Gentoo Logo
Gentoo Spaceship




Note: Due to technical difficulties, the Archives are currently not up to date. GMANE provides an alternative service for most mailing lists.
c.f. bug 424647
List Archive: gentoo-dev-announce
Navigation:
Lists: gentoo-dev-announce: < Prev By Thread Next > < Prev By Date Next >
Headers:
To: gentoo-dev-announce@g.o, gentoo-dev@g.o
From: Christian Hoffmann <hoffie@g.o>
Subject: Upcoming masking of dev-lang/php-4* and packages depending on it
Date: Sun, 7 Oct 2007 15:13:49 +0200
Heya,

I'm going to p.mask =dev-lang/php-4* and all packages explicitly
depending on this version of php (i.e. the whole dev-php4/ category
(36 packages) and one webapp, www-apps/knowledgetree, bug 194894 [1])
next weekend (around Oct 14th). This step is necessary as there is
hardly any upstream activity anymore.

The last official version of php-4, 4.4.7, dates back to May 3rd and is
in the same state as php-5.2.2 security-wise (and we all know how many
issues php-5 had in the past, just have a look at the recently published
GLSA 200710-02 [2]).

All those security problems, which were fixed in the 5.2 branch,
possibly apply to the 4.4 branch as well, yet there are no (backported)
fixes in upstream CVS and there is no sign of an upcoming release
either.
This means, if we were to continue php-4 support we would have to do
the upstream work and compile a list of issues + patches. Upstream
developers seem to see it the same way -- "if you really want to get it
done - do it" was one reply when I asked what's up with php-4. Noone
from our PHP team has the time and motiviation to do that work, and as
such we are going to mask it (unless someone volunteers to do the work
and/or upstream becomes active again).

We will still keep php-4 (and all related packages) in the tree until at
least the end of the year (this is the date where official upstream
"support" ends) and bump it if (and not "when"...) there are any
releases.

We advise all users of of php-4 to upgrade to php-5 as soon as possible.

[1] https://bugs.gentoo.org/show_bug.cgi?id=194894
[2] http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml

-- 
Christian Hoffmann
Gentoo PHP herd
Attachment:
signature.asc (PGP signature)
Navigation:
Lists: gentoo-dev-announce: < Prev By Thread Next > < Prev By Date Next >
Previous by thread:
Last Rites: America's Army
Next by thread:
Last rites: app-emacs/ses
Previous by date:
Last Rites: America's Army
Next by date:
Last rites: app-emacs/ses


Updated Jul 14, 2012

Summary: Archive of the gentoo-dev-announce mailing list.

Donate to support our development efforts.

Copyright 2001-2013 Gentoo Foundation, Inc. Questions, Comments? Contact us.