Re: Why [bug#47081] Remove mongodb?

["Ludovic Courtès" <ludo@gnu.org>]

Hi Léo,

Léo Le Bouter <lle-bout@zaclys.net> skribis:

> On Wed, 2021-03-17 at 17:56 +0100, zimoun wrote:
>> If the removal for security reasons had been discussed on IRC, it
>> could
>> be nice to point the discussion here.  Otherwise, open a discussion
>> on
>> the topic on guix-devel or bug-guix.  The full removal is a radical
>> solution (especially, it should be done with 2 commits: service+doc
>> and
>> then package; well another story).
>
> https://issues.guix.gnu.org/47081 - some of it there: 

Removing a package and its services is not something to do lightly: it
breaks user configs with no recourse.

We must insist on getting more opinions on such matters, and I think
there just wasn’t enough feedback here.  I understand it can be
frustrating to wait for input, but in such a case, please do.  This
project has always strove for consensus.

Remember that the opinion of those who’ve been taking care of security
issues in Guix for years, those who’ve been maintaining MongoDB, those
who wrote the service and its tests, are invaluable; they must have a
say.  I insist: humbly solicit and wait for their feedback.

Now, how do we move forward?  IMO we must look for available options
before we remove MongoDB.  Are there forks of the original
freely-licensed code base maintained around?  That sounds likely.  Are
there backports of the security fixes?  What do the previous
contributors to this code think—Chris, Efraim, Marius, Arun?

Léo, please get involved in reaching consensus on a solution.

Ludo’.