1

Yesterday, Debian removed Mediawiki from its stable distribution:

Removed packages
----------------

The following packages were removed due to circumstances beyond our
control:

+-------------------------------+--------------------------------------+
| Package                       | Reason                               |
+-------------------------------+--------------------------------------+
| lyz [184]                     | Depends on to-be-removed zotero-     |
|                               | standalone-build                     |
|                               |                                      |
| mediawiki [185]               | No longer security supported         |
|                               |                                      |
| mediawiki-math [186]          | Depends on to-be-removed mediawiki   |
|                               |                                      |
| zotero-standalone-build [187] | Unusable in jessie                   |
|                               |                                      |
+-------------------------------+--------------------------------------+

As I read it, this means "If you are running Debian stable, as of _now_, you will know longer receive security updates for mediawiki. So drop what you are doing, look for an alternative, and do it quickly, or you'll get pwned."¹

As we all know, running a commonly-used web application without security updates is like leaving your front door unlocked and going on vacation. So, are there any alternatives if you want to run mediawiki securely on your Debian server? I looked for alternative repositories but, unfortunately, jessie-backports does not contain mediawiki either.

The only alternative I can think of is to go back to the dark ages of system administration (before stable/LTS Linux distributions were invented), subscribe to the mediawiki-announce mailing list and install every. single. security update. manually. As you can imagine, I'd like to avoid that.

So, is there any alternative for us poor Debian stable users? Some MediaWiki fork which is still supported? Some reliable third-party repository?

¹ Please correct me if my interpretation is wrong. I'm surprised that they'd do something like that in the stable branch without at least some warning in advance, so that people can look for alternatives, but I understand that there might be circumstances beyond their control which lead to such situations.

Heinzi
  • 1,227
  • 1
  • 9
  • 19
  • 1
    As you said: updating manually, if no one can do that for you anymore (_including Debian maintainers_). –  Jun 05 '16 at 10:27
  • @Downvoter: Feedback to improve the question is appreciated. – Heinzi Jun 05 '16 at 11:28
  • @siblynx: Yes, that's the last resort. I'm still hoping that there's maybe a security-supported fork one can migrate to or a reliable third-party repository... – Heinzi Jun 05 '16 at 11:55
  • 1
    There are many Debian-like forks around, maybe even one has mediawiki supported. Did you lurked in that area? –  Jun 05 '16 at 12:26
  • @siblynx: I checked Ubuntu, the one Debian fork I know of which also has good security support, but they [dropped it from their package repositories as well](https://www.mediawiki.org/wiki/Manual:Running_MediaWiki_on_Ubuntu#Get_MediaWiki). – Heinzi Jun 05 '16 at 13:47

1 Answers1

2

Yesterday

This didn't happen yesterday. This happened back in 2014, when the people who were responsible for packaging up mediawiki for Debian simply stopped doing so.

Then in 2015 this was noticed and Debian member (and currently listed Debian maintainer for mediawiki) Jonathan Wiltshire filed a bug saying that the version of mediawiki packaged was woefully out of date and should be dropped.

In 2016, someone else tried to get the package back into Debian. The attempt floundered somewhat because the original package apparently didn't comply with Debian's rules about free software copyright.

Further reading

JdeBP
  • 66,967
  • 12
  • 159
  • 343
  • Thanks, that's very insightful. So, if I understood you correctly: Until yesterday (i.e. until Debian 8.3), the package was *officially* part of stable, but *de facto* not security-supported for quite some time. Did I get that right? – Heinzi Jun 05 '16 at 13:43
  • @Heinzi At [the end ot the ITP](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=810290#30) mentioned above you'll find a [link to the packages](https://people.wikimedia.org/~legoktm/debian/). I don't know why they haven't got through the NEW queue since March, maybe they decided to wait for mediawiki 1.27 LTS to be released (supposed to be in May, but first release-candidate was announced on Jun 1) and package that instead. Anyway, if you're willing to trust packages outside of the debian repos, you should be able to download the `.deb` files and install them with `dpkg`. – cas Jun 06 '16 at 00:09
  • 1
    @Heinzi the package was *officially* security supported until yesterday, in the sense that if someone did find or report a security issue in it, the security team would have taken on the issue and looked for a fix. But nobody was actively porting in upstream fixes. In the case somebody *did* find and report a security flaw, the age of the version would have made it difficult to issue a fix. And the unmaintained state also meant nobody upstream was specifically looking for security issues in this version, either. – trr Jun 07 '16 at 01:26