Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-11-01 Thread Emmanuel Charpentier
Dear Karl-Dieter (IIRC, apologies if not...) I saw your comments to my answer to William. It gives useful points, but I need more time to propose a consistent solution. One more (side) point : I think that what is called currently statistics is currently evolving to become a discipline aiming a

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-11-01 Thread kcrisman
> Nobody is suggesting deprecating the potential to use Sage+R. >> > > That's replacing "It's there" by "It can be done". Not the same thing... > unless you're a theologian or a politician. > > Thank you. > > A third point, distinct from the previous two, is that William deems the > current

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-31 Thread Emmanuel Charpentier
A couple of quick notes ; consistent answer to follow (not soon, alas...) : Le mardi 1 novembre 2016 03:23:41 UTC+1, William a écrit : > > On Mon, Oct 31, 2016 at 6:58 PM, kcrisman > > wrote: > > All I know is this: > > > > 1) We have "sold" a lot of Sage by saying it's all in there, and at >

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-31 Thread William Stein
On Mon, Oct 31, 2016 at 6:58 PM, kcrisman wrote: > All I know is this: > > 1) We have "sold" a lot of Sage by saying it's all in there, and at least > some people have used Sage+R effectively. Estimates of how many vary > wildly. But non-zero. Nobody is suggesting deprecating the potential to u

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-31 Thread kcrisman
All I know is this: 1) We have "sold" a lot of Sage by saying it's all in there, and at least some people have used Sage+R effectively. Estimates of how many vary wildly. But non-zero. 2) rpy2 might be there, but as far as I can tell most people who've used Sage+R use it via the "dumb pexpect

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-30 Thread William Stein
On Sunday, October 30, 2016, Emmanuel Charpentier < emanuel.charpent...@gmail.com> wrote: > Dear William, > > Sorry to have sounded frightened by *you* : I'm frightened by the amount > of *my* ignorance... > > Since it seems that I'm (almost) alone among Sage users to be interested > by the develo

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-30 Thread William Stein
On Sunday, October 30, 2016, William Stein wrote: > On Sun, Oct 30, 2016 at 12:09 PM, Emmanuel Charpentier > > wrote: > > Dear William, > > > > thanks for this advice, which I'll consider seriously, notwithstanding > its > > total opacity to me at the moment > > > > I just checked that the r

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-28 Thread Emmanuel Charpentier
Le vendredi 28 octobre 2016 13:13:10 UTC+2, Jean-Pierre Flori a écrit : > > > > On Friday, October 28, 2016 at 12:33:42 PM UTC+2, Emmanuel Charpentier > wrote: >> >> I just checked (by installation on a virtual machine) that a *virgin* >> (base + destktop + usual utilities) debian stable (jessi

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-28 Thread Jean-Pierre Flori
On Friday, October 28, 2016 at 12:33:42 PM UTC+2, Emmanuel Charpentier wrote: > > I just checked (by installation on a virtual machine) that a *virgin* > (base + destktop + usual utilities) debian stable (jessie) has openssl > installed. Tentatively asking for its removal (apt-get remove -s op

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-28 Thread Emmanuel Charpentier
I just checked (by installation on a virtual machine) that a *virgin* (base + destktop + usual utilities) debian stable (jessie) has openssl installed. Tentatively asking for its removal (apt-get remove -s openssl) tells that it would remove a ton of system utilities. The same is true on testin

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-28 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 8:15:38 PM UTC+2, kcrisman wrote: > > > So either they will stop distribute R or they will patch >>> en-masse. >>> >> >> Somehow, I doubt it. >> >> > Probably nobody even bothered to notice or notify e.g. Debian? > > I think people at Debian ar well aware of suc

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread kcrisman
> So either they will stop distribute R or they will patch >> en-masse. >> > > Somehow, I doubt it. > > Probably nobody even bothered to notice or notify e.g. Debian? Thanks for working on this; how annoying. -- You received this message because you are subscribed to the Google Groups "sag

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 5:28:41 PM UTC+2, William wrote: > > On Thu, Oct 27, 2016 at 8:25 AM, Jean-Pierre Flori > wrote: > > > > > > On Thursday, October 27, 2016 at 5:16:02 PM UTC+2, Jean-Pierre Flori > wrote: > >> > >> But you're right, by default Debian links to openssl: > >>

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread William Stein
On Thu, Oct 27, 2016 at 8:25 AM, Jean-Pierre Flori wrote: > > > On Thursday, October 27, 2016 at 5:16:02 PM UTC+2, Jean-Pierre Flori wrote: >> >> But you're right, by default Debian links to openssl: >> https://packages.debian.org/sid/libcurl3 >> >> And indeed curl is not GPL anyway: >> https://cu

