Hi Léo, Léo Le Bouter <lle-b...@zaclys.net> skribis:
> On Wed, 2021-03-17 at 17:56 +0100, zimoun wrote: >> If the removal for security reasons had been discussed on IRC, it >> could >> be nice to point the discussion here. Otherwise, open a discussion >> on >> the topic on guix-devel or bug-guix. The full removal is a radical >> solution (especially, it should be done with 2 commits: service+doc >> and >> then package; well another story). > > https://issues.guix.gnu.org/47081 - some of it there: Removing a package and its services is not something to do lightly: it breaks user configs with no recourse. We must insist on getting more opinions on such matters, and I think there just wasn’t enough feedback here. I understand it can be frustrating to wait for input, but in such a case, please do. This project has always strove for consensus. Remember that the opinion of those who’ve been taking care of security issues in Guix for years, those who’ve been maintaining MongoDB, those who wrote the service and its tests, are invaluable; they must have a say. I insist: humbly solicit and wait for their feedback. Now, how do we move forward? IMO we must look for available options before we remove MongoDB. Are there forks of the original freely-licensed code base maintained around? That sounds likely. Are there backports of the security fixes? What do the previous contributors to this code think—Chris, Efraim, Marius, Arun? Léo, please get involved in reaching consensus on a solution. Ludo’.