Roundcube and Debian

[makingitwork]

Debian has cited a number of security issues with the Roundcube packages for Debian, and plans to remove all packages from the Debian repository.  In addition, Roundcube is not in Jessie, the latest incarnation of Debian. Does the Roundcube team plan to keep Roundcube in the Debian ecosystem, or should I look elsewhere for a webmail package?

[ABerglund]

Roundcube is so simple to install and maintain from source, I don't see why it matters whether Debian includes it. The distro-packaged versions (all of them, not just Debian) scatter files all over the system.

[makingitwork]

Thanks for that.  Installation from source is not the problem in itself.  My concern is keeping the package up-to-date.  It is easier to do that using system upgrades from repository.  Installing from source means having to keep on top of security alerts etc. and manually upgrading from source when necessary.  So it would be nice to hear from the Roundcube developers on what their plans are for Debian.  Have they given up trying?  Are they working on meeting Debian's concerns? 

[alec]

We don't care much about distro packages, we just don't have time. And personally I'm not aware of any Debian's concerns.

[ABerglund]

Upgrade from source takes me about 10 minutes for a minor update, maybe a bit longer for a version change if DB schema changes are needed. I subscribe to the RC Users list, get an announcement when new versions are released. The distro versions (which are packaged by other groups, not the RC developers) are always delayed, often by weeks. I use CentOS, but don't use the packaged version through yum. There's no advantage.