Distributions

Fedora's Node.js problem

Aligning distribution and major package schedules is often something of a tricky balancing act. Fedora is currently doing some of that; it is trying to figure out what to with its Node.js package for Fedora 24. Node.js 5.10 is currently packaged for Fedora 24, but that release will only be supported until mid-year, which would mean that Fedora developers would have to backport security fixes for as long as a year. But the most recent release (6.0) came out on April 26 and may not yet support all of the other dependent packages, which puts Fedora somewhere between a rock and a hard place.

Current Node.js package maintainer Stephen Gallagher posted a message about the problem on the release day for Node.js 6.0. That release is a "significant ABI-breaking release, which means there is no guarantee that existing modules will work with it at all", he said. That release is slated to become the next long-term support release in October—on paper, that would make it a good choice for Fedora 24, since it will be supported until 2019. But Fedora 24 is nearly out the door, with a final freeze scheduled for the end of May and the release in mid-June. So, any change, especially one that could break all of the packages dependent on Node.js, is worrisome—at best.

Currently, Fedora 24 has Node.js 5.x, but that will be unsupported by the Node.js developers relatively soon. One option would be to stick with that, but once Fedora 24 is released, the project's policy of disallowing major ABI changes in a stable release would mean that Fedora has to pick up the maintenance burden. Gallagher put it this way:

Another option might be to fall back to Node.js 4.x, which was released in October 2015 and will be supported until well after the end of life for Fedora 24, but that is not without potential problems as well. Any of the dependent packages that have started using features from 5.x may not work. It all adds up to no "particularly good options", he said.

No one in the resulting thread seemed to like the "stick with 5.x" option. There was some talk of just abandoning 5.x and moving to 6.x sometime around October, but that would require Fedora Engineering Steering Committee (FESCo) approval and would set something of a bad precedent. But "drago01" thought that concerns about upgrading the package during the release cycle were based on a misunderstanding of the update policy, which says that it is possible to upgrade when an upstream stops supporting a release if backporting fixes "would be impractical". The definition of "practical" is up to the packager and FESCo.

Gallagher pointed out that the policy is likely changing, however:

Tom Hughes noted that there actually might not be any problem falling back to 4.x, since most packages try to support both 4.x and 5.x. Gallagher confirmed that by querying the package repository:

The beta release of Fedora 24 is targeted for May 10, so the regression to 4.x would happen after that. But if the repository metadata is accurate, there should be few repercussions to making the switch. Gallagher announced that plan on April 28 and asked Node.js users to test with the new package he had built.

There was also some discussion of which Node.js branches should be used in the future. Hughes asked if it would ever make sense to use versions without long-term support given Fedora's thirteen-month support cycle. Gallagher replied that it turns out those releases are generally only supported for nine months or so, which means that Fedora should always ship the long-term support releases. That seems to be the plan moving forward.

In the end, it would seem that it will be a fairly painless transition, even if it looked like there were only ugly choices at the start. As part of its general philosophy, Fedora targets the newest releases of packages, which is presumably why Node.js 5.x got picked up in the first place. But the burden of maintaining an unsupported release, especially for an internet-facing package like Node.js, is quite large. Better to distribute an older version than to risk exposing Fedora Node.js users to the vulnerabilities that will undoubtedly be uncovered during the life of Fedora 24.

Comments (6 posted)

Devuan Jessie beta released

Full Story (comments: 370)

The Linux Embedded Development Environment launches

Full Story (comments: 16)

Distribution newsletters

• DistroWatch Weekly, Issue 659 (May 2)
• Lunar Linux weekly news (April 29)
• Ubuntu Kernel Team weekly newsletter (May 3)
• Ubuntu Weekly Newsletter, Issue 463 (May 1)

Comments (none posted)

Ubuntu 16.04 Review: What’s New for Desktop Users (Linux.com)

Comments (none posted)