"Critical" projects and volunteer maintainers [LWN.net]

"Critical" projects and volunteer maintainers

Posted Jul 24, 2022 0:55 UTC (Sun) by developer122 (guest, #152928)
Parent article: "Critical" projects and volunteer maintainers

I do wonder how much angst could be eliminated if there were an explicit mechanism in these repos and package managers so that packages could be marked as deprecated (or otherwise unmaintained) by their authors. This would then raise immediate warnings during installation which listed all such packages pulled in by other dependencies as well as the chain that did so. If a package were to be deleted, then it should only be done automatically after 6 months of warnings. Hopefully that's enough to get people to pay attention when a warning like this comes up.

I also do like the idea of 3rd party notaries, especially in that new versions of a package are published to the repo not automatically taken as the (latest) version to install until one of more of one's vetting notary(s) of choice have examined it.

to post comments

"Critical" projects and volunteer maintainers

Posted Aug 3, 2022 17:09 UTC (Wed) by LtWorf (subscriber, #124958) [Link] (2 responses)

AFAIK there is no way to remove or take over abandoned packages.

I maintain one such package in debian and basically the original author stopped maintaining it and I can' make updates because I don't have the permissions. Pypi has no way to ever reclaim or remove it.

Also, today I found the module "typing-inspect". It's marked as alpha by the author. It has about 800000 daily downloads. It seems people do not read the flags that already exist when adding a dependency, so I don't think one more flag would change anything (except add hassle to people publishing libraries).

I'd be in favour of signing uploads, but it seems that the world has decided that learning to use gpg (or a graphical frontend) is hard, before even trying.

In my experience, people tend to pin dependencies. It seems typedload's recent versions are mostly ignored, while an older and much slower version from 2019 is the most downloaded by far.

"Critical" projects and volunteer maintainers

Posted Aug 3, 2022 18:04 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

> It seems people do not read the flags that already exist when adding a dependency, so I don't think one more flag would change anything (except add hassle to people publishing libraries).

It seems to me based on my reading of the description that it is perma-alpha:

> The “typing_inspect” module defines experimental API for runtime inspection of types defined in the standard “typing” module.

"Critical" projects and volunteer maintainers

Posted Aug 4, 2022 11:37 UTC (Thu) by kleptog (subscriber, #1183) [Link]

While people may not read the flags on a project, people are using tools like safety to warn them about security issues. If such tools could be configured to also warn about abandoned packages, unauthenticated packages and the like it would at least raise some visibility. NPM for example notifies when projects are seeking donations for example (though no idea how well that works).

Business are taking supply chain risks more and more seriously these days, so increasing awareness might be just enough to get some businesses to devote resources into fixing the problem.