Strictly speaking, my role in the MIR is to provide an assessment of what the security team believes is supportable for five years.
Maintaining a language's runtime support environment for five years is no small undertaking. Lua 5.1 support is in a rough place -- it's already two years "obsolete", as it were, and it feels like a gamble to see if the libluajit community is in a position to keep their fork of the language vibrant and supported for the long term.
I'd be content to remove the lua-5.1 Build-depends: requirement and stop building the module, as Robie's patch does. nginx-lua can live in a PPA.
If someone were willing to file a MIR (and become a bug subscriber) for libluajit-5.1, we could consider moving that to main, but the nginx-lua module would still remain in universe.
Strictly speaking, my role in the MIR is to provide an assessment of what the security team believes is supportable for five years.
Maintaining a language's runtime support environment for five years is no small undertaking. Lua 5.1 support is in a rough place -- it's already two years "obsolete", as it were, and it feels like a gamble to see if the libluajit community is in a position to keep their fork of the language vibrant and supported for the long term.
I'd be content to remove the lua-5.1 Build-depends: requirement and stop building the module, as Robie's patch does. nginx-lua can live in a PPA.
If someone were willing to file a MIR (and become a bug subscriber) for libluajit-5.1, we could consider moving that to main, but the nginx-lua module would still remain in universe.
Thanks