Next LTS should not have longer support than vendored components

[bastelfreak]

Use Case

Puppet and so Puppet Enterprise vendors a few components. Mostly Ruby, OpenSSL, Curl. PE LTS is designed for enterprise environments. "enterprise" is a loose term, but often those are environments that have a requirements to not use EoL software and have vendor support.

In the past PE LTS didn't, and still doesn't, satisfy this. Right now (PE 2021) it heavily relies on Ruby 2.7 and that's dead since April 2022: https://www.ruby-lang.org/en/downloads/branches/

Describe the Solution You Would Like

I would like to see a LTS support timeframe that matches the timeframe for the vendored components.

Describe Alternatives You've Considered

I don't see any workarounds I could do as a partner nor the PE users.

Additional Context

[joshcooper]

AFAIK the next PE LTS will consist of Ruby 3.2, OpenSSL 3.0 and Curl 8.

We won't be updating to Ruby 3.3 because we don't want to bump to a new Ruby version immediately prior to the next PE LTS and Ruby 3.3 introduces these incompatibilities:

• Gems with native extensions need to be recompiled
• Regexp.new no longer accepts a 3rd argument, which affects puppet's regsubst function
• More details in https://rubyreferences.github.io/rubychanges/3.3.html

OpenSSL 3.0 is the current LTS supported until 2026-09-07. OpenSSL 3.1 and 3.2 are non-LTS releases and will EOL in 2025.

We plan on migrating to Curl 8.x

[bastelfreak]

But how long will Puppet support the next PE LTS?

[binford2k]

I agree with what you're suggesting, but I would also say that support for a product that vendors components or frameworks also implicitly includes support for those components or frameworks.

[bastelfreak]

yes I totally agree. But the point is Perforce cannot offer this. How do you want to support stuff like Ruby 2.7 in PE 2021? That's just dead upstream. RedHat does that since years where they claim to support ancient software in their RHEL7 or RHEL8 releases and claim to 'we will backport every bugfix for years'. Yes but in the majority of the projects patches aren't flagged properly if they are a bugfix. Even rarer are patches that are explicitly flagged as security related. And if it's dead upstream you get no patches at all.

I don't see how Perforce can offer support for those vendored components. Because of that I suggest to change the LTS periods to only vendor components that are still supported upstream.