Unpublish Repomaker because of its lack of maintenance
I'm essentially writing this to @grote and @eighthave, but I think it's also of interest for @All.
Repomaker isn't maintained actively for quite some time. In the recent weeks, more and more very critical issues are popping because of the simple fact of not updating our dependencies. Half a year ago, I tried to update some dependencies in !213 (closed) and !215 (closed), but it's really a mess. The old version of Django blocks the update to newer versions of Python which blocks the update of our Flatpak runtime which blocks our update of Java which blocks our update of fdroidserver... We're essentially running in circles here.
Sadly, I don't have much time these days to regularly play this game of updating all dependencies. Also, I don't know if Repomaker is used at all (I don't use it personally) and that's even more frustrating to know that we might be maintaining a software nobody is using.
To quote some multiple, bad security issues (not only those of @eighthave):
- many, many serious issues in #231 (closed)
- for sure quite some serious issues in EOL Java version: github/flathub/repomaker#5
- for sure quite some serious issues in our KDE Flatpak runtime: github/flathub/repomaker#4
- we're using a pretty old version of fdroidserver (
0.8
) which blocks for sure quite some dependencies fixing serious issues
With all of this, I don't think it's good if we keep going like this. I'm therefore requesting to publicly mark Repomaker as unmaintained (readme, f-droid.org) and to unpublish Repomaker from all its distribution ways:
- Flathub
- Pypi
- Ubuntu ppa
I'll wait for 3 days for people to respond on this. If nobody does, I'll start by answering to github/flathub/repomaker#5 and requesting to unpublish Repomaker on Flathub, if nobody from F-Droid complains.