[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Why [bug#47081] Remove mongodb?
From: |
Efraim Flashner |
Subject: |
Re: Why [bug#47081] Remove mongodb? |
Date: |
Mon, 22 Mar 2021 11:55:59 +0200 |
On Sun, Mar 21, 2021 at 11:15:32PM +0100, Léo Le Bouter wrote:
> Hello!
>
> > Removing a package and its services is not something to do lightly:
> > it
> > breaks user configs with no recourse.
> >
> > We must insist on getting more opinions on such matters, and I think
> > there just wasn’t enough feedback here. I understand it can be
> > frustrating to wait for input, but in such a case, please do. This
> > project has always strove for consensus.
> >
> > Remember that the opinion of those who’ve been taking care of
> > security
> > issues in Guix for years, those who’ve been maintaining MongoDB,
> > those
> > who wrote the service and its tests, are invaluable; they must have a
> > say. I insist: humbly solicit and wait for their feedback.
> >
>
> I understand, and I did not think it was a light thing to do, no one
> mentionned anything we should do for the remove, so I actually do not
> know how we handle that but the security/non-free code thing put some
> urge into the situation, apologizes for moving on and pushing without
> waiting for more feedback, few people gave their feedback on IRC and by
> email and that's why I felt more confident doing the actual change.
>
> > Now, how do we move forward? IMO we must look for available options
> > before we remove MongoDB. Are there forks of the original
> > freely-licensed code base maintained around? That sounds likely.
>
> I never heard of any and after some searches even before I pushed the
> remove commit it remained inconclusive on whether we can rely on a
> fork.
>
> > Are
> > there backports of the security fixes?
>
> Ubuntu Focal maintains a package still but to me they still don't have
> all the fixes, see: https://packages.ubuntu.com/focal/mongodb-server
>
> All in all, I don't think we should keep a package in more-than-
> maintenance mode when the upstream has decided to change the license,
> they are uncooperative and making our work harder so I think we should
> remove the package. It's not like we are an LTS distro like Ubuntu
> Focal that absolutely must keep a package until the end of the support
> cycle. It may break configs yes, but actually this had to happen, at
> the same time they changed to a problematic nonfree license and openssl
> 1.1.1 is not supported on 3.4.x (Ubuntu uses 3.6.8 instead which also
> is under AGPL but more recent than our 3.4.10 we had so supports
> openssl 1.1.1 with some patches they made). I'm not particularily
> sympathetic to MongoDB. Also are there actually people using the
> mongodb service on GNU Guix?
>
> > What do the previous
> > contributors to this code think—Chris, Efraim, Marius, Arun?
>
> Chris voiced their opinion saying they didnt mind removing the package,
> I think Efraim said that on IRC also but I am not sure, so let's wait
> for their input here.
>
> >
> > Léo, please get involved in reaching consensus on a solution.
>
> CC'd them, of course, again, sorry.
>
> > Ludo’.
>
> Léo
>
I don't have a strong opinion. I had hoped they'd return to a free
license but that doesn't seem to be the case. I see it a bit more from a
selfish angle, I'd rather drop packages like mongodb which are
unsupported or effectively dead upstream AND I don't use to free up
resources for other packages but I'd rather not take away a package that
someone else is actually using.
Given limited developer time, I would personally rather spend my own
developer time porting gourmet (last release 2014) to python3 than
porting mongodb to openssl-1.1.
--
Efraim Flashner <efraim@flashner.co.il> אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted
signature.asc
Description: PGP signature
- Why [bug#47081] Remove mongodb?, zimoun, 2021/03/17
- Re: Why [bug#47081] Remove mongodb?, Léo Le Bouter, 2021/03/17
- Re: Why [bug#47081] Remove mongodb?, zimoun, 2021/03/17
- Re: Why [bug#47081] Remove mongodb?, Léo Le Bouter, 2021/03/17
- Re: Why [bug#47081] Remove mongodb?, zimoun, 2021/03/17
- Re: Why [bug#47081] Remove mongodb?, Léo Le Bouter, 2021/03/17
- Re: Why [bug#47081] Remove mongodb?, Léo Le Bouter, 2021/03/17
- Re: Why [bug#47081] Remove mongodb?, zimoun, 2021/03/17
Re: Why [bug#47081] Remove mongodb?, Ludovic Courtès, 2021/03/20
Re: Why [bug#47081] Remove mongodb?, Léo Le Bouter, 2021/03/17