To answer your question, generally yes the package maintainer is the one who maintains the package for the current version of the distro, even if upstream is unchanged. If a package is no longer compatible and no one is making it compatible, then yes it’s unmaintained and should be removed.
It wasn’t removed, it was marked as orphaned, which means anyone can take over and mess with it, lowering the bar for supply chain attacks.
If another user had said “I can take care of this long-term, gimme”, I’d had handed it over. Instead, some self-important dingbat with too many privileges decided to mass-mark all packages with an “outdated” flag beyond a certain age as orphaned, then ignored my mailing list post.
For what it’s worth, a distro package maintainer’s inability to update a package to a newer upstream version does not necessarily lead to a package being removed. Debian and Ubuntu kept shipping an ancient version of freetds sometime in the mid-2010s and the package maintainer was incommunicado.
A couple of weeks ago, some dingbat of an AUR admin orphaned a package of mine, ignoring the comment I left on it and my post to the mailing list.
Even though this package, to my knowledge, didn’t end up being attacked, I wonder if this was a potential precursor to the recent attack…
To answer your question, generally yes the package maintainer is the one who maintains the package for the current version of the distro, even if upstream is unchanged. If a package is no longer compatible and no one is making it compatible, then yes it’s unmaintained and should be removed.
It wasn’t removed, it was marked as orphaned, which means anyone can take over and mess with it, lowering the bar for supply chain attacks.
If another user had said “I can take care of this long-term, gimme”, I’d had handed it over. Instead, some self-important dingbat with too many privileges decided to mass-mark all packages with an “outdated” flag beyond a certain age as orphaned, then ignored my mailing list post.
For what it’s worth, a distro package maintainer’s inability to update a package to a newer upstream version does not necessarily lead to a package being removed. Debian and Ubuntu kept shipping an ancient version of
freetdssometime in the mid-2010s and the package maintainer was incommunicado.