Change #1175606 had a related patch set uploaded (by Krinkle; author: Krinkle):

[IPSet@master] doc: Update README to indicate the package is obsolete

https://gerrit.wikimedia.org/r/1175606

Change #1175604 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/libs/IPUtils@master] doc: Add missing perf docs about IPSet

https://gerrit.wikimedia.org/r/1175604

Used by the supported REL1_39, should be archived after REL1_39 is EOL, to avoid the message about abandoned package when running composer.

https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/REL1_39/composer.json#63

Change #1175604 merged by jenkins-bot:

[mediawiki/libs/IPUtils@master] doc: Add missing perf docs about IPSet

https://gerrit.wikimedia.org/r/1175604

Change #1175606 merged by jenkins-bot:

[IPSet@master] doc: Update README to indicate the package is obsolete

https://gerrit.wikimedia.org/r/1175606

Mentioned in SAL (#wikimedia-releng) [2025-10-07T13:16:43Z] <hashar> gerrit: update description of IPSet repository to "[ARCHIVED] wikimedia/ip-set library - Obsolete, has been fold in https://gerrit.wikimedia.org/g/mediawiki/libs/IPUtils/ - T401155"

Mentioned in SAL (#wikimedia-releng) [2025-10-07T13:18:00Z] <hashar> gerrit: removed ACLs for IPSet repo and reparented it with All-Archived-Projects to prevent replication to GitHub # T401155

Change #1194195 had a related patch set uploaded (by Jforrester; author: Jforrester):

[integration/config@master] Zuul: [IPSet] Mark as archived

https://gerrit.wikimedia.org/r/1194195

Per a discussion with @Jdforrester-WMF , vendor/core had ip-set removed with REL1_41. The library is still used in REL1_39 and we need to keep the repository active until 1.39 is phased out. I will restore the repo and unarchive it from GitHub.

Mentioned in SAL (#wikimedia-releng) [2025-10-07T14:13:18Z] <hashar> unarchived https://github.com/wikimedia/IPSet/ # T401155

Change #1194204 had a related patch set uploaded (by Hashar; author: Hashar):

[IPSet@refs/meta/config] Unarchive the repository, still needed for REL1_39

https://gerrit.wikimedia.org/r/1194204

Change #1194204 merged by Hashar:

[IPSet@refs/meta/config] Unarchive the repository, still needed for REL1_39

https://gerrit.wikimedia.org/r/1194204

Change #1199011 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/core@REL1_39] Update wikimedia/ip-utils to 5.0.0

https://gerrit.wikimedia.org/r/1199011

Change #1199011 merged by jenkins-bot:

[mediawiki/core@REL1_39] Update wikimedia/ip-utils to 5.0.0

https://gerrit.wikimedia.org/r/1199011

• Delete GitHub mirror. https://github.com/wikimedia/IPSet

I've also subsequently created a GitHub-local redirect to https://github.com/wikimedia/IPUtils.

Change #1194195 merged by jenkins-bot:

[integration/config@master] Zuul: [IPSet] Mark as archived

https://gerrit.wikimedia.org/r/1194195

This seems to be causing a problem when installing jobrunner: https://phabricator.wikimedia.org/T409891

Change #1204795 had a related patch set uploaded (by Hashar; author: Hashar):

[mediawiki/services/jobrunner@master] Update wikimedia/ip-utils to 5.0.0

https://gerrit.wikimedia.org/r/1204795

Change #1204795 merged by jenkins-bot:

[mediawiki/services/jobrunner@master] Update wikimedia/ip-utils to 5.0.0

https://gerrit.wikimedia.org/r/1204795

This may have also caused T410243: wikimedia/ip-set: Fatal Git reference error - commit f84555041a405f0ea51c64a0c7fb5fac36e99b84 no longer exists in repository

In T401155#11377674, @A_smart_kitten wrote:

This may have also caused T410243: wikimedia/ip-set: Fatal Git reference error - commit f84555041a405f0ea51c64a0c7fb5fac36e99b84 no longer exists in repository

In T410243#11380017, @Krinkle wrote:

This is the same as T409891. […]

For now, until T373933 and T323787 are resolved, I've restored the GitHub mirror at https://github.com/wikimedia/IPSet and marked it as archived.

