On Fri, 28 Sep 2018 at 22:42, Milosz Wasilewski <milosz.wasilewski@linaro.org> wrote:

I made a first attempt to add REST API for some LAVA objects (jobs,
devices and device types). The API is very rudimentary but already
solves some basic job filtering issues. However I'm not sure how to
add dependencies. There are 2 packages required for this code to work
properly. Pip packages are named 'djangorestframework'  and
'djangorestframework-filters'. Former has a corresponding debian
package 'python3-djangorestframework' but the later does not. Any
hints how to add proper dependencies to LAVA?

"""If your change introduces a dependency on a new python module, always ensure that this module is available in Debian by searching the Debian package lists. If the module exists but is not in the current stable release of Debian, it can be backported but be aware that this will delay testing and acceptance of your change. It is expressly not acceptable to add a dependency on a python module which is only available using pypi or pip install. Introducing such a module to Debian can involve a large amount of work - talk to us before spending time on code which relies on such modules or which relies on newer versions of the modules than are currently available in Debian testing."""

This would be a blocker for this merge request. The packaging work would have to be done first before the CI could work.
The package which does exist in Debian can be added to the requirements as part of the merge request:

The files for stretch, buster and unstable need the package to be listed. (The syntax for this is recent, it still needs a tweak in the docs.)

    name: python3-yaml

Python module name:
    name: Debian package name for Python3

If you need a specific version, that can be specified, follow the examples. Note that stretch needs to be supportable with that version.

See the allauth merge request for an example: https://git.lavasoftware.org/lava/lava/merge_requests/3/diffs

Pip cannot be supported directly. (Mixing virtualenv and packaging is not acceptable, it introduces version conflicts in the dependency chain.)

Adding a package to Debian involves a maintenance burden for that package which the team would have to be able to accept for the lifetime of at least Debian Buster (due for release Q2 2019, supported until ~2022). Django packages tend to be more complex than dependencies added for lava-dispatcher - security fixes et al. It's not impossible, we have added django-restricted-resource, but it depends on the expected usage (how many other packages and users in Debian are going to start using it and filing bugs etc.) and how complex it is to work with the package.

If there is a way to avoid using this module, it should be explored. If it needs to be added, there will be a delay until it's available (it would need to get through to stretch-backports to be part of a production release). Adding new python packages to Debian involves adding them as Python3 and for django modules, with Django moving to Django2.0 soon, Python2 support is not worth adding. If you have other use cases for this package, it is probably worth adding the package to Debian.


The code can be found here:

Lava-users mailing list