changing the default ghostscript type

[Greg Troxel <gdt%lexort.com@localhost>]

ghostscript is an unusual package.  The version maintained by upstream
is in the package "ghostscript-agpl", under the Affero GNU General
Public License (AGPL3), and the last version released years ago under
the GNU General Public License (GPL3) is in ghostcript-gpl.  Two
packages exist because some do not want to install packages under AGPL3,
and some want to run the version that is maintained by upstream.  This
note is explicitly not about whether one should or should not install
AGPL3 code; it merely acknowledges that some object to it and some do
not.

1) There is a package "ghostscript", which depends on either
ghostscript-agpl or ghostscript-gpl depending on an option.  The current
default is ghostscript-gpl.  So, people who do not set any defaults get
the unmaintained GPL3 version.  However, there are vulnerability
entries, so package tools should warn and require some sort of override.
If one sets the variable to ghostscript-agpl, then the AGPL3 version is
depended on, and one gets an error unless AGPL3 has been added to
ACCEPTABLE_LICENSES.  Therefore, we are in a situation where
installation of ghostscript is expected to require manual intervention
or mk.conf setting in all cases.

I am uncomfortable defaulting to unmaintained code, and I am not aware
of any other packaging system that defaults to old ghostscript, or even
one that packages it at all.

Therefore, I propose to change the ghostscript package so that the
default option will be ghostscript-agpl.  Those that have set the option
in mk.conf should not see any difference, similiar to any other
explicitly set option.

Note that this proposed change does not include and has nothing to do
with any changes to DEFAULT_ACCEPTABLE_LICENSES.  Everyone is still free
to choose which version they want by setting options and placing or not
placing licenses in DEFAULT_ACCEPTABLE_LICENSES, just as before.

2) Currently, ghostscript has a fixed dependency on the chosen type; the
code is basically:

  PKG_OPTIONS_VAR=		PKG_OPTIONS.gs_type
  PKG_OPTIONS_OPTIONAL_GROUPS=	ghostscript
  PKG_OPTIONS_GROUP.ghostscript+=	ghostscript-agpl ghostscript-gpl
  PKG_SUGGESTED_OPTIONS+=		ghostscript-gpl

  .if !empty(PKG_OPTIONS:Mghostscript-agpl)
  DEPENDS+=	ghostscript-agpl-[0-9]*:../../print/ghostscript-agpl
  .elif !empty(PKG_OPTIONS:Mghostscript-gpl)
  DEPENDS+=	ghostscript-gpl-[0-9]*:../../print/ghostscript-gpl
  .endif

I am contemplating changing the code so that in the absence of an
installed ghostscript package, the package will depend on the chosen
version, but that if either version is installed, the installed version
will be used.  With this setup, I believe that if someone installs
ghostcript-gpl (overding the vulnerable check), then ghostscript, even
with the new default option, will happiliy depend on it, that that
person can easily have what they want, even with binary packages.


Please reply to the list if you believe either of these steps (default
to ghostcript-agpl, dependency to match either) is unwise, and explain
what you would do instead and why what is wiser.

Thanks,
Greg