On 10/10/26 13:15, Tom Lane wrote:
"David E. Wheeler" <[email protected]> writes:
A couple times in the last year, people have hit me up to ask about taking
ownership of abandoned extensions on PGXN. In neither case was I able to track
down the original owner, not for lack of trying. Then this past week I was
alerted to potential superuser escalations in two more abandoned extensions on
PGXN.
Clearly not a good situation.
So I think it may be time for a policy on this. What do you recommend? I have a
few thoughts and options, some of which would require additional work on PGXN
at some point.
* Set up a committee of some kind to investigate abandoned extensions and find
vet and find replacement developers when possible.
* Cease transferring extensions without permission from long-gone developers
and instead suggest that people fork extensions and give them new names.
* Add an annotation to apparently abandoned extensions and mark them as such on
pgxn.org, along with relevant pointers to replacement extensions and contact
information for the original developer to get in touch and reclaim access. Or
maybe it goes away if they create a new release.
I think we have to think first of the users' experience. It's not
good if an extension that is abandoned and has known problems looks
the same as actively-maintained ones. So I would prioritize your last
bullet point of somehow annotating seemingly-abandoned extensions.
By the same token, I don't think "fork under a different name" offers
good user experience: what it offers is confusion. So I prefer a
mechanism that allows a new developer to take over an abandoned
extension over one that encourages forking, even if the latter is
supported by a pointer-to-replacement mechanism. For myself, if I'd
stopped maintaining something for lack of time/interest, I'd be very
happy if someone else picked it up; but I do realize that probably
not everyone feels that way. (Probably-impractical idea: when an
extension is first listed on pgxn, ask if it'd be okay to reassign
ownership in the event that development seems dead.)
In any case, I agree that you should have some sort of defined
process for deciding that an extension is abandoned. Whether
that's a committee or just a checklist, I don't have a strong
opinion about. But it should be unsurprising to all concerned
when such a determination is made.
It may be impractical, but given cases like the XZ Utils backdoor
situation (i.e where a malicious person showed up offering to "help"
maintain an open source project where the original maintainer was
stepping away), it seems like any transfer process needs a vetting step.
--
Joe Conway
PostgreSQL Contributors Team
Amazon Web Services: https://aws.amazon.com
