veyepar: External dependencies in web apps: system libs are not that scary

Author(s):	Francois Marier
Location	Track 2
Date	sep Sat 13	Days Raw Files
Start	12:00	First Raw Start	error-in-template
Duration	00:30:00	Offset	None
End	12:30	Last Raw End
Chapters
Total cuts_time	None min.

https://kiwi.pycon.org/schedule/presentation/37/
raw-playlist raw-mp4-playlist encoded-files-playlist host public mp4 svg png

assets release.pdf External_dependencies_in_web_apps_system_libs_are_not_that_scary.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = 
Francois Marier:
External dependencies in web apps: system libs are not that scary
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = 
@ Kiwi PyCon 2014 - Saturday, 13 Sep 2014 - Track 2 
http://kiwi.pycon.org/

**Audience level**

Intermediate

**Description**

Going to production is very different from setting up a development environment. We have great tools like pip and virtualenv for the latter but they lead to maintenance anti-patterns when they are used for production deployments. We don't "pip install apache" and instead leverage the QA and integration work of distro developers, so why not rely on distros for more than just the base system?

**Abstract**

Today's web applications often have a lot of external dependencies. Start off with a basic framework, sprinkle a couple of handy plugins or python modules and finish with a generous serving of JavaScript front-end libraries.

What you end up is a gigantic mess of code from different sources which follow very different release schedules and policies. Language-specific package managers can automate much of the dependency resolution and package installation, but you're on your own in terms of integration and quality assurance. Also, the minute you start distributing someone else's code with your project, you become responsible for the security of that external code.

You could of course decide to avoid the problem by writing it all yourself from scratch. Realistically though, you're not likely to go past the stage of a toy WSGI app using that approach because it's a lot of work.

This talk will examine the decision that the Libravatar [1] project made to outsource much of its maintenance burden to the distro by using system packages for almost everything.

[1] https://www.libravatar.org/

**Slides**

https://speakerdeck.com/nzpug/francois-marier-external-dependencies-in-web-apps-system-libs-are-not-that-scary

Comment:

production notes