[OpenIndiana-discuss] Heads-Up: Obsoletion of 39 old packages

[Marcel Telka]

On Tue, Jan 09, 2024 at 04:08:13PM -0600, Matthew R. Trower wrote:
> > All of them are:
> > - very old - they are more than 10 years old
> > - not maintained - we have no knowledge how to build them (there are
> >   no build recipes for them in oi-userland)
> > - not needed - nothing in OpenIndiana depends on them
> 
> I'm not very knowledgeable on how OI is packaged; how are they in the repos
> currently if we can't build them?  Did we inherit them in binary format in
> the ON IPS repos or something?

Without browsing to a lot of details the short answer is: yes.

All these OpenIndiana packages (and also ca 60 more packages that are
not on the list) are just binary blobs nobody knows for sure what
exactly is there, what bugs they contain, what security vulnerabilities,
or possibly malware, etc.

If you or somebody else believe we should keep any of them then somebody
needs to sit down and create build recipes for them.  This needs labor
and time somebody needs to invest.  Since nobody cared so far for many
many years it looks obvious that these pacakges are abandoned, unused,
rotted.

> I can say JEdit still works at a cursory glance.  I don't use it very often
> anymore, but I'm not sure why it should have to go if it isn't broken.  Is
> it causing you problems somehow?

Our current jedit package is at version 4.3.  This version was released
upstream 14 years ago.  Since 4.3 there were about 15 new releases
upstream.  The latest one is 5.6.0 released on September 2020.

More info: https://sourceforge.net/projects/jedit

The current jedit package is distributed (at least partly) under GPLv2.
This means that OpenIndiana should provide sources and build recipes for
the package.  We do not have that, so it looks like we violate the
license (IANAL).  We should stop.

> dwdiff appears to have source available
> https://os.ghalkes.nl/dwdiff.html

We are at 1.5.2 released upstream 15 years ago.  The latest upstream is
2.1.4 released 3 years ago.  License: GPLv3 (see above)

> as does mtx
> https://sourceforge.net/projects/mtx/

Our package is 1.3.11 released upstream 17 years ago.  The latest is
1.3.12 released 15 years ago.  License: GPLv2 (see above)

> I wonder why we don't?

Why we don't what?

> For the CDE packages, we don't ship an entire CDE, right? So all they can do

We do ship this:

$ pkg list -a | grep '\<cde\>'
cde/calendar-manager-server                       0.5.11-2013.0.0.0          ---
cde/cde-runtime                                   0.5.11-2013.0.0.0          ---
cde/cde-utilities                                 0.5.11-2013.0.0.0          ---
cde/help-viewer                                   0.5.11-2013.0.0.0          ---
consolidation/cde/cde-incorporation               0.5.11-2013.0.0.0          i--
$

I do not know how complete it is.

> is support programs intended to run on/integrate with CDE, on machines that
> don't actually have CDE installed... right?  Furthermore, CDE is open source

No idea.

> these days.  I don't know if current releases compile on OI, but it did at
> least compile at one time (I use it as my DE, in fact), and at any rate

If you are able to compile it, then you are welcome to contribute it to
oi-userland.

The git repo is here: https://github.com/OpenIndiana/oi-userland

> ought to be able to be made to compile again. So, people ought to be able to
> get a proper release of CDE if they desire one (though that may change if
> enough of the wrong 32-bit libs disappear).  Therefore, I would say CDE
> packages probably constitute cruft and ought to be able to go.

-- 
+-------------------------------------------+
| Marcel Telka   e-mail:   marcel at telka.sk  |
|                homepage: http://telka.sk/ |
+-------------------------------------------+