because it's the easiest=20
>> and because rpm/deb packages may have dependency issues like you=20
>> mentioned =3D> may not work on all distros, what we can do is when=20
>> people install cloudstack-cli rpm or deb, it runs a script that=20
>> installs pip (if unavailable) and cloudmonkey. cloudmonkey is pure=20
>> python, so the rpm/deb can also ship bundling src tarballs of=20
>> cloudmonkey and its dependencies and install from it. Advise best way=20
>> of doing this?
>
> I guess we won't be installing the CLI via RPMs at least for EL6.
>
> You are assuming that they would have internet access when installing
> - which is not a valid assumption.
>
> Honestly, the above idea makes me blanch. A package that reports as=20
> installed, and may or may not have installed - may have installed a=20
> compromised package (see rubygems.org compromise recently, kernel.org,=20
> and a number of other site compromises.), or might have installed=20
> packages I didn't know about is a Bad Idea (tm) The sysadmin doesn't=20
> know you are installing some of the dependencies, there is no record=20
> of those packages in the package manager, and there might potentially=20
> be conflicts with system packages, a security vulnerability in one of=20
> those dependencies wouldn't be caught on audit, etc etc.

/facepalm\, it's just a problem of packaging. The package can include cli o=
r any other artifact's dependencies, so in case of cli, you bundle both pyg=
ments and prettytable in cli's rpm/deb. AFAIK all of them are pure python s=
o easily installable. The cool people can use pip to install.

>
> And I really don't intend for this to sound like a rant, but the one=20
> of the important benefits behind using packages and a package manager=20
> is that a sysadmin needs (and often is required to have by government
> regulations) a single source of truth about the software installed on=20
> a machine.

No, it's not a rant, I understand.

> Developers love things like Maven central, pypi, CPAN, and rubygems,=20
> and for good reason, they are fast, flexible, and make their life=20
> easy. To a sysadmin managing machines in production, they are=20
> anathema; they make system state difficult or impossible to determine,=20
> they make audits painful.

I just assumed the sysadmin who would install CloudStack, cli and whatnot w=
on't be stupid, at the same time I want his life to be less miserable.

> In addition they make troubleshooting
> incredibly difficult. Do I have $foo installed - which version? Are=20
> there multiple copies of $foo installed on the system? Which one is=20
> actually being called/loaded?

Alright, but I'm talking only about the cli, since most users, admins inclu=
ded, would want it to run on their machines, the installation should be eas=
iest, that's why I said they can use pip, so it works on their windows, osx=
, linux, bsd boxes and that's why it's pure python (written that way).

Regards.
>
> --David