KatolaZ <katolaz@???> wrote:

>Sure, but you would agree that rebuilding an increasing number of
>infected packages in Devuan from upstream would mean a great deal of
>unnecessary work...


It may be unnecessary, that's why I see a couple of ways to solve it:

1) Contacting maintainers directly. This can be unfortunate
considering responses from the community but at the end of the day
I hope that there are some fellows that are more open to this.

2) If #1 fails, cutting Devuan to stable only, which means much less work,
but also admittedly means lowering the potential user base. Many
desktop users like myself prefer newer packages and sometimes it is
crucial to be cutting edge. For example, if one needs latest GTK but there
is only a version that is two versions behind.

3) And probably the least possible variant, rebuilding everything
to newer packages and creating the new ecosystem. Thus versions of
packages will be similar to Stretch/Sid but without endless revisions,
without rolling release model, only kind of bug fixes, crucial bugs I mean. I reckon it would be better to create
packages from upstream. The advantage is Devuan
will not depend on Debian and their TC and package
maintainers. Devuan will only use dpkg as the base but
it means much more work though potentially
expands that user base I mentioned. Trying to
maintain newer package versions means more regular
releases, like, let's say, once in two years. In this case
I think we'll have compatibility with Testing/Unstable.

Sure, these points only if systemd cluttering will reach 
extraordinary levels.

My two pennies worth,

Mitt