Re: Official snapshot with Botan 2

>On 2021-05-08 13:22, Michael Raskin wrote:
>>                  Hello
>>          I am trying to maintain a Monotone package in Nixpkgs. Current=
ly
>> the Botan 1 version needed to build the latest Monotone release seems t=
o
>> get a bunch of vulnerabilities reported (and so is marked insecure in
>> Nixpkgs). I have used net.venge.monotone.lapo.botan2 branch and the PCR=
E
>> 8.42 patch by Petr P=C3=ADsa=C5=99 to build Monotone with fresher versions and
>> indeed it works fine, syncs with 1.1 releases etc. However, right now
>> the only way I can grab it is via Monotone netsync, which is not good
>> for a Monotone package in a distribution package repository.
>
>If a bit of testing effort can be put together I think we better create=20
>a proper new release with those patches included, as when I fixed botan2=20=

>patch in April I just didn't have enough time to ensure it was working=20
>for everyone (I only checked it was working "enough for me").

Thank you again!

I can definitely confirm it words well enough for me, which includes=20
sync with an older installation (and normal use, although I happen to do
merges inside the same branch and haven't done a propagate recently).

I guess the question is how we reach everyone (left)? Then, whether the
functional test coverage is complete enough, and maybe do we want to=20
have some amount of installed-tests (given a checklist, I could write
those over time as a script, and maybe store nearby the Nix expression
so that they can be used in Nixpkgs CI, too)

>Basically, I don't have time to be a proper maintainer, but if patches=20
>are created and tested together=E2=80=A6 I think I can take time to create new=20
>releases from time to time.

Proper as in =C2=ABlead hash function migration=C2=BB? Because otherwise, it feels
like a maintenance-mode where no new features are ever expected but=20
patches forced by outside changes are eventually accepted and released
_is_ what I would call maintenance.

>Last releases were cut by Markus but with some reading docs I could do=20
>it given enough time, I think.
>(I am the maintainer of the server that host's the website too, so=20
>accesses are not a problem)
>
>--=20
>Lapo Luchini
>[email protected]
>
>