Re: [PHP-DEV] [RFC] End PEAR Project Endorsement
"Rowan Tommins [IMSoP]" <[email protected]>
| Newsgroups | gmane.comp.php.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi Nick, On 27 August 2026 04:36:50 BST, Nick Sdot <[email protected]> wrote: >Hey internals, > >I would like to open the discussion to "End PEAR Project Endorsement": >https://wiki.php.net/rfc/end_pear_endorsement Thanks for putting this together and moving the conversation forward. I wholeheartedly support this course of action. >We win nothing by further stalling a decision; I believe we should stop the endorsement for PEAR. I think this is the key: a lot of the comments on previous discussions were about "giving a chance" for one or other individual or group to revive the website. Multiple attempted contacts were made, and many months have gone by, with nobody reporting a positive result. If that's not long enough, how long is? If the site stays alive in its current state for 10 years, it will continue to be exploited by spammers and probably worse. That's not in anyone's interest. - Coincidentally, Andrew Nesbitt, who writes tooling and analysis comparing different packaging systems, wrote a recent post about approaches to sunsetting: <https://nesbitt.io/2026/06/23/sunsetting-a-package-manager.html> One of the points he discusses is that freezing a channel rather than taking it offline means that security vulnerabilities are also frozen in place, with no way to supersede them for anyone still using the old tooling. I think readonly is probably the right approach in this case at least in the short term, but actively sunsetting later is maybe something to consider. - My only other specific comment is that looking at the draft mirror, only some of the bug reports seem to be there. I'm guessing this is because of the problem Juliette reported a while ago that many of them have started showing an error about unconfirmed email addresses. I wonder if being logged in as a package maintainer would be enough to see them, or if they're gone for good unless someone with admin access appears. Does anyone have an account to check? Thanks again - and thanks also to everyone who has contributed to PEAR in the past, and everyone who has tried to reach someone to bring it back to life. Regards, Rowan Tommins [IMSoP]