samba - Feb 2021 - samba-4.14.0rc2 is presenting dependency problems on EL7

It looks like 4.14 is presenting dependency issues to compile for EL7.
Additional python dependencies, such python3-gpg, are awkward to build
because of excess dependency chains for gpgme

The question in my mind is "do I bother continuing to backport 4.14 to
EL 7". Maintaining such dependencies is always an adventure. But
CentOS 8 has just gotten peculiar. CentOS 8, from a policy decided
with no advance announcement to the user community, is now only
published as a beta platform for RHEL, and will no longer have any
certainty of any particular package being compatible with RHEL. That
makes publishing RPMs..... nasty, and I expect real trouble with EPEL
packages and potentially with Samba packages due to the inherent risk
of compiling security and performance critical packages with beta
software that can be updated arbitrarily and incompatibly at any time.

So, I'd welcome thoughts as to whether continuing EL 7 backports is
worth the work. It's already proven awkward with the gnutls
requirements. I'm hesitant to introduce another dependency chain with
python3-gpg and gpgme.

On Sun, 2021-02-07 at 20:01 -0500, Nico Kadel-Garcia via samba
wrote:
> It looks like 4.14 is presenting dependency issues to compile for EL7.
> Additional python dependencies, such python3-gpg, are awkward to build
> because of excess dependency chains for gpgme
> 
> The question in my mind is "do I bother continuing to backport 4.14 to
> EL 7". Maintaining such dependencies is always an adventure. But
> CentOS 8 has just gotten peculiar. CentOS 8, from a policy decided
> with no advance announcement to the user community, is now only
> published as a beta platform for RHEL, and will no longer have any
> certainty of any particular package being compatible with RHEL. That
> makes publishing RPMs..... nasty, and I expect real trouble with EPEL
> packages and potentially with Samba packages due to the inherent risk
> of compiling security and performance critical packages with beta
> software that can be updated arbitrarily and incompatibly at any time.
I do agree this looks like being quite a challenge.  I expect more
bumps in this road over the next little while.
> So, I'd welcome thoughts as to whether continuing EL 7 backports is
> worth the work. It's already proven awkward with the gnutls
> requirements. I'm hesitant to introduce another dependency chain with
> python3-gpg and gpgme.
First, I want to say a big thanks for all your efforts. 

GPG support has always been optional, so I would just build without it
rather than abandon the whole effort, if they cause too much trouble. ?

See --without-gpgme

We also don't (but should) even check for python3-gpg at build time, as
far as I can tell. 

For many administrators, the facility provided by the GPG support can
be achieved via the password hash userPassword schemes option which
hashes (rather than GPG encrypts) as password change time. 

Andrew Bartlett

-- 
Andrew Bartlett (he/him)        https://samba.org/~abartlet/
Samba Team Member (since 2001)  https://samba.org
Samba Developer, Catalyst IT    https://catalyst.net.nz/services/samba