On deprecated packages and notifying users

Hi,

First, what this *isn't* about: last-riting, things which we all agree
need to be removed, and aren't suitable for anybody to use ever.

Sometimes we have packages that most people shouldn't be using anymore,
but they were commonplace once:
* net-misc/dhcp (use kea, but kea isn't suitable for everybody)
* net-misc/ntp (use another time sync daemon)
* sys-kernel/genkernel (on life support)
* sys-apps/haveged (largely obsolete w/ modern kernels, see hanno's
remarks [0])

I'm sure there's more but these are the examples that came to mind.

We often update the wiki page, inform users of this on IRC/forums/MLs,
and may refer to it on bug reports, but it's very easy for people to
miss such developments I'd say from experience with breaking the news.

Should we have some way to inform users of this?

Some options:
* Last-riting these would be excessive, at least for some cases (ntp is
  debatable).
  
* ewarn in pkg_postinst with some revbump to propagate that. I fear this
  may be seen as antagonistic or rude to upstream developers.
  
* package.deprecated is currently used for developer-facing issues,
  where one should inform upstream about a rotting dependency or
  similar. Too noisy for users right now.

* Extended p.mask with no removal date.

I think I like the last option best, and I'm not sure this issue
justifies having a package.deprecated.users (a name I made up, we can
bikeshed that if we want to go that direction).

Thoughts? Any other ideas?

[0] https://www.openwall.com/lists/oss-security/2026/05/19/4

sam

-----BEGIN PGP SIGNATURE-----

iQEBBAEWCgCpFiEEJaa7iN2bdkxrVUHCc4QJ9SDfkZAFAmoNEZ0bFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z
Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQyNUE2QkI4OEREOUI3NjRDNkI1NTQx
QzI3Mzg0MDlGNTIwREY5MTkwDxxzYW1AZ2VudG9vLm9yZwAKCRBzhAn1IN+RkAI3
AQC94f5UNVWaTsqFV1ljkCBdjE9plGzB6qX7jza7rJ92UgD+PIJ8MQNf9v/IRcee
hGBwyv3utCv4KqrZivphYYZ0uAM=
=6dkP
-----END PGP SIGNATURE-----