Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
* Thomas Goirand z...@debian.org, 2013-10-15, 01:47: Unless something changed recently, Debian buildds don't block Internet access. :( I've read multiple times that they do. Could you show a build log where something is downloaded? The only thing I found[0] is a bit old, but here you go: https://buildd.debian.org/status/fetch.php?pkg=python-ethtoolarch=i386ver=0.7-1stamp=1340805337 http://bugs.debian.org/683174 [0] Unfortunately Google doesn't seem to index Debian build logs. :( Perhaps someone wants to implement buildlogsearch.debian.net? -- Jakub Wilk -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20131015112525.ga...@jwilk.net
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
* Barry Warsaw ba...@debian.org, 2013-10-11, 11:03: The point of this recommendation is so that missing Build-Depends are exposed when you are testing your package builds locally. ACK If you omit them, your package will still properly FTBFS, but only on the buildds. Unless something changed recently, Debian buildds don't block Internet access. :( -- Jakub Wilk -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20131014112335.ga3...@jwilk.net
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On 10/14/2013 07:23 PM, Jakub Wilk wrote: * Barry Warsaw ba...@debian.org, 2013-10-11, 11:03: The point of this recommendation is so that missing Build-Depends are exposed when you are testing your package builds locally. ACK If you omit them, your package will still properly FTBFS, but only on the buildds. Unless something changed recently, Debian buildds don't block Internet access. :( I've read multiple times that they do. Could you show a build log where something is downloaded? Thomas -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/525c2e23.6040...@debian.org
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On Tue, Oct 15, 2013 at 1:47 AM, Thomas Goirand wrote: I've read multiple times that they do. Could you show a build log where something is downloaded? At around 24:30 in the DebConf13 cross-compiler BoF a discussion about -source packages, build-depends on foo:src/foo:build-deps and apt-get source during builds was started. At 28:28 Helmut Grohne claimed that there is a plan to enable network namespaces on the Linux buildds and afterwards it was claimed by Colin Watson at 28:48 that some parts of d-i rely on being able to download stuff during the build and would be broken by that. No idea which package he meant though. https://penta.debconf.org/dc13_schedule/events/1020.en.html http://meetings-archive.debian.net/pub/debian-meetings/2013/debconf13/webm-high/1020_Cross_compilers_in_Debian.webm -- bye, pabs http://wiki.debian.org/PaulWise -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/CAKTje6FbdKh9=upenhe4qjgo4v_0x_l1-1nipefezg3m3xv...@mail.gmail.com
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On Tue, Oct 15, 2013 at 11:20:50AM +0800, Paul Wise wrote: On Tue, Oct 15, 2013 at 1:47 AM, Thomas Goirand wrote: I've read multiple times that they do. Could you show a build log where something is downloaded? At around 24:30 in the DebConf13 cross-compiler BoF a discussion about -source packages, build-depends on foo:src/foo:build-deps and apt-get source during builds was started. At 28:28 Helmut Grohne claimed that there is a plan to enable network namespaces on the Linux buildds and afterwards it was claimed by Colin Watson at 28:48 that some parts of d-i rely on being able to download stuff during the build and would be broken by that. No idea which package he meant though. He meant the package 'debian-installer', which assembles d-i images from udebs downloaded from the network. You cannot build-depend on udebs, they are not installable on a full system; so they must be downloaded from the mirror. -- Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. Ubuntu Developerhttp://www.debian.org/ slanga...@ubuntu.com vor...@debian.org signature.asc Description: Digital signature
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On Oct 12, 2013, at 01:03 PM, Thomas Goirand wrote: On 10/12/2013 11:33 AM, Scott Kitterman wrote: On Saturday, October 12, 2013 11:26:28 Thomas Goirand wrote: On 10/12/2013 01:26 AM, Barry Warsaw wrote: On Oct 11, 2013, at 07:23 PM, Julian Taylor wrote: It is better if one disables internet access of package builds completely. With pbuilder and iptables this is very easy, just run this when booting: iptables -I OUTPUT ! -d 127.0.0.1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp-port-unreachable ip6tables -I OUTPUT ! -d ::1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp6-port-unreachable (It works because pbuilder builds as user 1234, won't work for --login sessions) And if you don't use pbuilder? :) -Barry Well, if you don't, you should! :) /troll IIRC Barry uses sbuild, so I think you missed his point. I was just trying to be funny, and wasn't following any point... :) What's the point of that? :) M-x doctor RET-ly y'rs, -Barry signature.asc Description: PGP signature
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
[Ben Finney, 2013-10-11]
I've received conflicting advice on how to deal with Distribute's eagerness
at connecting to the internet during package builds.
