Thoughts on using pyuwsgi?

[fopinappb]

What do you guys think of using https://pypi.org/project/pyuwsgi/ wheel instead of uwsgi?
Same source just that this one is packaged with built binaries and uwsgi is currently the requirement that takes the longest to install

Not many stars - https://github.com/lincolnloop/pyuwsgi-wheels
But maintained by active web development company (not sure about its reputation)

[valentijnscholten]

I share the frustration of the slow build step of uwsgi, but for a high profile project also used in a Pro SAAS environment we probably cannot just use the provided alternative by an "unknown" company. They may lag behind on (security) releases. They haven't released uwsgi 2.0.31 which was released 10+ weeks ago. Wdyt @mtesauro

[valentijnscholten]

In the past I have tried to use https://packages.debian.org/bullseye/uwsgi-core and https://pkgs.alpinelinux.org/package/edge/main/x86/uwsgi and debian/alpine provided python3 plugins for those. But I couldn't get pip to stop building the wheels.

[mtesauro]

I share the frustration of the slow build step of uwsgi, but for a high profile project also used in a Pro SAAS environment we probably cannot just use the provided alternative by an "unknown" company. They may lag behind on (security) releases. They haven't released uwsgi 2.0.31 which was released 10+ weeks ago. Wdyt @mtesauro

It's something we can consider but given the size of our community, we're not going to swap out a critical and central part of DefectDojo without a lot of prep work and testing.

I'm curious if build time is the only reason so move to pyuwsgi? If the project is going to risk future bugs and downtime for the community, having a concrete list of benefits would really help.

As a dev, I've always preferred starting as close to 'the iron' as possible so having pre-built binaries is going to be faster, you don't control how those are built so you loose a bit of control over how your app is built.

For people just wanting to use DefectDojo, we have pre-built images in Docker hub so build time isn't an issue for them.

So, with what's in this thread, I don't see a compelling reason to change from our current use of uwsgi but I'm open to hearing why I'm missing some reasons to rethink that.

[valentijnscholten]

One way to get rid of the custom compilation is to use the system packages provided by Debian/Alpine: #13999

[fopina]

What about a simpler alternative of just building and publishing the wheel from a dojo-owned repo?

It's clearly dead so it shouldn't take any maintenance, just build once, publish and it'll be used everytime.

It will only require rebuilding whenever python version changes.

Happy to take a look into setting that up in some repository and then handing it over to the org, if that sounds good

[valentijnscholten]

You mean the pyuwsgi wheel or the uwsgi wheel? The latter is already pre-built and distributed via our pre-built Docker images.

[fopina]

I meant the uwsgi so building the image would be faster, but you’re right, actually previous images can be used to copy the wheel in a separate stage, I’ll use that.
Thanks