On Mon, 2023-08-28 at 11:21 -0400, Matt Connell wrote: > On Mon, 2023-08-28 at 15:04 +0200, Arve Barsnes wrote: > > dev-lang/php:7.4 is also masked, so I assume this is due to be > > removed soon. > > 7.X is EOL upstream as of 9 months ago, hence the mask. > > It was acknowledged in the mask commit that we would lose access to > some other packages because of this deprecation, but that's again an > upstream issue rather than a Gentoo one. Gentoo is favoring security > by masking 7.4, but you can always override it as you see fit for your > system(s).
Security was a big reason for the mask (upstream stopped making security fixes a long time ago), but regular maintenance has also become a problem. Upstream stopped releasing regular fixes for php- 7.4.x as well, things like compatibility patches for newer openssl and failing tests that can cause problems in Gentoo. PHP takes a long time to stabilize, so we wind up with... right now, there's three ebuilds in the tree for 7.4.x, and four ebuilds for 8.0.x, and four for 8.1.x. Somebody needs to backport things like openssl compatibility to each of those for as long as they're in the tree and not masked. And, the PHP project is empty: https://wiki.gentoo.org/wiki/Project:PHP I'm still working on dev-lang/php (so it's not abandoned), but we just don't have the kind of resources required to keep what are essentially forks of old PHP versions alive. Barring a miracle, they'll be removed as upstream kills off support. Losing dependent packages like PHPUnit sucks because it's avoidable (newer versions support newer PHP), but there's nobody keeping those packages up-to-date now, so they break when the old versions of PHP are masked or removed.
