Re: add pledge to devel/cvsweb

On Sun, Sep 29, 2019 at 07:37:26PM +0200, Ingo Schwarze wrote:
> Hi Solene,
>
> Solene Rapenne wrote on Thu, Sep 26, 2019 at 05:27:08PM +0200:
>
> > Hi, now that we have OpenBSD::pledge I thought it would be nice to use
> > it in devel/cvsweb
>
> I think this is a thoroughly bad idea.
>
> Pledge is useful for well-understood high-quality code.
>
> But CVSweb, at this point, is very old, barely maintained, low-quality
> code. With such code, adding pledge is mostly calling for trouble in
> the form of crashes that result from unexpected, but required behaviour.
>
> Besides, the CVSweb we have in ports is an old version: 2.0.6 (September
> 2002) plus patches. The latest upstream version is 3.0.6 (September
> 2005), but upstream is long dead. Doing new development in the form
> of patches to the port looks like a very bad idea.
>
> Some time ago, i set up a new upstream:
>
> http://mandoc.bsd.lv/cvsweb/
>
> I admit i got distracted, but i hope to return to it.
>
> If we want to improve CVSweb (which i do think makes sense), then the
> proper course of action, i think, is to
>
> 1. Commit such improvements as can be easily done and are quite
> useful to the FreeBSD-cvsweb-2_0-branch. Possibly, pledge can
> be part of that if we are really sure we understand what all the
> code does. Otherwise, i think step 6 below is the proper time
> for adding pledge.
>
> 2. Release 2.0.7 from that branch. This can be a short-term goal,
> the only reason it didn't happen yet is that i got distracted.
>
> 3. Update the port to 2.0.7.
>
> 4. Update the bsd.lv and possibly cvsweb.openbsd.org servers to 2.0.7.
>
> 5. Merge 2.0.7 into the MAIN branch (4.x revision numbers).
>
> 6. Develop and release cvsweb-4.0.0 as a medium-term project.
>
> 7. Update the port to 4.0.0.
>
> 8. Update the two servers.
>
> If you want to help with that, i'm happy to give you commit access
> to the upstream repository on mandoc.bsd.lv.
>
> If other porters think that solene's work should be committed directly
> to the port, i don't veto that, but i do not consider it useful either.
> I doubt that any running server will update to a new version of the
> port before the release of 2.0.7.
>
> Yours,
> Ingo

All of what you said make sense, I did not consider looking for a newer
version before trying to pledge cvsweb.

I don't really want to work more on cvsweb, I did this because it's a
cgi scripts run on official cvsweb.openbsd.org website and I wanted to
help there.. Altough it may be a good project for a port hackathon if
someone wants to read / debug some perl.