No, I am not saying this.  I said this: "Furthermore, such packages must meet Debian's licensing requirements."

We cannot Debian to accept a package, and we obviously have no particular influence over Debian's release schedule. Consequently, hosting a package either temporarily or permanently on debian.koha-community.org is a valid option for us in case of technical disagreement with Debian or because we want to require a package before it is available on Debian stable.  In the long run, however, it is better that such hosting be temporary; as it saves us work to have a dependency be part of Debian.

So that they have a chance of actually getting into Debian — and so that Koha does not fall into the trap of requiring non-free dependencies for the sake of developer convenience.

I should point out that this is not a new guideline.  From the wiki [1]:

"The Koha project is not going to redistribute a module just because it's in CPAN"

 

 

Are new developers actually the primary source of suggestions that we add new CPAN dependencies to Koha?

Regardless, there are a variety of competing aims at play here, and I submit that the convenience of new developers -- or not so new developers -- does not trump other considerations that include:

* keeping the number of dependencies (and thus, potential vectors for bugs and security exposures) manageable. Each new dependency adds a maintenance cost the project; not necessarily large in and of itself, but it adds up.

* ensuring Koha's stability for Debian users

* having some assurance that new dependencies are likely to work; if a CPAN module is already packaged for Debian, there's at least some signal that this is the case 

* for that matter, easing the situation for folks running RHEL who are restricted from installing CPAN modules willy-nilly; there are at least a few such Koha users out there

No. Somebody who wants to add a CPAN dependency that is not yet packaged for Debian has several avenues to take (assuming that they've triple-checked that a new dependency is actually necessary):

* they can package it themselves (and bluntly, in the case of paid development that is conducted by a commercial entity, I do not view that as an unreasonable expectation that they one way or another arrange to deal with packaging new dependencies that they propose)

* they can make a request of various other developers in the Koha community who have experience building packages -- it's not just me who can do it --  although I note that a request works better than a demand.

* they can make a request of the Debian Perl Group [3], who are, by all accounts, a pretty helpful bunch

* they can find a Debian Developer to contract with to build the package

 

CPAN, as with anything else, is subject to Sturgeon's law; using existing Perl packages helps provide a useful quality filter. As far as Debian is concerned, there are almost 3,500 CPAN modules that are already packaged for Jessie.  Does this cover everything? No, of course not; but I submit that a project that already has over 150 CPAN dependencies should be cautious about adding new ones.