Packages and dports update frequency

[John Marino]

On 6/25/2017 14:30, Francois Tigeot wrote:
> On Sun, Jun 25, 2017 at 08:42:44AM -0500, John Marino wrote:
>> Dports generation is frozen until Rust is fixed.
>> I'm waiting for M. Neumann to update the port.  I was told that would
>> happen 2 weeks ago so I don't know what the hold-up is.
>>
>> Without a way to update rust easily, we'd have to drop firefox.
>
> Only the latest www/firefox port version (Firefox 54) requires Rust.
> (and even then it only seems to be an option)

"seem" is the keyword.  RUST is required as of Firefox 53.  The firefox 
maintainer on FreeBSD should update the port to remove RUST option 
because it's not optional anymore.

>
> There is a www/firefox-esr port based on Firefox 52 which should be
> maintained for a full year and which does not require Rust.
>
> If we stop freezing DPorts, we will only lose the latest version of
> Firefox. Firefox 52 will still be usable for a long time.

Correct.  As of now, we'd have to remove www/firefox port and rely on 
www/firefox-esr as long as we can.  I do not know how long this ESR 
version will be kept at 52.  I don't recall ESR versions being that 
long-term despite its name.

>
> I think it's a small price to pay compared to the problem of having
> an outdated and insecure application ports tree.

It's time to remind everyone that dports contributions are welcome.  I 
haven't seen much in the way of this in the last few months.  If 
somebody wants to pick this up, even lead the effort, I'll show them how.


>
> If the Rust authors don't want to make it possible to easily update
> their software, it's their call but tens of thousands of other
> applications shouldn't have to suffer for it.
>

mozilla is ingrained in the framework.  Keeping 54RC frozen takes work. 
Removing it altogether (as suggested) is easier.  However, categorizing 
something a few weeks behind as immediately "insecure" and "outdated" is 
being over dramatic.  It's barely different than a quarterly branch.

John