Future of xulrunner

[Alexander Sack]

On Fri, Jan 22, 2010 at 12:55:49AM -0500, Scott Kitterman wrote:
> It's just been pointed out to me that one of the possible implications of 
> https://blueprints.edge.launchpad.net/ubuntu/+spec/desktop-lucid-new-firefox-
> support-model is that Ubuntu would ship xulrunner in Universe to support 
> rdepends that we don't want to remove.
> 
> The history of xulrunner in Universe is very poor in terms of maintenance and 
> security support.  An LTS release is not the time for this.  I think it either 
> needs to be in Main or removed.  This will have significant implications as 
> there are rdepends that get a lot of use:
> 
> https://wiki.ubuntu.com/xulrunner-list
> 
> Given that list and Mozillas plan for a new continuous release process, there 
> isn't an easy answer.  My experience with supporting clamav and the libclamav 
> rdepends is that forward porting apps to the newer API as Firefox evolves will 
> be easier than trying to backport a never ending stream of security fixes from 
> a code base that is increasingly distant from what we are trying to support.

Thanks for sharing your concerns. Plan is to review the apps in
universe. Packages that are hard to forward port and are exposed to
insecure/remote content will most likely get dropped.

 - Alexander