Re: [PHP-DEV] [RFC] End PEAR Project Endorsement

Thanks Rowan,

On 27.08.26 20:17, Rowan Tommins [IMSoP] wrote:
> One of the points he discusses is that freezing a channel rather than taking it offline means that security vulnerabilities are also frozen in place, with no way to supersede them for anyone still using the old tooling.
>
> I think readonly is probably the right approach in this case at least in the short term, but actively sunsetting later is maybe something to consider.
>


Agreed. The infra team also would prefer sunsetting at some point; it's 
in the future scope of the RFC.

Also, it's mentioned in the RFC but probably worth to be highlighted 
here: only 6 packages are still publishing to PEAR.

- 3/6 are PEAR infra packages
- 2/6 are non-PEAR infra packages (but by a PEAR Group member) were 
recently marked as unmaintained

Which makes it exactly one single independent package that is still 
maintained (legend!):
Net_SMTP (which is also on Packagist).

I think we can safely say that security is not a very pressing concern 
in this very situation; and that keeping the CLI alive for a while is to 
demonstrate good manners rather than serving high demand. :)

> My only other specific comment is that looking at the draft mirror, only some of the bug reports seem to be there. I'm guessing this is because of the problem Juliette reported a while ago that many of them have started showing an error about unconfirmed email addresses.
>
> I wonder if being logged in as a package maintainer would be enough to see them, or if they're gone for good unless someone with admin access appears. Does anyone have an account to check?

Correct. Only bugs that are accessible on the PEAR website are in the 
archive. Rather than archiving and linking error pages with no relevant 
content, I omitted those. Saves resources and clicks. Some of the pages 
could be recovered from year 2007 snapshots on archive.org, but that's 
quite some extra work. Since the PEAR site itself no longer has those 
pages, it’s probably:

A) reasonable to expect anyone who wants to look up such old bugs to 
visit archive.org themselves
B) not the job of the archive to me more complete than its source; 
hence, out of scope for the RFC

That said, if an admin would provide a database dump I am keen to 
backfill missing bugs at any time (before or after the archive goes online).

--

Cheers
Nick