Subject: [alpine-devel] Packages to consider moving from main/ to community/

From: "A. Wilcox" <[email-masked]>
Date: Wed, 14 Feb 2018 12:42:14 -0600

Hi there Alpinists,

We've made a list of packages currently in main/ that may be better
suited to being in community/:

== Media software / stuff that uses Qt5 upstream ==

Rationale: Qt 5 is in community, doesn't really belong in main

* audacious
* v4l-utils

== HTTP servers ==

Rationale: HTTP servers are notoriously terrible at security and having
them in main means lots of maintenance work for Alpine to keep security
fixes for them for years.

* darkhttpd
* lighttpd (+ acf-lighttpd)
* mini_httpd
* nghttp2

Thanks for your consideration.

Best to you and yours,
--arw

-- 
A. Wilcox (awilfox)
Project Lead, Adélie Linux
http://adelielinux.org

---

From: Steffen Nurpmeso <[email-masked]>
Date: Wed, 14 Feb 2018 22:36:43 +0100

"A. Wilcox" <[email-masked]> wrote:
 |We've made a list of packages currently in main/ that may be better
 |suited to being in community/:
 ...
 |== HTTP servers ==
 |
 |Rationale: HTTP servers are notoriously terrible at security and having
 |them in main means lots of maintenance work for Alpine to keep security
 |fixes for them for years.
 ...
 |* lighttpd (+ acf-lighttpd)

I understand only main/ is backward supported?
But i really have to stand up for this one. 
Reported bugs end up in new releases occasionally, which then end
in main by updating APKBUILD.  If i look at the commit log i see
something back in July 2015, which surely was a pain.  Can a port
be managed any cheaper than this one?

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: William Pitcock <[email-masked]>
Date: Wed, 14 Feb 2018 18:51:23 -0600

Hello,

> be managed any cheaper than this one?

We suggested lighttpd for move to community because upstream is not
always fast on fixing security problems.

William

---

---

From: Francesco Colista <[email-masked]>
Date: Wed, 14 Feb 2018 19:53:42 +0100

> Rationale: Qt 5 is in community, doesn't really belong in main

Hi!
You need to consider the dependencies.
So far, in main there are ffmpeg and gst-plugins-good who depends from 
v4l-utils-dev.
If you move it in community, dependency will break.
And move them also to community, will end up in moving:
- sox
- audacious-plugings
- gst-libav
- omxplayer
- pianobar

audacious is not a dependency of any pacakge besides audacious-plugins.

Move all of them, IMHO, is not a bad idea.

-- 
:: Francesco Colista
:: Alpine Linux Infrstraucture
:: http://www.alpinelinux.org
:: GnuPG ID: C4FB9584

---