Re: Does Guix provide security support for Python2? For how long?

[zimoun]

Hi,

On Fri, 15 Jan 2021 at 18:18, Jorge P. de Morais Neto
<jorge+list@disroot.org> wrote:
> Em [2021-01-15 sex 18:07:40+0100], zimoun escreveu:
>
> > As far as I know, Guix provides the security support that upstream
> > releases.
>
> I too suppose so in general.  But I would like a more authoritative
> answer for the specific case of Python2.  And, in fact, this should be
> publicly documented---in the manual or in the website, as well as the
> description of the python2 package and maybe also in the description of
> all python2-.* packages.

As far I know, Python 2 is End Of Life and not supported upstream.
Therefore, if your question is: will Guix people fix Python 2
security?  Then the answer is no.
However, please indicate if an organization is still maintaining
Python 2 and maybe Guix could package their release.


> > Using the Guix time-machine, the code that works now should work
> > exactly the same in the future, even if Python 2 is removed in the
> > future Guix releases.  Does it make sense?
>
> The problem is that OfflineIMAP is Internet software, and therefore, I
> believe, it is important to have security support for it (including its
> dependencies).

In this case, please consider to switch from OfflineIMAP to something else.
Guix is about packaging, not supporting security from deprecated upstream.

All the best,
simon