From: Urabe Shyouhei <shyouhei@...>
Date: 2010-09-10T10:52:56+09:00
Subject: [ruby-core:32275] Re: Can we convert the standard library to gems?

I'm off today so sorry if I missed some mails.

(2010/09/10 6:53), Ryan Davis wrote:
>> But, Urabe san said, full release is needed even if "gem update"
>> can be used.
> 
> Then we need to change Urabe's mind. I think his argument does more harm than good by delaying fixes in order to coordinate full releases. If ruby+gem installs do an automated update at the end of install, then there is NO reason why security fixes should be delayed for full releases.

1) Being able to do "gem update" on stdlibs seems to be a good thing to have.
I'm not against on that point now.

2) Besides that, every security issues should be addressed on our canonical
distributions, because:

2-1) Not all of ruby users use gem.  A Linux system without internet
connection might not be practical, but a ruby installation without one is a
real usage today.

2-2) I don't think we (core team) can handle occasional updates of such gems
like Debian does.  We ought to miss something.

3) Anyway, you might be surprised to hear (esp. from me) that a full release
is not a real problem.  To make a release is as easy as "make dist".  The real
headache is to coordinate one.  And I suspect that coordination will not leave
our hands...  Who wants to nurse WEBrick?



In one word: a full release is needed anyway and it will not make a fix delay.