You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "lhotari (via GitHub)" <gi...@apache.org> on 2024/04/30 08:52:58 UTC
[PR] Set grpcio minimum version to 1.59.3 so that Alpine py3-grpcio can be used [pulsar-client-python]
lhotari opened a new pull request, #211:
URL: https://github.com/apache/pulsar-client-python/pull/211
### Motivation
When using the Alpine base image in Pulsar, there's a need to compile grpcio from source when 1.60.0 version is required. It's better to allow grpcio version 1.59.3 so that Alpine's py3-grpcio can be used to fulfill the requirement.
Please see https://github.com/apache/pulsar/pull/22613 for more context.
### Modifications
- downgrade grpcio dependency to 1.59.3
### Additional context
- there's no specific minimum version constraint originating from pulsar-client-python
- grpcio is required by apache-bookkeeper-client. the dependencies are defined in https://github.com/apache/bookkeeper/blob/master/stream/clients/python/setup.py the version in this file is >= 1.8.2
- the grpcio minimum version was set to 1.60.0 in this commit: https://github.com/apache/pulsar-client-python/commit/162afd53bda321992223cb209a509ee1c46f870a . The referenced CVE requires 1.53.0 , so there doesn't seem to be any reason why we couldn't downgrade to 1.59.3 .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Set grpcio minimum version to 1.59.3 so that Alpine py3-grpcio can be used [pulsar-client-python]
Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on PR #211:
URL: https://github.com/apache/pulsar-client-python/pull/211#issuecomment-2084787805
I suggest using the `1.53.0` as minimum version, just for consider the multiple os.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Set grpcio minimum version to 1.59.3 so that Alpine py3-grpcio can be used [pulsar-client-python]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat merged PR #211:
URL: https://github.com/apache/pulsar-client-python/pull/211
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Set grpcio minimum version to 1.59.3 so that Alpine py3-grpcio can be used [pulsar-client-python]
Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on PR #211:
URL: https://github.com/apache/pulsar-client-python/pull/211#issuecomment-2099685056
Do you have a release plan? If not, the pulsar 3.3.0 arm image will take about 2 hours to build the grpcio wheel, please see https://github.com/nodece/pulsar-python-deps-build/actions/runs/8891459473/job/24418839959#step:6:315 for details.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Set grpcio minimum version to 1.59.3 so that Alpine py3-grpcio can be used [pulsar-client-python]
Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on PR #211:
URL: https://github.com/apache/pulsar-client-python/pull/211#issuecomment-2084925645
> There might be other CVEs.
Good catch, see https://github.com/advisories/GHSA-p25m-jpj4-qcrr
Must be equal to or greater than 1.55.3.
> Which OS do you have in mind?
Now it seems that only alpine-3.18.
For other OS, the users can use the pip to install the grpcio.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Set grpcio minimum version to 1.59.3 so that Alpine py3-grpcio can be used [pulsar-client-python]
Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on PR #211:
URL: https://github.com/apache/pulsar-client-python/pull/211#issuecomment-2097220522
Any updates?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Set grpcio minimum version to 1.59.3 so that Alpine py3-grpcio can be used [pulsar-client-python]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #211:
URL: https://github.com/apache/pulsar-client-python/pull/211#issuecomment-2084844942
> I suggest using the `1.53.0` as minimum version, just for consider the multiple os.
There might be other CVEs. Which OS do you have in mind?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org