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 5:23:58 PM UTC+2, William wrote: > > Hi, > > > > We've been down this road before with Sage, and it's pretty annoying. > I've personally wasted hundreds of hours on it (GNUtls, openssl, etc.) > Programmers playing lawyers have ended up with a broken and > i

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 5:16:02 PM UTC+2, Jean-Pierre Flori wrote: > > But you're right, by default Debian links to openssl: > https://packages.debian.org/sid/libcurl3 > > And indeed curl is not GPL anyway: > https://curl.haxx.se/docs/copyright.html > Groumpf. > See https://curl.haxx.s

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 5:18:40 PM UTC+2, Emmanuel Charpentier wrote: > > > > Le jeudi 27 octobre 2016 17:00:05 UTC+2, Jean-Pierre Flori a écrit : >> >> >> >> On Thursday, October 27, 2016 at 4:59:02 PM UTC+2, Jean-Pierre Flori >> wrote: >>> >>> >>> >>> On Thursday, October 27, 2016 at

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread William Stein
Hi, We've been down this road before with Sage, and it's pretty annoying. I've personally wasted hundreds of hours on it (GNUtls, openssl, etc.) Programmers playing lawyers have ended up with a broken and inconsistent legal foundation. There is no easy way out, since only copyright owners can c

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
But you're right, by default Debian links to openssl: https://packages.debian.org/sid/libcurl3 And indeed curl is not GPL anyway: https://curl.haxx.se/docs/copyright.html Groumpf. See https://curl.haxx.se/legal/distro-dilemma.html for more rumbling. Now what if a GPL application links to libcurl

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Emmanuel Charpentier
Le jeudi 27 octobre 2016 17:00:05 UTC+2, Jean-Pierre Flori a écrit : > > > > On Thursday, October 27, 2016 at 4:59:02 PM UTC+2, Jean-Pierre Flori wrote: >> >> >> >> On Thursday, October 27, 2016 at 4:49:23 PM UTC+2, Emmanuel Charpentier >> wrote: >>> >>> >>> >>> Le jeudi 27 octobre 2016 16:04:52

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Emmanuel Charpentier
Le jeudi 27 octobre 2016 16:59:02 UTC+2, Jean-Pierre Flori a écrit : > > > > On Thursday, October 27, 2016 at 4:49:23 PM UTC+2, Emmanuel Charpentier > wrote: >> >> >> >> Le jeudi 27 octobre 2016 16:04:52 UTC+2, Jean-Pierre Flori a écrit : >>> >>> >>> >>> On Thursday, October 27, 2016 at 3:59:26

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 4:59:02 PM UTC+2, Jean-Pierre Flori wrote: > > > > On Thursday, October 27, 2016 at 4:49:23 PM UTC+2, Emmanuel Charpentier > wrote: >> >> >> >> Le jeudi 27 octobre 2016 16:04:52 UTC+2, Jean-Pierre Flori a écrit : >>> >>> >>> >>> On Thursday, October 27, 2016 at 3

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 4:49:23 PM UTC+2, Emmanuel Charpentier wrote: > > > > Le jeudi 27 octobre 2016 16:04:52 UTC+2, Jean-Pierre Flori a écrit : >> >> >> >> On Thursday, October 27, 2016 at 3:59:26 PM UTC+2, Emmanuel Charpentier >> wrote: >>> >>> >>> >>> Le jeudi 27 octobre 2016 13:1

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Emmanuel Charpentier
Le jeudi 27 octobre 2016 16:04:52 UTC+2, Jean-Pierre Flori a écrit : > > > > On Thursday, October 27, 2016 at 3:59:26 PM UTC+2, Emmanuel Charpentier > wrote: >> >> >> >> Le jeudi 27 octobre 2016 13:10:17 UTC+2, François a écrit : >>> >>> It is a most interesting point because it explain why >>>

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 3:59:26 PM UTC+2, Emmanuel Charpentier wrote: > > > > Le jeudi 27 octobre 2016 13:10:17 UTC+2, François a écrit : >> >> It is a most interesting point because it explain why >> the R binary installed from epel for RH7.1 and family >> isn’t linked to openssl. >

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
Building R against a ssl-less libcurl works (modulo patching configure) and does not seem to add errors into R's test suite. So I suggest the following: [123]: * add curl as a standard package and let it use ssl if present except when making dist tarballs (ticket needs some tweaking in case of di

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Emmanuel Charpentier
Le jeudi 27 octobre 2016 13:10:17 UTC+2, François a écrit : > > It is a most interesting point because it explain why > the R binary installed from epel for RH7.1 and family > isn’t linked to openssl. > How old is RH7.1 ? The introduction of the libcurl requirement dates from the R 3.3.0 rel

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Francois Bissey
It is a most interesting point because it explain why the R binary installed from epel for RH7.1 and family isn’t linked to openssl. If they don’t have a rock solid argument, and even if they have, there may not be anymore official R packages from big league binary distros. Unless they patch R, t

