[pkg-php-pear] Remaining packages looking for sponsorship

[James Valleroy]

On 9/2/23 3:16 PM, Fab Stz wrote:
> With the updater script, there is a possibility that the latest upstream
> version contains changes to the PHP code in addition to metadata changes. I
> can imagine that in some cases, the change in PHP code could lead to changes
> in the metadata structure. In such a case, the newly downloaded metadata might
> not work anymore with the actually installed PHP code. Your suggestion to let
> the user choose wether he wants the Debian package metadata or upstream
> metadata would permit to manage this.
> 
> Actually the script could work this way:
> - have the debian package metadata in
> /var/lib/php-giggsey-libphonenumber/available/debian-$VERSION
> - have additional metadata downloaded from upstream in
> /var/lib/php-giggsey-libphonenumber/available/upstream-$VERSION
> - At the end of the updater the user would be asked which one to use. If he
> selects an "upstream" version, he would be warned of the security risk & that
> latest metadata might not work anymore with PHP code and would have to confirm
> his choise. Then the updater would create the symlink /var/lib/php-giggsey-
> libphonenumber/enabled (which would be the location where the PHP code looks
> for the metadata)
> 
> When a new version of the package is installed, the metadata stored in /var/
> lib/php-giggsey-libphonenumber/available/upstream-* would be deleted.

This approach sounds good to me!