Hi Léo, Léo Le Bouter <lle-b...@zaclys.net> skribis:
> I would like to propose that we reduce the scope of the maintenance we > do in GNU Guix and establish a list of packages that we more or less > commit to maintaining because this is something that we can do and is > attainable, for example, we could remove desktop environments that we > can't maintain to good standards realistically and focus our efforts on > upstreams that don't go against our way of doing things, that are > cooperative, that provide good build systems we can rely on for our > purposes, etc. > > I propose we also add some requirements before packages can go into > such a maintained state, like a working and reliable updater/refresher > with notifications directed to some mailing list when that one finds a > new release, a reduced amount of downstream patches and a cooperative > upstream with who we preferably have some point of contact to solve > issues or gather more insider knowledge about the software if we need, > a working and reliable CVE linter with proper cpe-name/vendor and > notifications going to a mailing list we all subscribe to, etc.. > probably lots of other things are relevant but you see the idea. > > It should also be possible to filter out packages that are not declared > to be in this maintained state, for example, in the GNU Guix System > configuration. I think most would agree with the general ideas. What’s more complicated is the implementation. What’s “good standards”? What’s “realistically”? How do we tell whether “upstream is cooperative”? Whether a package is “maintained”? However, concrete actions we can take is identify shortcomings of existing tools (I’m glad you reported a bunch of ‘guix refresh’ failures!) and missing tools (a tool that would automatically refresh/build and push patches to a branch would be great), and work on them incrementally. Thanks, Ludo’.
