#1148536 ITP: rox-filer -- Fast and lightweight GTK3 file manager and desktop

#1148536#5
Date:
2026-09-20 15:41:35 UTC
From:
To:
* Package name : rox-filer
* Version : 2.12.2
* Upstream Contact: josejp2424 <josejp2424@gmail.com>
* URL             : https://github.com/josejp2424/ROX-Filer2
* License         : GPL
  Programming Lang: C
  Description     : Fast and lightweight GTK3 file manager and desktop

This is a GTK3 port of classic ROX-Filer 2.12 with modern GTK3 integration,
system-theme icons, multilingual support and additional desktop features.

If this package got sponsored, I will maintain it.
I welcome co-maintainers if anyone want to join me.
Besides, I am glad if a package team could support.

#1148536#10
Date:
2026-09-20 18:08:07 UTC
From:
To:
Hi. I have a few comments.

Generally speaking, in Debian, we try to write package descriptions to be informative for the users, to help them decide if they want to use the software. The use of GTK 3 is an implementation detail, and the software could be functionally the same if you were to cease using GTK 3. A Debian user, ideally, shouldn't need to know what GTK even is. I understand porting to GTK 3 likely took a lot of work and it's something to be proud of, but users are a different audience with different concerns.

• GTK 4 was released in 2020; why should new GTK 3 software be packaged?
• This revival effort looks *very* fresh: there have never been any issues or pull requests on the GitHub repository from anyone. How many users are there? How do we know that anyone wants this? What does this desktop environment have to offer, especially when compared to MATE or CDE? Do you use this software?
• The revision history is incomprehensible. There have only ever been 35 commits and almost half of them are "update README".
• There seems to be only a single upstream developer, an anonymous person "josejp2424" who has had their GitHub account for six months and is apparently the sole maintainer of another GNU/Linux distro

I'm not saying that's what this is, because I don't know... but this *looks* like AI slop at best, and a trojan horse for an xz-style backdoor at worst. There's over 70,000 lines of C code, and despite the proposed package name, this really is an entire desktop environment; how is anyone supposed to skim this code?

I cannot stop you from packaging this, but I urge you to explain your considerations with much more detail than the three sentences you've given.