On 10-Dec-2012, Barry Warsaw wrote:
Also, please put this near the top of your d/rules file:
-snip snip-
# Prevent setuptools/distribute from accessing the internet.
export http_proxy = http://127.0.9.1:9
-snip snip-
This should probably be mandatory for any distutils based package. ;)
On 11-Oct-2013, Thomas Goirand wrote:
I don't agree with adding:
export http_proxy = http://127.0.9.1:9
on top of debian/rules. The reason is that, by doing this, you are hiding
problems. If a python package downloads something using pip or anything
else, it most likely means that you forgot a build-depends. […]
So remove it, and if during the build process something tries to download
a python package, then you need to simply fix your build-depends.
I'm open to discussions on this very subject though.
Thanks to both Barry and Thomas for taking this seriously.
Currently I tend to agree with Barry's advice. Successfully downloading a
if you set http_proxy to a non existing proxy, setuptools/distribute
will still try to download stuff from internet, the only difference is
it will fail this time so setting it is not hiding problems, it's
exposing them.
Note that pybuild is doing it by default (if http{,s}_proxy is not set),
so with --buildsystem=pybuild you will expose missing build dependencies
*and* let get-orig-source work (pybuild doesn't set http_proxy in this
target). If you for some reason need network during build (f.e. tests
setup a HTTP server), just set http_proxy to empty string, in src:flask
I do this:
override_dh_auto_test:
http_proxy='' dh_auto_test
--
Piotr Ożarowski Debian GNU/Linux Developer
www.ozarowski.pl www.griffith.cc www.debian.org
GPG Fingerprint: 1D2F A898 58DA AF62 1786 2DF7 AEF6 F1A2 A745 7645
--
To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20131011102124.gc12...@p1otr.com
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
Le 11/10/13 12:21, Piotr Ożarowski a écrit : override_dh_auto_test: http_proxy='' dh_auto_test You ight want to set https_proxy='' as well. -- Antoine hashar Musso -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/5257dccd.9060...@free.fr
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On Oct 11, 2013, at 03:39 PM, Ben Finney wrote: Currently I tend to agree with Barry's advice. Successfully downloading a package from the internet during a long package build is hiding dependency problems, and setting the HTTP proxy so that it fails is going to make that problem easier to notice. Note that the recommendation should be updated to *also* disable https_proxy since modern setuptools is now (thankfully) preferring https. The point of this recommendation is so that missing Build-Depends are exposed when you are testing your package builds locally. If you omit them, your package will still properly FTBFS, but only on the buildds. This is more evident in Ubuntu where we only upload source packages, and the buildds deliberately disable internet access. You'd like to find these errors early when you're doing local test builds (e.g. via sbuild in my case). As Piotr points out, pybuild sets both proxies automatically, which I think is great. I have it on my List to update the LibraryStyleGuide on the wiki to nudge people toward pybuild. I may get to that after Ubuntu 13.10 is released. Cheers, -Barry signature.asc Description: PGP signature
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On Oct 11, 2013, at 12:21 PM, Piotr Ożarowski wrote:
Note that pybuild is doing it by default (if http{,s}_proxy is not set),
so with --buildsystem=pybuild you will expose missing build dependencies
*and* let get-orig-source work (pybuild doesn't set http_proxy in this
target). If you for some reason need network during build (f.e. tests
setup a HTTP server), just set http_proxy to empty string, in src:flask
I do this:
override_dh_auto_test:
http_proxy='' dh_auto_test
Ah yes of course. I've had to override it in get-orig-source and occasionally
in the tests. Really happy to hear that pybuild DTRT.
