Obsolete Debian release is being used #24

mlowicki · 2018-06-07T07:46:14Z

Jessie is marked as obsolete - https://www.debian.org/releases/.

yosifkit · 2018-06-11T22:04:38Z

There will be a final release later this month and it will then transition to https://wiki.debian.org/LTS; so it is only obsolete in the eyes of the Debian release and security teams.

We would want to update the image like docker-library/python#215, to have explicit aliases for jessie and stretch so that users would be able to stick to one while they evaluate the move to a new base distribution.

mlowicki · 2018-06-12T09:22:33Z

Yes, that would be perfect an generally the way docker-library/python works, makes our life much easier when it goes to handling upgrades or security issues.

KOLANICH · 2018-07-31T07:18:32Z

Any progress on it?

tianon · 2018-07-31T18:54:33Z

#27 is the first step; once we get those published I'll be doing a bump to stretch. 👍

tianon · 2018-08-01T00:19:14Z

Ok, I've attempted this adjustment, but the current published binaries from https://pypy.org/download.html link against libssl.so.1.0.0 and libcrypto.so.1.0.0, which aren't available in Debian Stretch (the libssl1.0.2 package provides 1.0.2 versions, and trying to fake it by renaming them and adjusting LD_LIBRARY_PATH results in errors like /usr/local/lib_pypy/_pypy_openssl.pypy3-60-x86_64-linux-gnu.so: /usr/local/lib/libssl.so.1.0.0: version 'OPENSSL_1.0.1' not found (required by /usr/local/lib_pypy/_pypy_openssl.pypy3-60-x86_64-linux-gnu.so), so that's definitely not feasible).

So unfortunately, this looks like it's not going to be possible for us to implement unless upstream adjusts the binaries they publish (or we find a trivial way to just rebuild /usr/local/lib_pypy/_pypy_openssl.pypy3-60-x86_64-linux-gnu.so against a newer OpenSSL).

KOLANICH · 2018-08-01T07:23:45Z

unless upstream adjusts the binaries they publish

Upstream definitely should do that. Or just use sid https://packages.debian.org/sid/pypy .

tianon · 2019-01-17T01:20:34Z

We will not be consuming binaries directly from unstable, nor will we be consuming packages built and part of Debian unless upstream specifically tells us that is what they would prefer.

At the moment, PyPy upstream recommends that we use their officially published binaries, so that is what we are doing, and those binaries have constraints that we can't trivially work around within Debian Stretch and Debian Jessie is still supported within the Debian project (it's just that it's now supported by the LTS team instead of the security and release teams, so to a lesser extent).

Ideally, we'd switch to using the "Portable Linux Binaries" PyPy recommends on their download page (https://github.com/squeaky-pl/portable-pypy#portable-pypy-distribution-for-linux), but those are unfortunately very limited in multi-architecture support, which would be a shame to lose here (and is considered an avenue of absolute last resort only if we absolutely must, as in Debian Jessie is no longer officially supported).

If you wish to use a newer Debian base and are OK with Debian's pypy package, it is trivial for you to do so without our support:

FROM debian:stretch
RUN apt-get update && apt-get install -y pypy

KOLANICH · 2019-01-17T06:53:53Z

If you wish to use a newer Debian base and are OK with Debian's pypy package, it is trivial for you to do so without our support:

I just don't want to maintain a docker image. The good thing in official images is that they are built and maintained by someone else.

tianon · 2019-01-17T06:58:50Z

Have you tried automated builds? They definitely take most of the pain out of maintaining (add repository links and they automatically rebuild on base image updates too).

KOLANICH · 2019-01-17T20:16:38Z

Have you tried automated builds? They definitely take most of the pain out of maintaining (add repository links and they automatically rebuild on base image updates too).

