Upstream repository shutdowns

From Gentoo Wiki
Jump to:navigation Jump to:search

This article is used to list deprecated (or simply no longer existent) locations for upstream package repositories. At one time Gentoo ebuild maintainers were able to download source tarballs for packages from these sites. Now that they are no longer usable, ebuild maintainers have the difficult job up tracking down where the upstream projects have decided to move their project repositories.

The broken SRC_URI values in the official Gentoo tree generate a lot of maintenance work.

Security

Many projects got forked several times during the shut down procedure and it is not always easy to find out which fork is the right one for the Gentoo ebuild.

While many packages need an update to a new URL it is easy to plant silently a link to malicious source code instead of the original source code. It is also possible that a developer uses a wrong fork by accident.

Developers should read also the How to deal with package forks? discussion as started on 2017-03-09 on the developer mailing list.

Mirrors

Find out, if there sources on example.com which we must not mirror

user $cd /var/db/repos/gentoo/metadata/md5-cache; grep "URI=.*example\.com" -R -l | xargs grep "RESTRICT"

Returns all RESTRICT variables of the affected ebuilds. Are they using restrictions which would forbid mirroring in general?

Note about mirror://gentoo from devmanual "Previous policy was to use mirror://gentoo directly, but this is now deprecated, as that wouldn't allow to have long-term availability and traceability of the source files, which might be a requirement of the license. "

Fixing a package

  • If there is no suitable upstream homepage use HOMEPAGE="https://wiki.gentoo.org/wiki/No_homepage" as a substitute.

Notable repositories that were shut down

Retrieved from "https://wiki.gentoo.org/index.php?title=Upstream_repository_shutdowns&oldid=1076777"