openstack team mailing list archive

[Thierry Carrez <thierry@xxxxxxxxxxxxx>]

Gabriel Hurley wrote:
> As for packages, I can’t speak to Fedora offhand, but Ubuntu has the
> “nodejs” package which is what we’ve used internally for development and
> for the devstack gate going forward. The LESS binary itself is being
> bundled with Horizon to alleviate versioning incompatibilities and
> package differences across OS’s.

Bundling code maintained in other projects in our own code is bad
practice. Code duplication makes us responsible for bug fixing and more
importantly security vulnerability tracking on code we didn't write and
don't maintain.

Is that the only solution ? Could you give more details on the "package
differences" that forced you to go this way ? In particular, why are you
fine depending on node.js from distros but not from LESS from distros ?

NB: I made the same comment directly on
https://review.openstack.org/#/c/7367/

Cheers,

-- 
Thierry Carrez (ttx)
Release Manager, OpenStack