[OpenIndiana-discuss] Heads-Up: Obsoletion of 39 old packages

[Carsten Grzemba]

Am 10.01.24 10:34 schrieb Marcel Telka  <marcel at telka.sk>: 
> 
> On Tue, Jan 09, 2024 at 04:08:13PM -0600, Matthew R. Trower wrote:
> > > All of them are:
> > > - very old - they are more than 10 years old
> > > - not maintained - we have no knowledge how to build them (there are
> > > no build recipes for them in oi-userland)
> > > - not needed - nothing in OpenIndiana depends on them
> > 
> > I'm not very knowledgeable on how OI is packaged; how are they in the repos
> > currently if we can't build them? Did we inherit them in binary format in
> > the ON IPS repos or something?
> 
> Without browsing to a lot of details the short answer is: yes.
> 
> All these OpenIndiana packages (and also ca 60 more packages that are
> not on the list) are just binary blobs nobody knows for sure what
> exactly is there, what bugs they contain, what security vulnerabilities,
> or possibly malware, etc.
> 
> If you or somebody else believe we should keep any of them then somebody
> needs to sit down and create build recipes for them. This needs labor
> and time somebody needs to invest. Since nobody cared so far for many
> many years it looks obvious that these pacakges are abandoned, unused,
> rotted.
> 
> > I can say JEdit still works at a cursory glance. I don't use it very often
> > anymore, but I'm not sure why it should have to go if it isn't broken. Is
> > it causing you problems somehow?
> 
> Our current jedit package is at version 4.3. This version was released
> upstream 14 years ago. Since 4.3 there were about 15 new releases
> upstream. The latest one is 5.6.0 released on September 2020.
> 
> More info: https://sourceforge.net/projects/jedit
> 
> The current jedit package is distributed (at least partly) under GPLv2.
> This means that OpenIndiana should provide sources and build recipes for
> the package. We do not have that, so it looks like we violate the
> license (IANAL). We should stop.
> 
> > dwdiff appears to have source available
> > https://os.ghalkes.nl/dwdiff.html
> 
> We are at 1.5.2 released upstream 15 years ago. The latest upstream is
> 2.1.4 released 3 years ago. License: GPLv3 (see above)
> 
> > as does mtx
> > https://sourceforge.net/projects/mtx/
> 
> Our package is 1.3.11 released upstream 17 years ago. The latest is
> 1.3.12 released 15 years ago. License: GPLv2 (see above)
> 
> > I wonder why we don't?
> 
> Why we don't what?
> 
> > For the CDE packages, we don't ship an entire CDE, right? So all they can do
> 
> We do ship this:
> 
> $ pkg list -a | grep '\<cde\>'
> cde/calendar-manager-server 0.5.11-2013.0.0.0 ---
> cde/cde-runtime 0.5.11-2013.0.0.0 ---
> cde/cde-utilities 0.5.11-2013.0.0.0 ---
> cde/help-viewer 0.5.11-2013.0.0.0 ---
> consolidation/cde/cde-incorporation 0.5.11-2013.0.0.0 i--
> $
> 
> I do not know how complete it is.
> 
> > is support programs intended to run on/integrate with CDE, on machines that
> > don't actually have CDE installed... right? Furthermore, CDE is open source
> 
> No idea.
> 
> > these days. I don't know if current releases compile on OI, but it did at
> > least compile at one time (I use it as my DE, in fact), and at any rate
> 
> If you are able to compile it, then you are welcome to contribute it to
> oi-userland.
> 
> The git repo is here: https://github.com/OpenIndiana/oi-userland
> 
> > ought to be able to be made to compile again. So, people ought to be able to
> > get a proper release of CDE if they desire one (though that may change if
> > enough of the wrong 32-bit libs disappear). Therefore, I would say CDE
> > packages probably constitute cruft and ought to be able to go.
> 
> -- 
> +-------------------------------------------+
> | Marcel Telka e-mail: marcel at telka.sk |
> | homepage: http://telka.sk/ |
> +-------------------------------------------+
> 
> _______________________________________________
> openindiana-discuss mailing list
> openindiana-discuss at openindiana.org
> https://openindiana.org/mailman/listinfo/openindiana-discuss
> 

Should we really remove all GPL licensed components?   Sources and build recipes are public available.   
I use mtx and I would update the package.
      
-- 

<signatureafterquotedtext>Carsten</signatureafterquotedtext>