Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:128871
Precedence: list
MIME-Version: 1.0
References: <CAOD_yv0k=1nBq6LOR9w2pNXHnjtPL5NtBV=SLRsKjpVCK1dFug@mail.gmail.com>
 <fdf1d284-27bf-4bb2-924e-21fa82673c6f@gmx.de> <CAOD_yv2Sga6P1N-Uu2w-nyyY-XMvytWy-_r1v=xZpygQ_67iRQ@mail.gmail.com>
 <CAEZPtU6NJfxjckrpikVfmFcJ2OyhhKg3YJdqTkpvPaU_uMeyGg@mail.gmail.com>
 <CAEKnhAEsGS+k7Mg4Z1z-fbWh4hsAbkpgTxsdJEYaG7N1+F=Ddg@mail.gmail.com>
 <CANSNCr1paQGq3Vg0MKsNkZagtRweGpQuu9jy-bpnot_=RbLv-g@mail.gmail.com>
 <CAEKnhAGEzupa25BbWy60h_EKrM9e0txm2Tao+vZON=Ob=ce-Bw@mail.gmail.com> <c1451dfa-c38a-f421-66c9-aa51b949aeb9@php.net>
In-Reply-To: <c1451dfa-c38a-f421-66c9-aa51b949aeb9@php.net>
Date: Mon, 20 Oct 2025 11:22:06 +0700
Message-ID: <CAEZPtU4gg7whzhNjF+fGzV6FyA03HSCDBPVoLFm9qT5ijZ5SUw@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [Discussion] Deprecate PEAR and recommend Composer
To: Derick Rethans <derick@php.net>, Chuck Burgess <demon.gene@gmail.com>, 
	Christian Weiske <cweiske@cweiske.de>
Cc: Jakub Zelenka <bukka@php.net>, Brent Roose <brent.roose@jetbrains.com>, 
	PHP Internals List <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: pierre.php@gmail.com (Pierre Joye)

Hi,

On Tue, Oct 14, 2025 at 1:05=E2=80=AFAM Derick Rethans <derick@php.net> wro=
te:
>
> On Fri, 10 Oct 2025, Jakub Zelenka wrote:
>
> > Hi,
> >
> > On Fri, Oct 10, 2025 at 2:44=E2=80=AFPM Brent Roose <brent.roose@jetbra=
ins.com>
> > wrote:
> >
> > > The only thing related to PHP/internals is the fact PEAR is bundled w=
ith
> > >> PHP and that the PEAR website is a subdomain pear.php.net.
> > >>
> > >
> > > In my opinion, this is sufficient reason to have an RFC for it. A qui=
ck
> > > search through the RFCs showed a handful of website-related ones:
> > >
> > > - https://wiki.php.net/rfc/deprecate-pear-include-composer
> > > - https://wiki.php.net/rfc/global_login
> > > - https://wiki.php.net/rfc/phpnet-analytics
> > >
> > > Then there's the fact that Pear comes bundled with PHP, even more of =
an
> > > argument that internals have at least something to say about it. Seve=
ral
> > > RFCs have addressed bundling/unbundling third party plugins before. A=
gain,
> > > a quick search:
> > >
> > > - https://wiki.php.net/rfc/unbundle_imap_pspell_oci8
> > > - https://wiki.php.net/rfc/unbundle_xmlprc
> > > - https://wiki.php.net/rfc/deprecate-and-remove-ext-wddx
> > > - https://wiki.php.net/rfc/unbundle_recode
> > >
> > > To me, and I believe to a significant part of the PHP community, what=
's
> > > most important is for PHP to acknowledge that composer is its de-fact=
o
> > > standard package manager. This doesn't mean composer cannot operate
> > > independently anymore, but an endorsement would make a lot of sense.
> > >
> >
> > Removing PEAR/PECL from php-src is absolutely fine and such RFC should
> > be done. As I mentioned, we could also discuss removal from the
> > php.net domain (move it to the separate domain from pear.php.net).
> > That's what we control and can do.

I checked the archives to see who had and may still have access, I
found one discussion about compromised pear phar in 2019. It looks
like


Christian Weiske
Chuck Burgess

May have access. And eventually Rasmus?

I added them to the loop here, let see. That may help doing whatever
we decide to do.


--=20
Pierre

@pierrejoye | http://www.libgd.org