Re: CVS is the `released version'

[David Kastrup]

Tom Tromey <address@hidden> writes:

>>>>>> "David" == David Kastrup <address@hidden> writes:
>
> David> I am not comfortable with having Emacs automatically install and load
> David> anything, period.
>
> Just to be clear here, package.el never automatically installs
> anything.  You must ask for it using the package menu mode (or some
> other install approach).  Once something is installed, it is
> automatically activated when package-initialize is called -- but this
> is an intentional feature.
>
> David> I consider the "fixed repository"
> David> approach something that does not work out.  Each package should carry
> David> with itself the information where to ask for updates.
>
> I considered this but rejected it for two reasons.
>
> First, in my view it is simply more convenient for users to have a
> single, pre-configured download site.  That way no configuration of
> package.el is needed, it "just works".  Yes, this is slightly harder
> for package maintainers, but I've tried to make package.el impose as
> few hardships as possible, and I think the burden is not too great.

Please take a look at how the XEmacs package system works.  It has a
central repository.  It tends to distribute outdated or non-working
code because the people maintaining the central server tend to be not
the same creating the packages.

In my opinion, it is the crucial weakness of the XEmacs package
system.  We don't want to go there.  If some package is provided
upstream, we want to have it directly usable from its default download
location.

> Second, 3rd party sites often die.  ELL has many stale links in it,
> and in my view the free-for-all of the Emacs Wiki is a bit too scary
> to trust blindly.  I know that the worst failure mode with a site
> under my control (hosted on my web site or on savannah) is that it
> will go stale -- which while lamentable at least is not a potential
> security hole.

Where is the problem with that?  Allow for fallback sites to be
specified.  The fallback may well end in a central repository, and if
you are lucky, the package drawn from there will have been updated to
know where to get more recent packages in future.

-- 
David Kastrup, Kriemhildstr. 15, 44793 Bochum