Oracle Solaris has obsoleted Python 3.7. But I still need it - what do I do?

Python 3.7 is now almost six years old and it's time to retire it. The SRU 72 has done just that, removing Python 3.7 upon update. So, if you don't want it removed, you might think the solution is simply not to update. But what if you want the latest security updates from SRU 72 and to keep Python 3.7 just a bit longer as a stopgap measure? Read on to find out how.

New Python Incorporations

To keep a single pakcage is pretty simple, you unlock the package before you update, but something like a certain Python version—a full environment—is a large collection of packages and this can be quite complex.

Our goal is to allow you to unlock Python 3.7 environment in one step afterwhich you can freeze this environment as a whole. And for that we created new runtime/python-37-incorporation. You unlock just the one incorporation. For an example let's have SRU 69 machine which still has Python 3.7. Thus the goal is to update to SRU 72 but keep the Python 3.7 interpreter around.

Here are the simple steps to allow you to do this. First change the facet on the incorporation:

$ pkg list entire
NAME (PUBLISHER)                                  VERSION                    IFO
entire                                            11.4-11.4.69.0.1.170.0     i--

$ /usr/bin/python3.7 -V
Python 3.7.17

$ pkg change-facet -v version-lock.runtime/python-37-incorporation=false
...

This allows installing python-37-incorporation, which doesn't natively belong to SRU 72.

Now we need to restrict IPS to never install the python incorporation which would remove python 3.7. We have designed it so that the incorporation has two versions. "11.4" is incorporation holding real packages with content. And version "99" holds the obsoleted packages.

$ pkg list -af runtime/python-37-incorporation
NAME (PUBLISHER)                                  VERSION                    IFO
runtime/python-37-incorporation                   99-11.4.72.0.0.172.0       ---
runtime/python-37-incorporation                   99-11.4.72.0.0.171.0       ---
runtime/python-37-incorporation                   11.4-11.4.69.0.1.170.1     ---
runtime/python-37-incorporation                   11.4-11.4.69.0.1.170.0     i--
runtime/python-37-incorporation                   11.4-11.4.69.0.0.169.0     ---
runtime/python-37-incorporation                   11.4-11.4.69.0.0.168.0     ---

To limit IPS to keep 11.4 around run:

$ pkg freeze runtime/python-37-incorporation@11.4
runtime/python-37-incorporation was frozen at 11.4

Then update the system as usual:

$ pkg update -v --accept 2>&1 | tee log
...

Let's observe what happened:

$ ggrep -E -A 1 'entire|runtime/python-37' log
  entire
    11.4-11.4.69.0.1.170.0 -> 11.4-11.4.72.0.0.172.0
--
  runtime/python-37
    3.7.17-11.4.69.0.1.170.0 -> 3.7.17-11.4.69.0.1.170.1
  runtime/python-37-incorporation
    11.4-11.4.69.0.1.170.0 -> 11.4-11.4.69.0.1.170.1

We can see that:
- entire was updated to SRU 72
- Python 3.7 remains on version of SRU 69
- Python 3.7 was still updated within 11.4 boundaries

This shows that freezing python-37-incorporation to version 11.4 still allows any updates should there be some. This is unlikely, but if there is for example some major security issue found in the future in Python 3.7 we have the means of updating python and you will sill be able to install the update.

When Python 3.7 is no longer needed, unfreeze and update:

pkg unfreeze runtime/python-37-incorporation
pkg update -v runtime/python-37-incorporation
pkg change-facet -v version-lock.runtime/python-37-incorporation=none

Done

You can retain Python 3.7 (or any later version being phased out) temporarily. However, this is a stopgap solution. How long will the possibility last? That is difficult question. First of all it is
not supported (we will not be fixing many years old python release). Another limitation is that python does not live in a vacuum and all the packages around are changing. For example Python 3.7 is using OpenSSL 1. Once we obsolete OpenSSL 1 (which is ongoing work) Python 3.7 will no longer fucntion correctly no matter what.

This should be enough to get you going. Rest of the article says how the incorporations work.

