public inbox for gentoo-dev@lists.gentoo.org
 help / color / mirror / Atom feed
From: Michael Orlitzky <mjo@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Subject: Re: [gentoo-dev] Re: Last rites EAPI=6 packages: dev-php/*
Date: Fri, 13 Sep 2024 06:22:51 -0400	[thread overview]
Message-ID: <ZuQSe7fpn8DMdw4n@stitch> (raw)
In-Reply-To: <46dc3021-6f24-4110-8304-fa5f62d2fa44@uls.co.za>

On 2024-09-11 17:23:16, Jaco Kroon wrote:
> 1.  Let users (myself included) just download and use that.
> 2.  We package the phar file rather than the individual deps. Yes, this 
> is cheating.  Like using embedded libs, however, I've seen and observed 
> that in some cases this makes more sense than splitting them up (eg 
> clippy and frr).
> 3.  We go about figuring everything out again and bumping all those 
> individual packages and keeping them all up to date individually.  I 
> don't think this is worth our time and effort.
> 
> I honestly think in this case 2 may well be acceptable. Otherwise 1, but 
> I think 3 is not worth the effort based on your feedback and further 
> reading from when I originally posed the question to now.

I agree that (3) is probably too much trouble. It might be worth it if
someday people want to bring back other packages that would benefit
from the deps, like PHPUnit.

I don't like (2) because there's no way for the security team to know
what's inside composer.phar, and no way for users to tell that they've
got ~15 bundled dependencies in a tool that's extremely
sensitive. So... what I've been doing is putting composer.phar in
/usr/local/bin. (I also run it as a separate user because I don't
trust the code it's downloading but that has nothing to do with
Gentoo.)


  reply	other threads:[~2024-09-13 10:22 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-06-21 17:20 [gentoo-dev] Last rites EAPI=6 packages: dev-php/* Arthur Zamarin
2024-09-11  7:33 ` [gentoo-dev] " Jaco Kroon
2024-09-11 11:26   ` Michael Orlitzky
2024-09-11 15:23     ` Jaco Kroon
2024-09-13 10:22       ` Michael Orlitzky [this message]
2024-09-13 11:53         ` Jaco Kroon
2024-09-13  1:46   ` Duncan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZuQSe7fpn8DMdw4n@stitch \
    --to=mjo@gentoo.org \
    --cc=gentoo-dev@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox