Home / mailings [gentoo-announce] Upcoming masking of dev-lang/php-4* and packages depending on it
Posted on 17 October 2007
Gentoo-announce--Sig_/Y=vN5271BmdJ3zi7YrZP8JA
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
We, the Gentoo PHP team, are going to mask =dev-lang/php-4* [0] and all
packages explicitly depending on this version of php around October
18th (i.e. the whole dev-php4/ category (36 packages) and
www-apps/knowledgetree, unless there is a php5-compatible version by
the time of masking; bug 194894 [1]). This step is necessary as
there is hardly any upstream activity anymore.
The last official version of php-4 (4.4.7) dates back to May 3rd and is
in the same state as php-5.2.2 security-wise (and we all know how many
issues php-5 has had in the past, just have a look at the recently
published GLSA 200710-02 [2]).
All those security problems, which were fixed in the 5.2 branch,
possibly apply to the 4.4 branch as well, yet there are no (backported)
fixes in upstream CVS and there is no sign of an upcoming release
either.
This means, if we were to continue php-4 support we would have to do
the upstream work and compile a list of issues + patches. Upstream
developers seem to see it the same way -- "if you really want to get it
done - do it" was one reply when I asked what's up with php-4. No one
from our PHP team has the time and motivation to do that work, and as
such we are going to mask it (unless someone volunteers to do the work
and/or upstream becomes active again).
We will still keep php-4 (and all related packages) in the tree until at
least the end of the year (this is the date where official upstream
"support" ends) and bump it if (and not "when"...) there are any
releases.
We advise all users of php-4 to upgrade to php-5 as soon as possible,
although it may break really old PHP scripts which rely on
php-4 specific behaviour. Please see the upstream documentation
[3][4][5] for any advice on how to migrate your scripts.
[0] http://bugs.gentoo.org/show_bug.cgi?id=189172
[1] http://bugs.gentoo.org/show_bug.cgi?id=194894
[2] http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
[3] http://www.php.net/manual/en/migration5.php
[4] http://www.php.net/manual/en/migration51.php
[5] http://www.php.net/manual/en/migration52.php
--
Christian Hoffmann
Gentoo PHP herd
--Sig_/Y=vN5271BmdJ3zi7YrZP8JA
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc
