Django 1.8.x is needed for current GeoNode and EOxServer releases

[kalxas]

We need to backport Django 1.8.x for Bionic.

[johanvdw]

-1

Django 1.8 is no longer supported by django, and this is clearly on their roadmap: ​https://www.djangoproject.com/download/

As 1.11 is the new LTS and available for bionic, I think these projects should be adapted rather than 1.8 being backported.

[kalxas]

Those are the only projects using Django in the disk, so we do not have any side effects. Django 1.11 is supported in their master branches but I do not expect them to make a release until we ship. Especially for GeoNode, 2.8.x was released 2 months ago and 2.10 including django 1.11 support will take at least another 4 months to be released.

So we either install those projects from their unstable branch (we never do this normally) or we backport Django.

[johanvdw]

What should users of these software do when security problems occur in the 1.8 branch?

Can we consider these web based software mature enough for inclusion if they rely on an unsupported development framework?

My recommendation would be that their community releases a version relying on 1.11. Not for OSGeo Live, but because it is in their users interest.

I'm not really black-white on this, but at least we should first hear the maintainers on this before we even consider backporting.

On xenial 1.8 is in main, so it may still get security updates through canonical.

[kalxas]

Django 1.8.7 is now in our ppa, we can switch to default 1.11 whenever projects are ready for it.

[kalxas]

EOxServer is back and working fine in build 263

[kalxas]

GeoNode packages are ready for Bionic:

​https://launchpad.net/~gcpp-kalxas/+archive/ubuntu/geonode/+packages?field.name_filter=&field.status_filter=published&field.series_filter=bionic