Add Package project status attribute?

[davidak]

Issue description

I noticed that we have some packages where the upstream project is officially unmaintained or had no activity for 8 years. I think it would be helpful for package maintainers and users to mark such packages.

We would have to add a new meta attribute like:

meta.project-status (one word would be preferred)

that can have several states

maintained (default)
unmaintained (official upstream statement)

example: qsyncthingtray (last release 5 years ago, unmaintained)

abandoned (no update for X years)

example: syncthing-tray (last release 8 years ago)

I think we can keep such packages (like we do right now) for those that are still using them, but remove when they become broken or insecure. A package lifecycle diagram might be nice for the documentation.

We can show the project status in the search with a colored label: green, orange, blue

We could also include broken and insecure packages and show a big warning, so users know the packages exist and need some work.

With the new meta attribute, we can also add options like allowBroken:

allowUnmaintained = true;
allowAbandoned = true;

(default true, so the behavior does not change. users can change that)

Also the option to allow single packages:

permittedUnmaintainedPackages = [];
permittedAbandonedPackages = [];

We can create a script to check how long a package (definition) had no update and check the upstream status.

We have to think about the wording to not conflict the project status with out package maintainership status. Many packages have no maintainer set, so they are technically unmaintained.

What do you think?

[MinerSebas]

This sounds like something covered by/can be integrated into NixOS/rfcs#127, but I have no idea of the Implementation Status of the RFC.

[piegamesde]

Also, I'd explicitly call it "upstreamMaintained" or something, to make the distinction clear

[lolbinarycat]

since i have a bit of experience with adding meta attributes, i would name this abandoned and make it a boolean set to false by default.

the documentation would say "this package has been officially abandoned by the upstream maintainers"

however, i'm not entirely sure how useful this would be, since you can always just check the repo to see how long it's been since the last commit.

maybe i'll implement this if my other metadata PRs get accepted (otherwise i would have to deal with a fair few merge conflicts)

[YoshiRulz]

Rather than try to assign an exact duration to 'unmaintained', it might be better to put the date (or just year) of the last non-bot revision/patch into meta and let the consumer decide.