Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Jakub Zelenka
Hi, On Thu, Feb 9, 2023 at 10:19 AM Max Kellermann wrote: > Hi, > > what happens if there is a bug in a vendored library, but upstream > refuses to fix it? > > Last month, my PR for removing obsolete C99 integer checks was merged: > > https://github.com/php/php-src/pull/10304 > > This change sp

Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Rowan Tommins
On Thu, 9 Feb 2023 at 16:05, Max Kellermann wrote: > > OK, that seems clear. As far as I can see, this is the first time on this > > thread or either of the PR threads that you've actually explained that > > violation. > > I explained it already: > > https://github.com/derickr/timelib/pull/141#i

Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Kamil Tekiela
Hi Max, On Thu, 9 Feb 2023 at 16:05, Max Kellermann wrote: > - Jan 19 7:49 PM: commit > https://github.com/php/php-src/commit/0df92d218e88a0 pushed to > php-src > > Look how the commit is exactly a revert of the timelib PR that Derick > Rethans closed and locked just the day before. > Ahh

Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Max Kellermann
On 2023/02/09 16:29, Rowan Tommins wrote: > This is where I'm suggesting you assume good faith: what looks like a > "secret revert" probably feels like something entirely different to Derick. Timeline: - Jan 13 11:34 AM: PR https://github.com/derickr/timelib/pull/141/files - Jan 18 4:34 PM: PR

Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Rowan Tommins
On Thu, 9 Feb 2023 at 13:14, Max Kellermann wrote: > The issue still exists, and I'm here > for your advice on how to resolve this. I'm desperate. > Is this a critical security issue? If not, there's no need to be desperate; just take a breath, explain what you were trying to achieve, and be g

Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Max Kellermann
On 2023/02/09 14:49, Michael Voříšek - ČVUT FJFI wrote: > One good way to maintain some quality standard is to enforce it thru CI Agree, the CI is a nice tool for enforcing certain policies, but first there needs to be a decision on what is the desired quality standard. Finding such a decision i

Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Michael Voříšek - ČVUT FJFI
One good way to maintain some quality standard is to enforce it thru CI :) This also applies to https://github.com/php/php-src/pull/10549/files and https://github.com/php/php-src/pull/10531/files for example, such problems should fail the CI and enforce the contributors to fix the code before t

Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Max Kellermann
On 2023/02/09 13:37, Rowan Tommins wrote: > Firstly, let's try to keep this discussion civil, and assume good faith on > both sides. Parts of your e-mail read like accusations of bad behaviour, > rather than genuinely trying to understand what happened, and how we can > collectively avoid it happe

Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread David CARLIER
Hi, On Thu, 9 Feb 2023 at 12:38, Rowan Tommins wrote: > On Thu, 9 Feb 2023 at 10:19, Max Kellermann wrote: > > > Hi, > > > > > Firstly, let's try to keep this discussion civil, and assume good faith on > both sides. > > > That a kind of constant with you, Max, through your PR too. If you could

Re: [PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Rowan Tommins
On Thu, 9 Feb 2023 at 10:19, Max Kellermann wrote: > Hi, > > what happens if there is a bug in a vendored library, but upstream > refuses to fix it? > I don't have an answer to the procedural question, or the specific technical issue, but I would like to say three things: Firstly, let's try to

[PHP-DEV] How to deal with bugs in vendored libraries?

2023-02-09 Thread Max Kellermann
Hi, what happens if there is a bug in a vendored library, but upstream refuses to fix it? Last month, my PR for removing obsolete C99 integer checks was merged: https://github.com/php/php-src/pull/10304 This change speeds up configure and removes code that violates the C99 spec. It included a