OK, REL1_39 is gone, time to do this again.

This time, let's do the work properly:

• Empty the repo of files.
• Re-lock the gerrit repo.
• Delete the GitHub and Diffusion downstream mirrors.

Next time, let's not invent a bespoke checklist when there's a standard one that doesn't miss things out!

Change #1240067 had a related patch set uploaded (by Jforrester; author: Jforrester):

[IPSet@master] Empty repo, now that we're archiving

https://gerrit.wikimedia.org/r/1240067

Delete the GitHub and Diffusion downstream mirrors.

FWIW, I would personally advocate for marking the GitHub mirror as archived rather than deleting it, to e.g. prevent future broken links. But I'll leave the decision to others :)

In T401155#11625447, @A_smart_kitten wrote:

Delete the GitHub and Diffusion downstream mirrors.

FWIW, I would personally advocate for marking the GitHub mirror as archived rather than deleting it, to e.g. prevent future broken links. But I'll leave the decision to others :)

What kind of breakage are you thinking of this fixing? This is not our normal protocol, but maybe it should be if there are things that break from it?

What kind of breakage are you thinking of this fixing?

E.g. if someone has linked to a commit / file permalink on the GitHub repo rather than on Gitiles (as I often personally do with Wikimedia's GitHub mirrors fwiw), those links should still continue to work if the GitHub mirror is archived, but would stop working if the mirror is deleted (both IIUC).

Plus, with regards to IPSet specifically, IIUC, deleting this repo's GitHub mirror previously caused issues when some third-parties attempted to composer update/composer install (e.g. T410243). Granted that MW1.39 is now EOL / IPSet is archived, but I guess I feel like we should consider not (potentially) causing issues for third-parties that still use IPSet through Composer in some way (as it seems may happen if we delete the GitHub mirror) if we don't have to do so for another reason.

This is not our normal protocol, but maybe it should be if there are things that break from it?

Unless there are any arguments against archiving GitHub mirrors upon repo-archival (rather than deleting them) - which, to be clear, I'd be open to hearing & potentially changing my view based upon! - I think I'd be in favour of this :) I sorta also mentioned in T410243#11379809 that it's something I've thought about / wanted to propose for a while, but've never got around to formally typing it up and actually proposing it for realsies.

Change #1240067 merged by Zabe:

[IPSet@master] Empty repo, now that we're archiving

https://gerrit.wikimedia.org/r/1240067

Yeah, until we solve T373933, we need to keep GitHub mirrors of repos that back Packagist packages specifically because that would otherwise rewrite Packagist.org history and delete historical versions.

Most major package managers (npm, PyPi, etc) keep historical versions and these are expected to work indefinitely. Combine this with automatic package selection based on PHP requirements, and old versions are naturally used at the long tail through third-party projects. Breaking that would make us an unreliable vendor in the open source ecosystem.

This resembles the Git protocol, where tags are immutable. And indeed, we keep them in Gerrit as well. Nobody is suggesting we delete the Gerrit repo.

For PyPi and npm, this preservation is enforced upstream by hosting tarballs on a central server. Packagist stores only URLs to tarballs that themselves are decentralised at the source. In our case, that's our GitHub mirror. After we resolve T373933, these will point to Gerrit where our archived repo can serve tarball exports without issue. But until then, GitHub must function as an archive for Composer-packages specifically. This isn't an issue for npm packages.

In any event, this is extremely rare. Afaik this is the first or maybe second package in 15 years that we've deprecated/archived. There probably won't be another one until we resolve T373933.