[ruby-core:17422] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk

Urabe Shyouhei wrote:
> Igal Koshevoy wrote:
>   
>> Because the lastest SVN version seems to introduce API changes, trying
>> to fix it may be time consuming and stressful.
>>
>> I urge you to consider reviewing the submitted unofficial patches and
>> make a new release based on a well-known stable version of the code,
>> such as p111 or p114.
>>     
>
> No, I don't like that menu.  Please take a look at the ChangeLog.  All
> modifications applied to 1.8.6 are bugfixes.  You may think p114 was
> stable enough, but it wasn't than the current one.  I apologize for some
> of them being incomplete, but simply reverting them won't make you happy
To: Urabe Shyouhei

Thank you for the explanation.

We are grateful for the bug fixes, but this version seems to change the 
API. If the tests fail and API changes, then we can't deploy this 
version to our users because their applications won't work.

I respect your concerns and recognize that both options I listed are 
unpleasant, but urgency may require a compromised choice. Creating a 
backport against p111 or p114 using some of the submitted patches as 
guidance will make it possible to create a fully-compatible official 
solution within hours. In contrast, figuring out how to make the latest 
SVN version compatible can take days to weeks.

I realize that a backport using an older version may seem distasteful, 
but most people are using p36, p111, and p114 with selected patches. 
These older versions may have issues, but nothing that's so noticeable 
that it prevents them from being used, unlike the new versions.

For the sake of protecting Ruby's good image, I believe it's necessary 
to ship an *official* version that's compatible and addresses these 
vulnerabilities as soon as possible. After that's shipped, resolving the 
matter with the API changes in the current code will likely be a 
priority. If there's anything that we in the Ruby community can help you 
with, please ask. :)


To: All

If anyone can lend a, check out the RedMine ticket at 
[http://redmine.ruby-lang.org/issues/show/199]. It contains a 
mostly-automated set of commands for downloading, compiling the new 
Ruby, and running it against the various test suites. It also contains 
full logs of my test output which demonstrate how the new code is 
failing dozens of tests that the old stable releases passed. Please join 
me in trying to figure out what's wrong and filing bug reports so that 
the current Ruby branch can be improved.

-igal