Re: Why [bug#47081] Remove mongodb?

[Léo Le Bouter]

On Wed, 2021-03-17 at 17:56 +0100, zimoun wrote:
> If the removal for security reasons had been discussed on IRC, it
> could
> be nice to point the discussion here.  Otherwise, open a discussion
> on
> the topic on guix-devel or bug-guix.  The full removal is a radical
> solution (especially, it should be done with 2 commits: service+doc
> and
> then package; well another story).

https://issues.guix.gnu.org/47081 - some of it there: 
https://logs.guix.gnu.org/guix/2021-03-12.log#001752

Efraim, Cbaines, Lfam was involved there and shown no big objections

> 
> Well, you updated mongodb from 3.4.10 to 3.4.24 on the March 10th,
> submitted a patch series for the removal on the March 12th and pushed
> on
> the March 16th.  In the meantime, the update has been reverted on the
> March 11th because of license issue, IIUC.
> 

The security update was reverted, then the revert was reverted due to
debate on licensing which turns out reverting the revert was actually
wrong because some specific files were under SSPL, at that point we
were shipping SSPL code which is nonfree, so the removal is also that.

Nonfree code + security issue made it kind of stressful

Léo

signature.asc
Description: This is a digitally signed message part