Fair enough, and I realize it’s easy to ask for this from the outside. I didn’t mean that I should be the one to do it, though, and I’m not sure I could. The fixes are public once the advisories go out, so anyone can backport them. But a signed and notarized build, an auto-update, a version number that scanners and distro trackers recognize: those only come from the project itself. A patched fork wouldn’t reach most users.
I maintain a few much smaller projects (Fedify and LogTape, for instance) and try to ship patch releases for older minors, so I do have some sense of what it costs. It’s far more manageable at that scale. I’d guess Ghostty’s situation is harder, with more platforms, more packaging, and many more users. Please read my comment as a wish rather than a criticism of how the team spends its time.
Fair enough, and I realize it’s easy to ask for this from the outside. I didn’t mean that I should be the one to do it, though, and I’m not sure I could. The fixes are public once the advisories go out, so anyone can backport them. But a signed and notarized build, an auto-update, a version number that scanners and distro trackers recognize: those only come from the project itself. A patched fork wouldn’t reach most users.
I maintain a few much smaller projects (Fedify and LogTape, for instance) and try to ship patch releases for older minors, so I do have some sense of what it costs. It’s far more manageable at that scale. I’d guess Ghostty’s situation is harder, with more platforms, more packaging, and many more users. Please read my comment as a wish rather than a criticism of how the team spends its time.
score 1 · canonical