deepnest is abandoned, but there is a active fork - is there a process for moving over?

[bramp]

Output of brew config

HOMEBREW_VERSION: 4.3.9
ORIGIN: https://github.com/Homebrew/brew
HEAD: 1c98a33a376e5b35ebc801d0f7d6ba7b9eb118ac
Last commit: 24 hours ago
Core tap JSON: 09 Jul 01:00 UTC
Core cask tap JSON: 09 Jul 01:00 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_EDITOR: nano
HOMEBREW_MAKE_JOBS: 12
Homebrew Ruby: 3.3.3 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.3/bin/ruby
CPU: dodeca-core 64-bit arm_blizzard_avalanche
Clang: 15.0.0 build 1500
Git: 2.45.2 => /opt/homebrew/bin/git
Curl: 8.6.0 => /usr/bin/curl
macOS: 14.5-arm64
CLT: 15.3.0.0.1.1708646388
Xcode: 15.4
Rosetta 2: false

Output of brew doctor

❯ brew doctor
Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  python-lxml
  python-packaging

Warning: You have the following deprecated, official taps tapped:
  Homebrew/homebrew-cask-fonts
Untap them with `brew untap`.

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built. Run `brew link` on these:
  python-packaging
  python-lxml

Description of issue

This cask seems to be using the binary from https://deepnest.io / https://github.com/Jack000/Deepnest . Per the issues listed on that github, it seems the author has abandoned the project long ago and is no longer responding. I originally went to Github because I found the application to not work correctly. I found that https://github.com/deepnest-io/Deepnest is a fork, that compiles and works correctly.

What is the process for perhaps flagging cask/deepnest as old, abandoned, and potentially not working, and pointing it at a newer fork? (I couldn't find any process documented). I'd be happy to update the cask files to try and do that.

[gromgit]

Speaking as a independent observer, this would be a switch from cask to formula, so it's a matter of someone opening the necessary PRs to:

1. add a formula to Homebrew/core
2. remove the existing cask file in Homebrew/cask

The first is more challenging, as the Homebrew CI environment is deliberately strict about its build process to ensure reproducibility.

[p-linnane]

Adding to @gromgit's excellent answer: We can deprecate the cask since it is no longer maintained. Regarding the newer repo you linked, it appears to be a fork of a fork of a fork that has also seen no new commits in 10 months. This is not suitable for inclusion in the main Homebrew repos, but you may be interested in hosting it in your own tap.

[bramp]

Ok thank you both! I may try and make my own tap, but this may be a niche project and not maintained well enough to be useful to others.

[Dexus]

@p-linnane @gromgit @bramp

I'm the Author behind the newest and latest deepnest app (https://github.com/deepnest-next/deepnest), if someone can help me I would like to take over the cask and update it. But I'm currently not knowing how brew.sh works and how I have to use it, to make it possible.

Would it be possible to get help form your side on this topic?

Best Regards, Josef

[SMillerDev]

Adding it as a new cask won't be a problem though: https://docs.brew.sh/Adding-Software-to-Homebrew

[Dexus]

Unless the original repo blesses your fork as the successor, we won't be able to change the cask.

So inactivity of the origin repo is no indication? Would be then a problem since nobody can reach the origin author since years...

[SMillerDev]

So inactivity of the origin repo is no indication?

It's an indicator that it should be replaced. But since everyone can just fork repos we can't really replace existing software unless the original author signs off on it. Otherwise malicious actors could just fork popular software, claim they're replacing the original and magically have malware appear on all devices that had it installed before.

[Dexus]

So inactivity of the origin repo is no indication?

It's an indicator that it should be replaced. But since everyone can just fork repos we can't really replace existing software unless the original author signs off on it. Otherwise malicious actors could just fork popular software, claim they're replacing the original and magically have malware appear on all devices that had it installed before.

Okay, got it. deepnest-io was hijacked in december last year and then deleted - this would correctly the successor. But even then, its difficult to get any contact to the origin author. So it will life in the repo forever as dead app? Or would it be a possible to add a notice for a fork that publish under a different name - even it would be the same... as in view of the file path...

[p-linnane]

Okay, got it. deepnest-io was hijacked in december last year and then deleted - this would correctly the successor. But even then, it's difficult to get any contact to the origin author. So it will life in the repo forever as dead app?

It's not the successor unless the original upstream says it is. Users installed the software from the original upstream, not this fork. We do not change upstreams without confirmation because we're not willing to let package names be pulled out from under projects. We also are not going to surprise our users by arbitrarily selecting another source. We do this for security and a consistent user experience. If you want the deepnest name, you need to get upstream to sign off on it. If they cannot, regardless of the reason, you'll need to submit the package using a different name.