Re: CVS commit: pkgsrc/mail/roundcube-plugin-carddav

["David H. Gutteridge" <david%gutteridge.ca@localhost>]

On Wed, 13 Jul 2022 at 22:22:07 +0900 (JST), Takahiro Kambe wrote:
> In message <8efd892b-ad09-4bd4-0d47-5317b06342f1%NetBSD.org@localhost>
>         on Tue, 12 Jul 2022 11:02:23 +0200,
>         Frederic Fauberteau <triaxx%NetBSD.org@localhost> wrote:
> >>> Modified Files:
> >>>     pkgsrc/mail/roundcube-plugin-carddav: Makefile PLIST distinfo
> >>>     pkgsrc/mail/roundcube-plugin-carddav/patches: patch-
> carddav.php
> >> I think that it this pacakge should use release file on GitHub
> instead
> >> of using composer.
> > I think that I used composer to install dependencies of the package
> in
> > its own tree.
> The composer would work fine, but versions of depending (packagist's)
> packages decided at package build time.
> 
> So, there are chance to use different version of depending packages
> and it cause:
> 
> 1. Different binary packages with the same package version.
> 
> 2. Suddnely package build breaks (by update of depending packages).
> 
> Fortunately, in the case of roundcube-plugin-carddav, depending
> packages are not very fluquently updated...

This sounds akin to someone updating a Python package in pkgsrc so that
it uses pip to install its own dependencies, rather than declaring and
managing them via pkgsrc. This would be problematic for the reasons
already noted.

Regards,

Dave