No, I have not heard about this feature. Thank you.

soerenmartius · 2019-03-26T15:25:31Z

seems like we need to update to stretch now. Building the image already fails since the mirrors don't exist anymore.

https://lists.debian.org/debian-devel-announce/2019/03/msg00006.html

soerenmartius · 2019-03-26T17:17:45Z

Get:1 http://security.debian.org jessie/updates InRelease [44.9 kB]
Get:2 http://security.debian.org jessie/updates/main amd64 Packages [822 kB]
Ign http://deb.debian.org jessie InRelease
Ign http://deb.debian.org jessie-updates InRelease
Get:3 http://deb.debian.org jessie Release.gpg [2420 B]
Ign http://deb.debian.org jessie-updates Release.gpg
Get:4 http://deb.debian.org jessie Release [148 kB]
Ign http://deb.debian.org jessie-updates Release
Get:5 http://deb.debian.org jessie/main amd64 Packages [9098 kB]
Err http://deb.debian.org jessie-updates/main amd64 Packages

Err http://deb.debian.org jessie-updates/main amd64 Packages

Err http://deb.debian.org jessie-updates/main amd64 Packages

Err http://deb.debian.org jessie-updates/main amd64 Packages

Err http://deb.debian.org jessie-updates/main amd64 Packages
  404  Not Found
W: Failed to fetch http://deb.debian.org/debian/dists/jessie-updates/main/binary-amd64/Packages  404  Not Found

tianon · 2019-03-26T20:34:25Z

Yep, see debuerreotype/docker-debian-artifacts#66 (comment). We still have a little runway with the Debian LTS project, but not very much.

soerenmartius · 2019-03-26T21:02:31Z

it's a reasonable idea to upgrade the distribution asap. I've been wrapping my head around upgrading to stretch today but end up having some weird issue's with libssl in pypy ( haven't got enough time to dig in properly )

tianon · 2019-03-26T21:26:35Z

Yeah, that's the bit I outlined back in #24 (comment); good to know that's still the case. 😞

tianon · 2019-03-26T21:27:13Z

I wonder if it would be possible for us to rebuild just _pypy_openssl.pypy3-60-x86_64-linux-gnu.so without rebuilding all of PyPy?

tianon · 2019-03-26T22:13:15Z

I've managed to get something that's working pretty successfully for 3.5 and 3.6 via running /usr/local/lib_pypy/_ssl_build.py post-install, but that doesn't work for 2.7 (it appears that on 2.7, pypy itself links directly to libssl.so.1.0.0, unlike on 3.x where it's a separate .so file under lib_pypy that does so and can thus be rebuilt externally).

soerenmartius · 2019-03-26T22:14:03Z

thanks for the heads-up, could you share some code?

tianon · 2019-03-26T22:14:29Z

diff --git a/Dockerfile-slim.template b/Dockerfile-slim.template
index 91a44c6..09c070c 100644
--- a/Dockerfile-slim.template
+++ b/Dockerfile-slim.template
@@ -1,4 +1,4 @@
-FROM debian:jessie-slim
+FROM debian:stretch-slim
 
 # ensure local pypy is preferred over distribution pypy
 ENV PATH /usr/local/bin:$PATH
@@ -31,7 +31,6 @@ RUN set -ex; \
 		bzip2 \
 		wget \
 	; \
-	rm -rf /var/lib/apt/lists/*; \
 	\
 	wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/%%TAR%%-v${PYPY_VERSION}-${pypyArch}.tar.bz2"; \
 	echo "$sha256 *pypy.tar.bz2" | sha256sum -c; \
@@ -42,6 +41,12 @@ RUN set -ex; \
 # smoke test
 	%%CMD%% --version; \
 	\
+# rebuild ffi bits for compatibility with Debian Stretch+ (https://github.com/docker-library/pypy/issues/24#issuecomment-409408657)
+	apt-get install -y --no-install-recommends gcc libc6-dev libssl-dev; \
+	cd /usr/local/lib_pypy; \
+	%%CMD%% _ssl_build.py; \
+# TODO rebuild other cffi modules here too? (other _*_build.py files)
+	\
 	wget -O get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
 	\
 	%%CMD%% get-pip.py \
@@ -58,6 +63,7 @@ RUN set -ex; \
 	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
 	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
 # smoke test again, to be sure
+	rm -rf /var/lib/apt/lists/*; \
 	%%CMD%% --version; \
 	pip --version
 
diff --git a/Dockerfile.template b/Dockerfile.template
index 14ef48e..5e42067 100644
--- a/Dockerfile.template
+++ b/Dockerfile.template
@@ -1,4 +1,4 @@
-FROM buildpack-deps:jessie
+FROM buildpack-deps:stretch
 
