Could storing old package versions on archive.org be a good idea ?

[maaaaz]

Hello everyone,
Thanks for the amazing work on Termux.

We know that no old packages is kept (cf. this), then would storing old versions on archive.org be a good idea to you ?

Cheers !

[TomJo2000]

That isn't really an option, and is not what the web archive at archive.org is for.

• The repos are currently 20+ GB.
  Even "lazily" snapshotting only unique versions of packages, that would quickly build up.

• Termux uses a rolling release.
  We do not support, nor plan to support, legacy versions of packages.
  Supporting legacy packages would exponentially explode the support, testing and maintenance burden for our over 2300 packages.

Note

If you wish to, for whatever reason, build an older version of a package and it's dependencies.
All changes to the build files are preserved in the Git history of this repo, and any of those versions can presumably be built by checking out the repo at the desired point in the history and using the build infrastructure available in the repo.
Though I would like to reiterate that Termux does not, and will not be officially supporting legacy versions of packages, and any breakage that occurs because of such is yours to deal with.

[maaaaz]

Understood, but :

• 20ish GB is not an insane amount of volume for archive.org, this is actually quite surprisingly small compared to other "commonly-found" uses of archive.org (e.g https://www.reddit.com/r/DataHoarder/comments/7shuyx/how_to_get_a_large_amount_of_data_from_archiveorg/)
• storing archived packages does not imply supporting these packages. I only refer to archiving purposes, for example to compare what was inside a package if, for example, a vulnerability or rogue code is detected in the future (like the xz-utils backdoor)
• building an old version of a package (with a git-revert of a package code) with a current version of a compiler might not produce exactly-the-same-back-in-time version of that package. Technically, at least the compiler in the compiled version should be archived to produce correct back-in-time results.

I will think about it.

Thanks !

[TomJo2000]

If you wish to mirror the official repositories for preservation purposes, that procedure is well documented.
https://github.com/termux/termux-packages/wiki/How-to-mirror-the-official-repositories

Frankly speaking, I do not think there is much if any value in preserving every version of a package, let alone all packages.
And I am not aware of any other package repositories doing the same thing.
Aside maybe from Gentoo's Ebuild's, though those are only the build scripts,
and would thus face the same caveats about reproducability mentioned above.

It is our responsibility as maintainers to offer, update and maintain software packages.
That does not mean we should be expected to preserve or maintain, in perpetuity,
every version ever packaged in our repositories.
If build file preservation does not suffice, please by all means mirror the repositories and keep a personal collection.

[ChiefMikeK]

But https://archive.org/search?query=termux has 348 Results including

The final Marshmallow/Pie snapshot Termux app and packages for legacy Android 5/6 : Internet Archive

[TomJo2000]

We do not have any control over what users choose to archive.

[agnostic-apollo]

Android 5 snapshot was likely done by sylirre.