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 12:31:00 PM UTC+2, Jeroen Demeyer wrote: > > On 2016-10-27 12:24, Francois Bissey wrote: > > While not configurable by the user in R-3.2.x it would build if > > libcurl wasn’t found or missing https support. > > The change to bail out if you don’t fulfil all th

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Emmanuel Charpentier
Le jeudi 27 octobre 2016 12:28:57 UTC+2, Jean-Pierre Flori a écrit : > > > > On Thursday, October 27, 2016 at 12:22:37 PM UTC+2, Emmanuel Charpentier > wrote: >> >> I'm afraid that we don't have much say in the matter : the R core >> development team has choosen to rely on curl, and their build

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jeroen Demeyer
On 2016-10-27 12:24, Francois Bissey wrote: While not configurable by the user in R-3.2.x it would build if libcurl wasn’t found or missing https support. The change to bail out if you don’t fulfil all the condition appear deliberate to me. And I see the point from a support point of view. My co

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 12:22:37 PM UTC+2, Emmanuel Charpentier wrote: > > I'm afraid that we don't have much say in the matter : the R core > development team has choosen to rely on curl, and their build system will > fail without it. Furthermore, among those 9402 packages, a lot of

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Francois Bissey
While not configurable by the user in R-3.2.x it would build if libcurl wasn’t found or missing https support. The change to bail out if you don’t fulfil all the condition appear deliberate to me. And I see the point from a support point of view. My conclusion is that R developers would fill it a

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Emmanuel Charpentier
I'm afraid that we don't have much say in the matter : the R core development team has choosen to rely on curl, and their build system will fail without it. Furthermore, among those 9402 packages, a lot of them may have choosen to follow R "guidance" an use CURL. If we choose to use another lib

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 12:02:42 PM UTC+2, Jeroen Demeyer wrote: > > On 2016-10-27 11:49, Jean-Pierre Flori wrote: > > > > > > On Thursday, October 27, 2016 at 11:41:20 AM UTC+2, Jeroen Demeyer > wrote: > > > > On 2016-10-27 11:29, Francois Bissey wrote: > > > R package s

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Emmanuel Charpentier
Le jeudi 27 octobre 2016 11:29:12 UTC+2, François a écrit : > > R package system include downloading facility from repositories. > That’s why you need curl. At least in theory. > In practice, web access to (a lot of) data repositories, databases, etc... is more and more used : there is no poi

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Francois Bissey
My own examination of R-3.3.1 configure script is that configure will fail if libcurl 7.28+ is not present or present with ssl disabled [m4/R.m4 line 4215 thereafter]. Unless the code for `install.package` has significantly changed between 3.2.x and 3.3.x it is an unnecessary failure dictated by an

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Emmanuel Charpentier
As of this morning, CRAN offered 9402 packages... These packages offer practical implementations for a tremendous list of applied statistics problems (and more...). Using R "without its packaging system" is about as useful as using Python without pip or any other Python packaging system... --

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jeroen Demeyer
On 2016-10-27 11:49, Jean-Pierre Flori wrote: On Thursday, October 27, 2016 at 11:41:20 AM UTC+2, Jeroen Demeyer wrote: On 2016-10-27 11:29, Francois Bissey wrote: > R package system include downloading facility from repositories. That's fine but it should be possible to just run

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
On Thursday, October 27, 2016 at 11:41:20 AM UTC+2, Jeroen Demeyer wrote: > > On 2016-10-27 11:29, Francois Bissey wrote: > > R package system include downloading facility from repositories. > > That's fine but it should be possible to just run R without it's > packaging system. > Then I sugg

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jeroen Demeyer
On 2016-10-27 11:29, Francois Bissey wrote: R package system include downloading facility from repositories. That's fine but it should be possible to just run R without it's packaging system. -- You received this message because you are subscribed to the Google Groups "sage-devel" group. To

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Francois Bissey
R package system include downloading facility from repositories. That’s why you need curl. At least in theory. I’ll have to check for 3.3.x but there was alternatives in 3.2.x. François > On 27/10/2016, at 22:26, Jeroen Demeyer wrote: > > This is the obvious answer: > >> [6] or patch R not to

Re: [sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jeroen Demeyer
This is the obvious answer: [6] or patch R not to use curl Why should I need a web download tool to do calculations in statistics? -- You received this message because you are subscribed to the Google Groups "sage-devel" group. To unsubscribe from this group and stop receiving emails from it

[sage-devel] R 3.3.1 depends on a SSL/TLS implementation

2016-10-27 Thread Jean-Pierre Flori
Hi all, The latest R versions depends on libcurl and actually more than that: on a libcurl with https support. So we might want to build our own libcurl with https support (see #21767) but we then need an SSL/TLS implementation which Sage curretnly provides only optionally through openSSL becau