Thank you for summarizing our IRC discussion, Mariusz. To be clear, the problem occurs during the upgrade process where more than 1 server is involved. That might be the case in small deployments with just 2 servers, where the time of two Django versions running simultaneously is likely small, or on huge deployments of the course of days or weeks, when a staged rollout occurs.
Cheers, Markus On Fri, Jul 31, 2020, at 11:28 AM, Mariusz Felisiak wrote: > Markus reported a release blocker #31842 > <https://code.djangoproject.com/ticket/31842> related with running an > app on multiple servers with different versions of Django (3.0.x or > 3.1). Signatures created on servers with Django 3.1 are not valid on > Django 3.0, it's not only about signing.loads()/dumps but also about > sessions etc. (see #27468 > <https://code.djangoproject.com/ticket/27468>). We have several > possible approaches: > * revert commits related with #27468, > * change the default hashing algorithm to SHA-1, > * add the new setting for the default hashing algorithm, > * add the "algorithm" parameter to signing.dumps()/loads() (PR13260 > <https://github.com/django/django/pull/13260>) and ignore the rest of > the problem (it's probably not an option), > * add the new setting "MIN_DJANGO_VERSION" and change the default > hashing algorithm if it's 3.0 or less. > * ... (ideas are welcome) > Best, > Mariusz > > -- > You received this message because you are subscribed to the Google > Groups "Django developers (Contributions to Django itself)" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to django-developers+unsubscr...@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/django-developers/2a3d706d-6f78-406e-b7a9-3bba3ea9b7e6n%40googlegroups.com > > <https://groups.google.com/d/msgid/django-developers/2a3d706d-6f78-406e-b7a9-3bba3ea9b7e6n%40googlegroups.com?utm_medium=email&utm_source=footer>. -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-developers+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/d8d56bc4-98a4-460b-ac8c-3b194b11daa4%40beta.fastmail.com.