 # ensure local pypy is preferred over distribution pypy
 ENV PATH /usr/local/bin:$PATH
@@ -23,14 +23,19 @@ RUN set -ex; \
 # this "case" statement is generated via "update.sh"
 	%%ARCH-CASE%%; \
 	\
-	wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/%%TAR%%-v${PYPY_VERSION}-${pypyArch}.tar.bz2"; \
+	wget -O pypy.tar.bz2 "https://bitbucket.org/pypy/pypy/downloads/%%TAR%%-v${PYPY_VERSION}-${pypyArch}.tar.bz2" --progress=dot:giga; \
 	echo "$sha256 *pypy.tar.bz2" | sha256sum -c; \
 	tar -xjC /usr/local --strip-components=1 -f pypy.tar.bz2; \
 	find /usr/local/lib-python -depth -type d -a \( -name test -o -name tests \) -exec rm -rf '{}' +; \
 	rm pypy.tar.bz2; \
 	\
 # smoke test
-	%%CMD%% --version
+	%%CMD%% --version; \
+	\
+# rebuild ffi bits for compatibility with Debian Stretch+ (https://github.com/docker-library/pypy/issues/24#issuecomment-409408657)
+	cd /usr/local/lib_pypy; \
+	%%CMD%% _ssl_build.py
+# TODO rebuild other cffi modules here too? (other _*_build.py files)
 
 RUN set -ex; \
 	\

wglambert added the Issue label Jun 7, 2018

mlowicki mentioned this issue Jun 14, 2018

Obsolete Debian release is being used docker-library/mongo#280

Closed

wglambert added Request Request for image modification or feature and removed Issue labels Jul 11, 2018

tianon mentioned this issue Jul 31, 2018

Add suite aliases ("pypy:3-jessie", etc) #27

Merged

This comment has been minimized.

Sign in to view

yosifkit mentioned this issue Feb 13, 2019

Update to PyPy 7.0.0 #30

Merged

tianon mentioned this issue Mar 27, 2019

Update PyPy 3.x to Debian Stretch #32

Merged

yosifkit closed this as completed in #32 Mar 28, 2019

pjenvey mentioned this issue Apr 16, 2019

Workaround debian jessie base docker apt-get issues mozilla-services/autopush#1327

Closed

tianon mentioned this issue Apr 10, 2020

pypy 2.7 with a newer Debian release #36

Closed

tianon mentioned this issue Apr 10, 2020

Update to Debian Buster #37

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Obsolete Debian release is being used #24

Obsolete Debian release is being used #24

mlowicki commented Jun 7, 2018

yosifkit commented Jun 11, 2018

mlowicki commented Jun 12, 2018

KOLANICH commented Jul 31, 2018

tianon commented Jul 31, 2018

tianon commented Aug 1, 2018

KOLANICH commented Aug 1, 2018

This comment has been minimized.

tianon commented Jan 17, 2019

KOLANICH commented Jan 17, 2019 •

edited

Loading

tianon commented Jan 17, 2019 via email

KOLANICH commented Jan 17, 2019

soerenmartius commented Mar 26, 2019

soerenmartius commented Mar 26, 2019 •

edited

Loading

tianon commented Mar 26, 2019

soerenmartius commented Mar 26, 2019 •

edited

Loading

tianon commented Mar 26, 2019

tianon commented Mar 26, 2019

tianon commented Mar 26, 2019

soerenmartius commented Mar 26, 2019

tianon commented Mar 26, 2019

Obsolete Debian release is being used #24

Obsolete Debian release is being used #24

Comments

mlowicki commented Jun 7, 2018

yosifkit commented Jun 11, 2018

mlowicki commented Jun 12, 2018

KOLANICH commented Jul 31, 2018

tianon commented Jul 31, 2018

tianon commented Aug 1, 2018

KOLANICH commented Aug 1, 2018

This comment has been minimized.

tianon commented Jan 17, 2019

KOLANICH commented Jan 17, 2019 • edited Loading

tianon commented Jan 17, 2019 via email

KOLANICH commented Jan 17, 2019

soerenmartius commented Mar 26, 2019

soerenmartius commented Mar 26, 2019 • edited Loading

tianon commented Mar 26, 2019

soerenmartius commented Mar 26, 2019 • edited Loading

tianon commented Mar 26, 2019

tianon commented Mar 26, 2019

tianon commented Mar 26, 2019

soerenmartius commented Mar 26, 2019

tianon commented Mar 26, 2019

KOLANICH commented Jan 17, 2019 •

edited

Loading

soerenmartius commented Mar 26, 2019 •

edited

Loading

soerenmartius commented Mar 26, 2019 •

edited

Loading