-Barry
--
To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/2013100428.7f5bdafb@anarchist
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On 11.10.2013 17:04, Barry Warsaw wrote:
On Oct 11, 2013, at 12:21 PM, Piotr Ożarowski wrote:
Note that pybuild is doing it by default (if http{,s}_proxy is not set),
so with --buildsystem=pybuild you will expose missing build dependencies
*and* let get-orig-source work (pybuild doesn't set http_proxy in this
target). If you for some reason need network during build (f.e. tests
setup a HTTP server), just set http_proxy to empty string, in src:flask
I do this:
override_dh_auto_test:
http_proxy='' dh_auto_test
Ah yes of course. I've had to override it in get-orig-source and occasionally
in the tests. Really happy to hear that pybuild DTRT.
-Barry
while I think doing it in the helper tools is a good idea, one shouldn't rely
on it.
It is better if one disables internet access of package builds completely.
With pbuilder and iptables this is very easy, just run this when booting:
iptables -I OUTPUT ! -d 127.0.0.1 -m owner --gid-owner 1234 -j REJECT
--reject-with icmp-port-unreachable
ip6tables -I OUTPUT ! -d ::1 -m owner --gid-owner 1234 -j REJECT --reject-with
icmp6-port-unreachable
(It works because pbuilder builds as user 1234, won't work for --login sessions)
--
To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/52583425.6010...@googlemail.com
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On Oct 11, 2013, at 07:23 PM, Julian Taylor wrote: It is better if one disables internet access of package builds completely. With pbuilder and iptables this is very easy, just run this when booting: iptables -I OUTPUT ! -d 127.0.0.1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp-port-unreachable ip6tables -I OUTPUT ! -d ::1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp6-port-unreachable (It works because pbuilder builds as user 1234, won't work for --login sessions) And if you don't use pbuilder? :) -Barry -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20131011132625.7632847b@anarchist
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On 10/12/2013 01:26 AM, Barry Warsaw wrote: On Oct 11, 2013, at 07:23 PM, Julian Taylor wrote: It is better if one disables internet access of package builds completely. With pbuilder and iptables this is very easy, just run this when booting: iptables -I OUTPUT ! -d 127.0.0.1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp-port-unreachable ip6tables -I OUTPUT ! -d ::1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp6-port-unreachable (It works because pbuilder builds as user 1234, won't work for --login sessions) And if you don't use pbuilder? :) -Barry Well, if you don't, you should! :) /troll Thomas -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/5258c164.2020...@debian.org
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On Saturday, October 12, 2013 11:26:28 Thomas Goirand wrote: On 10/12/2013 01:26 AM, Barry Warsaw wrote: On Oct 11, 2013, at 07:23 PM, Julian Taylor wrote: It is better if one disables internet access of package builds completely. With pbuilder and iptables this is very easy, just run this when booting: iptables -I OUTPUT ! -d 127.0.0.1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp-port-unreachable ip6tables -I OUTPUT ! -d ::1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp6-port-unreachable (It works because pbuilder builds as user 1234, won't work for --login sessions) And if you don't use pbuilder? :) -Barry Well, if you don't, you should! :) /troll IIRC Barry uses sbuild, so I think you missed his point. Scott K -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/230.SL2RIH18Y6@scott-latitude-e6320
Re: Using ‘export http_proxy = http://127.0.9.1:9/’ to fail noisily on dependency problems
On 10/12/2013 11:33 AM, Scott Kitterman wrote: On Saturday, October 12, 2013 11:26:28 Thomas Goirand wrote: On 10/12/2013 01:26 AM, Barry Warsaw wrote: On Oct 11, 2013, at 07:23 PM, Julian Taylor wrote: It is better if one disables internet access of package builds completely. With pbuilder and iptables this is very easy, just run this when booting: iptables -I OUTPUT ! -d 127.0.0.1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp-port-unreachable ip6tables -I OUTPUT ! -d ::1 -m owner --gid-owner 1234 -j REJECT --reject-with icmp6-port-unreachable (It works because pbuilder builds as user 1234, won't work for --login sessions) And if you don't use pbuilder? :) -Barry Well, if you don't, you should! :) /troll IIRC Barry uses sbuild, so I think you missed his point. I was just trying to be funny, and wasn't following any point... :) Thomas -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/5258d814.7020...@debian.org
