Hi,

On Tue, Oct 14, 2025 at 1:05 AM Derick Rethans <[email protected]> wrote:
>
> On Fri, 10 Oct 2025, Jakub Zelenka wrote:
>
> > Hi,
> >
> > On Fri, Oct 10, 2025 at 2:44 PM Brent Roose <[email protected]>
> > wrote:
> >
> > > The only thing related to PHP/internals is the fact PEAR is bundled with
> > >> PHP and that the PEAR website is a subdomain pear.php.net.
> > >>
> > >
> > > In my opinion, this is sufficient reason to have an RFC for it. A quick
> > > search through the RFCs showed a handful of website-related ones:
> > >
> > > - https://wiki.php.net/rfc/deprecate-pear-include-composer
> > > - https://wiki.php.net/rfc/global_login
> > > - https://wiki.php.net/rfc/phpnet-analytics
> > >
> > > Then there's the fact that Pear comes bundled with PHP, even more of an
> > > argument that internals have at least something to say about it. Several
> > > RFCs have addressed bundling/unbundling third party plugins before. Again,
> > > a quick search:
> > >
> > > - https://wiki.php.net/rfc/unbundle_imap_pspell_oci8
> > > - https://wiki.php.net/rfc/unbundle_xmlprc
> > > - https://wiki.php.net/rfc/deprecate-and-remove-ext-wddx
> > > - https://wiki.php.net/rfc/unbundle_recode
> > >
> > > To me, and I believe to a significant part of the PHP community, what's
> > > most important is for PHP to acknowledge that composer is its de-facto
> > > standard package manager. This doesn't mean composer cannot operate
> > > independently anymore, but an endorsement would make a lot of sense.
> > >
> >
> > Removing PEAR/PECL from php-src is absolutely fine and such RFC should
> > be done. As I mentioned, we could also discuss removal from the
> > php.net domain (move it to the separate domain from pear.php.net).
> > That's what we control and can do.

I checked the archives to see who had and may still have access, I
found one discussion about compromised pear phar in 2019. It looks
like


Christian Weiske
Chuck Burgess

May have access. And eventually Rasmus?

I added them to the loop here, let see. That may help doing whatever
we decide to do.


-- 
Pierre

@pierrejoye | http://www.libgd.org

Reply via email to