Dead project : no updates of released branches ... not anymore possible to package for distributions ?

--===============0442110237==
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-7JjlkuJqaLW387IXFKSw"


--=-7JjlkuJqaLW387IXFKSw
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi.

I'm worried as the "official" current Debian maintainer of phpgroupware.

There have been quite a few security issues found in phpgroupware, that
have been "fixed" by applying patches in the Debian package, which were
never formally officially "managed" by the phpgroupware project in a
sensible way. You may find a list of the most worrying ones in :
http://security-tracker.debian.org/tracker/source-package/phpgroupware
Problems have mostly been addressed by direct email contact with a few
of you, but that ain't sustainable iMHO.

Even though there are patches floating around, you aren't managing them
through the bugtracker, nor releasing updated archives for the project.
I don't know what your habits are, but for me, the bugracker is the main
interface between a project and its users / packagers... failing to
properly manage the tickets in the tracker is as important as failing to
commit in the SVN.

A few other problems are tracked there as "being fixed in 0.9.18
branch"... and it's really questionable if there will ever be a release
some day. The latest one I've had a look at is the IP V6 support one :
http://savannah.gnu.org/bugs/index.php?func=3Ddetailitem&item_id=3D13796 (m=
y
interest triggered by :
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=3D31;bug=3D317437 )

I think it's great to prepare the next version, but it's even better to
be able to care for the current one.

I'm currently considering declaring phpgroupware unmaintained, and
pulling it out of Debian, as it is not really safe in my opinion, to
commit on maintaining such a package in the next stable Debian, that is
supposed to be maintained for a couple years from now.

I'm sorry, but it seems that it's the best decision IMHO, to be honest
with users that depend on such packaging (although it's not obvious
there are so many of them). I don't know if other distributions are
still packaging phpgroupware and what they think... :-/

Any comments ?

I may as well pass the maintainer responsability to someone else, as I
may be too picky... but I honestly think there's a problem here that
needs to be addressed, and getting away from it won't really help.

Best regards,
--=20
Olivier BERGER <[email protected]>
http://www-public.it-sudparis.eu/~berger_o/ - OpenPGP-Id: 2048R/5819D7E8
Ing=C3=A9nieur Recherche - Dept INF
Institut TELECOM, SudParis (http://www.it-sudparis.eu/), Evry (France)

--=-7JjlkuJqaLW387IXFKSw
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Ceci est une partie de message
 =?ISO-8859-1?Q?num=E9riquement?= =?ISO-8859-1?Q?_sign=E9e?=

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAABAgAGBQJLqdHCAAoJEPnq46ZYGdfoBTEH/AzQ8v1QAA8njSf2FUcGUnDD
seY5Q5jTfnCpw0PrdT2r4Pefkdd9YInsDO2wo0AlBG9Hj9pva7FoMYk8pQtFD1Z7
28gqprvSISjFM2sWP/beoJMiwvdzrKBg9JubQtFzlQ6f0ez+P8iiRzo3TmchZz4p
sy4UnbwAdhIZ/bCR8JN5J+9FQLfasqJznv0sKzar8qMZ8XGdVsdKRq1ww4x3pbM+
KfUlF2iIiKHjrbDQgxdm1CafJZpoH8I3W1M4tbsJNvWgiRp7koHUMl1unkfpLCmk
qllj33V437CNH3YGF/ufc+NOUNyyAcZInBi3doLrkMkBF1AZCJeJ6ERa2K6zyIw=
=1FHn
-----END PGP SIGNATURE-----

--=-7JjlkuJqaLW387IXFKSw--




--===============0442110237==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
phpGroupWare-developers mailing list
[email protected]
http://lists.gnu.org/mailman/listinfo/phpgroupware-developers

--===============0442110237==--