From: Michael Orlitzky <mjo@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Subject: Re: [gentoo-dev] Re: Last rites EAPI=6 packages: dev-php/*
Date: Fri, 13 Sep 2024 06:22:51 -0400 [thread overview]
Message-ID: <ZuQSe7fpn8DMdw4n@stitch> (raw)
In-Reply-To: <46dc3021-6f24-4110-8304-fa5f62d2fa44@uls.co.za>
On 2024-09-11 17:23:16, Jaco Kroon wrote:
> 1. Let users (myself included) just download and use that.
> 2. We package the phar file rather than the individual deps. Yes, this
> is cheating. Like using embedded libs, however, I've seen and observed
> that in some cases this makes more sense than splitting them up (eg
> clippy and frr).
> 3. We go about figuring everything out again and bumping all those
> individual packages and keeping them all up to date individually. I
> don't think this is worth our time and effort.
>
> I honestly think in this case 2 may well be acceptable. Otherwise 1, but
> I think 3 is not worth the effort based on your feedback and further
> reading from when I originally posed the question to now.
I agree that (3) is probably too much trouble. It might be worth it if
someday people want to bring back other packages that would benefit
from the deps, like PHPUnit.
I don't like (2) because there's no way for the security team to know
what's inside composer.phar, and no way for users to tell that they've
got ~15 bundled dependencies in a tool that's extremely
sensitive. So... what I've been doing is putting composer.phar in
/usr/local/bin. (I also run it as a separate user because I don't
trust the code it's downloading but that has nothing to do with
Gentoo.)
next prev parent reply other threads:[~2024-09-13 10:22 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-21 17:20 [gentoo-dev] Last rites EAPI=6 packages: dev-php/* Arthur Zamarin
2024-09-11 7:33 ` [gentoo-dev] " Jaco Kroon
2024-09-11 11:26 ` Michael Orlitzky
2024-09-11 15:23 ` Jaco Kroon
2024-09-13 10:22 ` Michael Orlitzky [this message]
2024-09-13 11:53 ` Jaco Kroon
2024-09-13 1:46 ` Duncan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZuQSe7fpn8DMdw4n@stitch \
--to=mjo@gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox