Re: [gentoo-dev] the graveyard overlay

[Philip Webb]

160708 William Hubbs wrote:
> On Fri, Jul 08, 2016 at 05:56:04PM +0300, Andrew Savchenko wrote:
>> IMO the criteria should be whether they work or not,
>> not whether upstream is more or less active.
>> If they're blockers on other work, by all means cull them.
>> However, if the biggest problem with them is
>> that they're using a few inodes in the repo, they should probably stay.
> There is an overlay for packages that are removed from the official tree
> -- https://github.com/gentoo/graveyard --
> and that is where old software should go,
> if it doesn't have an active maintainer.

A lot of this lengthy discussion is missing some basic points,
though a few people have mentioned them in passing.
As someone who has used Gentoo exclusively since 2003
& who raised the objections to removal of Xcdroast + Nethack,
let me try to get you all to focus on the real-life issues.

(1) The fact that a pkg has little or no upstream support
or that it doesn't have an active Gentoo maintainer
is not a reason for removing it from the regular tree.

One basic reason some software is no longer being actively developed
is simply that they work perfectly well as they now are,
eg the file manager Krusader & the desktop manager Fluxbox :
both of these are very useful & have no drop-in replacements,
but very little development has occurred for several years.
The same is true of Xcdroast & Nethack, which have been threatened,
but which have been rescued after some small patches have been applied.
This is likely to be true of more + more pkgs, as time passes :
even changes in the kernel these days rarely affect desktop users.

(2) There are  3  basic categories of Gentoo user :
(a) server-farm managers, (b) multi-user sysadmins, (c) single-users.
Each of these have different security concerns :
(a) need to be alert to the many threats from all over the Internet ;
(b) need (among other things) to prevent privilege escalation ;
(c) are largely immune to those types of threat,
though a few of the Internet variety can affect them.

The security objections raised against Xcdroast + Nethack
were both problems which would arise only on multi-user systems,
yet single-users were also to be deprived of access to them.
Perhaps part of the problem is that many Gentoo developers
also earn their livings as sysadmins with many users or many servers :
the simpler happier world of single-users escapes their attention.

(3) Users generally don't want to be developers : they're too busy or too old.
Asking them "Are you willing to maintain it yourself ?" is a silly excuse ;
offering them the chance to dig around in a graveyard is even worse ;
even maintaining an overlay is a nuisance : I tried it with KDE Sunset.
Neither Xcdroast nor Nethack belong in a graveyard of any kind :
once the obscure security problems have been fixed,
they belong in the regular tree marked 'stable',
like many other pkgs whose development has been completed.

Users all do -- or should -- appreciate the unpaid work of the developers,
but developers also need to realise that without non-developer users
Gentoo would very quickly die & their justified pride + satisfaction die too.

(4) I have  3  simple recommendations to fix the everyday problems.

(a) the justification for tree-cleaning should be explicitly
that a pkg either (i) won't compile, (ii) crashes when run
or (iii) has a serious security hole which affects all  3  types of user.

(b) there needs to be a developer role 'General Maintainer',
who should be available to look at pkgs which have no regular maintainer,
but which compile, run properly & are generally secure :
their job would be to step in, like Mr Savchenko -- thanks again -- ,
to fix small problems which would otherwise be neglected ;
less formally, all developers might see it as part of their role
to help out occasionally with such small problems.

(c) Gentoo's rules + policies need explicitly to reflect the fact
that there are  3  types of user, as described :
eg some pkgs might be marked as 'not safe for multi-user systems' ;
that would recognise real distinctions which are now being ignored.

HTH & thanks as always to all of you for making Gentoo work since 2003.

-- 
========================,,============================================
SUPPORT     ___________//___,   Philip Webb
ELECTRIC   /] [] [] [] [] []|   Cities Centre, University of Toronto
TRANSIT    `-O----------O---'   purslowatchassdotutorontodotca