On Tue, Sep 7, 2021 at 7:56 PM Christophe Pettus <xof@thebuild.com> wrote:
>
>
>
> > On Sep 7, 2021, at 10:52, Jonathan S. Katz <jkatz@postgresql.org> wrote:
> > However, my point is that the packages should ultimately be hosted on
> > community infrastructure.
>
> I don't think it's viable to insist that all packages be downloaded from the pg.org infrastructure. It's reasonable
tosay that we won't link directly to a download, but will link to a third-party website where the packages are made
available.
>
I agree that it's not viable to insist they're all downloaded from
"us", and there are sometimes good reasons for it. For example, the
*BSD ports system kind of relies on it being off their systems and not
off ours, but we still want to point to that.
I think it would make sense to more clearly indicate *when* the
download is off a third party site vs when it's from something the
community runs, as a general rule. That would also clear up some of
the confusion when people have issues. And that should be applied
across the board.
It would probably also make sense to have some leve of at leas ta
"soft SLA" defined as a requirement to get listed. Like putting out
patches within <x> time of a release for example -- I think that would
be a perfectly reasonable requirement to put out there. And no, we
can't follow up on every single one of them, but if we get repeated
reports of something not being properly maintained we can remove it
from our list.
But we also need to make sure we don't end up being a link factory for
companies or organisations who just want to get clicks, and do so by
hosting an installer. In fact, from that perspective it might b better
to actually link to a direct binary if possible rather than a
website. But that's also going to be expensive on maintenance. But we
probably *should* put a hard rule in place wrt the amount of tracking
etc that can be done on the resulting page(s) being linked to.
--
Magnus Hagander
Me: https://www.hagander.net/
Work: https://www.redpill-linpro.com/