So, has anyone figured out an efficient process yet to 'freeze' all releases/versions of a piece of software so that people can keep using it as it is forever seemingly unchanged, while still providing security updates and ensuring interoperability of eg. file formats?
(This is not a "recommend me a tool" question. This is a *process* question.)
@joepie91 It is incompatible with current famous models of powering software development, but there's a process.
You'll need to establish a long-term payment mechanism — such as a trust fund — that will pay for continued maintenance of the old version of a software to somebody who is reasonably familiar with it.
In practice, this sort of thing is, with some commonness, done to industrial control systems software and aviation and spacenautics software. NATO militaries (and probably others) also do it to many kinds of military sofware.
@joepie91 Related, in a funny-sad kind of way: https://mstdn.social/@JugglingWithEggs/114366284703714532
@joepie91 You mean as in how you could provide this?
(I don't have an answer BTW, but the question was a bit unclear to me)
@joepie91 that sounds like a monumental task, I think it is beneficial to build conversion between different versions of the same file format into the software, and I think thorough standardisation of any file formats, protocols, and processes would help a lot, paying attention to standardising error handling too
@joepie91 My understanding is that it's impossible, unless you have an extreme amount of engineers essentially maintaining all the dependencies by themselves. Like, most software and libraries don't have multiple major versions maintained upstream at once. So if you are on an older version - receiving a security update is either a (pretty custom) backport, or updating the dependency to latest.
@KFears Right, but "updating the dependency to latest" is more or less the direction I'm thinking in. Some kind of process to make that an (economically/time-wise) viable thing to do in a software maintenance process.
@joepie91 I don't think that's possible without extremely strict semver adherence from dependencies...
@joepie91 honestly since red hat couldn't do it, I just assume the answer is no