Incorporations

To understand how to keep packages installed beyond their 'natural' lifespan we first need to understand what dictates which packages can be installed. Who determines that SRU 50 Samba cannot be installed on an SRU 60 system? Or that SRU 65 removes Python 3.7? The answer lies in 'incorporations'.

An incorporation is a package listing versions of other packages that can be installed. The overarching incorporation is called 'entire'. On SRU 72, you might see:

$ pkg list entire
NAME (PUBLISHER)                                  VERSION                    IFO
entire                                            11.4-11.4.72.0.0.172.0     i--

(Note: This example was run on a pre-production release, so the numbers might differ slightly in the final release.)

$ pkg contents entire
pkg: This package delivers no filesystem content, but may contain metadata. Use
the -o option to specify fields other than 'path', or use the -m option to show
the raw package manifests.

Aha! We need to view metadata:

$ pkg contents -m entire
...
depend facet.version-lock.consolidation/userland/userland-incorporation=true fmri=consolidation/userland/userland-incorporation@11.4-11.4.72.0.0.172.0 type=incorporate
...

Focusing on this line (called action):

 - "depend" says that this action does not install any data. Instead it declares that another package must, must not or might be installed.

 - "facet. ..." is a condition. Will be important later.

 - "fmri= ...." says which package must or must not be installed when our "entire" is installed.

 - "type=incorporate" says that "The dependency is optional, but the version of the dependent package is constrained."

In short this line means that while entire@11.4.72.0.0.172.0 is installed, you may only install userland-incorporation of version 11.4.72.0.0.172.0.

See man -s 7 pkg for gory details.

What does userland-incorporation (please note the 'incorporation' in name) contain?

$ pkg contents -m userland-incorporation | grep runtime/python-37
...
depend facet.version-lock.runtime/python-37-incorporation=true fmri=runtime/python-37-incorporation@99-11.4.72.0.0.172.0 type=incorporate

Digging even deeper:

$ pkg contents -m runtime/python-37-incorporation | grep runtime/python-37
...
depend facet.version-lock.runtime/python-37=true fmri=runtime/python-37@3.7.17-11.4.72.0.0.172.0 type=incorporate

Together, these dependencies mean that installing SRU 72 'entire' allows only runtime/python-37 version "3.7.17-11.4.72.0.0.172.0"

$ pkg info -r runtime/python-37@3.7.17-11.4.72.0.0.172.0
          Name: runtime/python-37
         State: Not installed (Obsolete)
....

And that is obsolete package (== package is uninstalled). Thus, installing SRU 72 'entire' means Python 3.7 will be uninstalled.

Facets

Now let's go back to the 'facet' mentioned above.

depend facet.version-lock.runtime/python-37=true fmri=runtime/python-37@3.7.17-11.4.72.0.0.172.0 type=incorporate

As said facet is a condition. It says that this line (action) is in effect only when a facet named "version-lock.runtime/python-37" is true.

And since the man page pkg(7) says:

Facets  are treated as boolean values by package clients: Facets can be
       set only to true  (enabled)  or  false  (disabled)  in  the  image.  By
       default,  all  facets starting with 'facet.debug.' or 'facet.optional.'
       are considered to be set to false in the image; all others are  consid-
       ered to be set to true in the image.

The facet is by default to 'true' and so the action is in effect. But it also tells us how to "disable" it. Just set the facet to false. Before that the only allowable version to install is the one from SRU 72 (which is 'o'bsolete):

$ pkg list -a runtime/python-37
NAME (PUBLISHER)                                  VERSION                    IFO
runtime/python-37                                 3.7.17-11.4.72.0.0.172.0   --o

$ pkg change-facet -v version-lock.runtime/python-37=false
...
$ pkg install -v runtime/python-37@3.7.17-11.4.69.0.1.170.1
...
$ /usr/bin/python3.7 -V
Python 3.7.17

This works, but unlocking and installing each package individually is tedious. Python 3.7 has many packages:

$ pkg list -a '*-37' | wc -l
168

You would have to unlock and install Python 3.7 environment package by package. This is why we have created the new incorporation which can be used as discussed above.
Which is why we introduced so called "Python Incorporations".