Re: [phpGroupWare-developers] Dead project : no updates of released branches ... not anymore possible to package for distributions ?

[Benoit Hamet]

Hi Olivier,
Hi All,

Olivier Berger a écrit :
> Hi.
> 
> I'm worried as the "official" current Debian maintainer of phpgroupware.
> 
> There have been quite a few security issues found in phpgroupware, that
> have been "fixed" by applying patches in the Debian package, which were
> never formally officially "managed" by the phpgroupware project in a
> sensible way. You may find a list of the most worrying ones in :
> http://security-tracker.debian.org/tracker/source-package/phpgroupware
> Problems have mostly been addressed by direct email contact with a few
> of you, but that ain't sustainable iMHO.
The release is already done. the 0.9.014 is available since some days
now but not yet officially announced on the main web site. I'm writing
the announcement atm. I hope to publish it at the end of the day.


> 
> Even though there are patches floating around, you aren't managing them
> through the bugtracker, nor releasing updated archives for the project.
> I don't know what your habits are, but for me, the bugracker is the main
> interface between a project and its users / packagers... failing to
> properly manage the tickets in the tracker is as important as failing to
> commit in the SVN.
The patches are commited in the svn. They were not published on the
official track manager due to lack of time. I know this is bad practice,
but we've got some man power problem.

> 
> A few other problems are tracked there as "being fixed in 0.9.18
> branch"... and it's really questionable if there will ever be a release
> some day. The latest one I've had a look at is the IP V6 support one :
> http://savannah.gnu.org/bugs/index.php?func=detailitem&item_id=13796 (my
> interest triggered by :
> http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=31;bug=317437 )
> 
> I think it's great to prepare the next version, but it's even better to
> be able to care for the current one.
That's a long time discussed problem. Either try to maintain a mostly
dead code that will not be supporting > php5.2 (AFAIK this should be the
next php version in Debian isn't it ?), or try to move on with a new
code, supporting >= php 5.2.


> 
> I'm currently considering declaring phpgroupware unmaintained, and
> pulling it out of Debian, as it is not really safe in my opinion, to
> commit on maintaining such a package in the next stable Debian, that is
> supposed to be maintained for a couple years from now.


> 
> I'm sorry, but it seems that it's the best decision IMHO, to be honest
> with users that depend on such packaging (although it's not obvious
> there are so many of them). I don't know if other distributions are
> still packaging phpgroupware and what they think... :-/
Having 0.9.16 in the next stable debian is not a solution for me. First
argument in mind is the php version that will not be supported by this
old code base ... So until "nextgen" is released, I don't see how to
push for a debian package of phpgroupware ... AFAIK Gentoo is(was ?)
packaging phpgroupware too.


> 
> Any comments ?
Some inlined, probably others will come in mind later.

> 
> I may as well pass the maintainer responsability to someone else, as I
> may be too picky... but I honestly think there's a problem here that
> needs to be addressed, and getting away from it won't really help.
Welcome as a developper of nexgen :).

Best regards,

Caeies.