Forum OpenACS Improvement Proposals (TIPs): TIP #33 (Approved): deprecate the PayflowPro package
Having the module to support PayflowPro in the toolkit is going to encourage people to use it, and it seems likely that most of them are going to have problems. Therefore, I am proposing that we deprecate the payflowpro package. It should probably be moved to contrib, rather than removing it entirely, so that anyone who wishes to try using it can do so.
One thing that just occurred to me is that I don't actually know if the linking issue is specific to Linux or not. IOW the module *might* function correctly on Solaris, FreeBSD, etc. Since most OpenACS installations are on Linux I think this is still a valid proposal; those who really want to use the module can retrieve it from contrib.
It would be awfully nice if someone could verify whether or not this is a problem for FreeBSD, Solaris etc so anyone picking it up from contrib knows what the scoop is. I guess for now just documenting it along with a request to post any additional information if someone decides to pursue the issue would be just fine.
Another reason to deprecate this is that libpfpro.so is statically linked against an *old* version of OpenSSL (0.9.5-something). Since Verisign is loathe to provide an updated version, you may be opening your site to an attack of some sort if bugs in that version of OpenSSL can be exploited somehow via libpfpro.so.
Granted, the attack surface is pretty small, but you never know.
is the devil).
Did we ever decide the proper way to move a package, and if so, can someone please summarize and/or point me to the thread? I can't find it. If not, we need to decide it now. Back when I was last in charge of a CVS tree it was always done by moving files within the repository, but I know that caused an uproar last time someone did it. So what's the currently acceptable right way?
I would propose "deprecated" for packages we do not want people to use because there is a better package.
Then "Contrib" would be for unmaintained packages with no guarantee of them working or quality.
If we used these definitions then PayFlowPro should move to contrib I think.
I'm assuming this change will make it into HEAD automagically when the branch is merged back in. Somebody please speak up if I need to do it in both places.