From owner-svn-ports-all@FreeBSD.ORG Mon May 19 01:40:05 2014 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 860E0ACE; Mon, 19 May 2014 01:40:05 +0000 (UTC) Received: from mouf.net (mouf.net [IPv6:2607:fc50:0:4400:216:3eff:fe69:33b3]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mouf.net", Issuer "mouf.net" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4259A2F4E; Mon, 19 May 2014 01:40:05 +0000 (UTC) Received: from mouf.net (swills@mouf [199.48.129.64]) by mouf.net (8.14.5/8.14.5) with ESMTP id s4J1drUd013526 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 19 May 2014 01:39:58 GMT (envelope-from swills@mouf.net) Received: (from swills@localhost) by mouf.net (8.14.5/8.14.5/Submit) id s4J1dqlm013525; Mon, 19 May 2014 01:39:52 GMT (envelope-from swills) Date: Mon, 19 May 2014 01:39:52 +0000 From: Steve Wills To: Akinori MUSHA Subject: Re: svn commit: r354025 - in head/textproc/rubygem-nokogiri: . files Message-ID: <20140519013952.GB12777@mouf.net> References: <201405140650.s4E6oOMw059963@svn.freebsd.org> <20140516154153.GA59733@mouf.net> <86ppjcsbii.knu@iDaemons.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <86ppjcsbii.knu@iDaemons.org> User-Agent: Mutt/1.5.22 (2013-10-16) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.4.3 (mouf.net [199.48.129.64]); Mon, 19 May 2014 01:39:58 +0000 (UTC) X-Spam-Status: No, score=0.0 required=4.5 tests=none autolearn=unavailable version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on mouf.net X-Virus-Scanned: clamav-milter 0.98.1 at mouf.net X-Virus-Status: Clean Cc: svn-ports-head@freebsd.org, svn-ports-all@freebsd.org, ports-committers@freebsd.org X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 May 2014 01:40:05 -0000 On Sat, May 17, 2014 at 11:52:37PM +0900, Akinori MUSHA wrote: > At Fri, 16 May 2014 15:41:57 +0000, > Steve Wills wrote: > > This is not the correct fix. Please see attached. Please use this fix and > > remove rubygem-mini_portile from ports. The mini_portile gem does it's own > > installing of libraries and other things and this is not how we want ports to > > work, IMHO, so we really should avoid having it in port if possible. > > Our libxml2 was updated to 2.9.x after the recent security incidents, > but nokogiri does not fully support that version, i.e. some features > do not function properly. Using textproc/libxml2 worked only by > chance, that is, it was staying still at 2.8.0 while other > OS/distributions had migrated to 2.9.x a long time ago. > > I have to point out that libxml2 is notorious for not releasing a new > version even if a critical bug is found, so it's all up to each > distributor as to which set of patches they merge to their package, > investing their time to track the uptream git repository. > > Team Nokogiri has suffered so much with this, and concluded that there > is no way but to maintain its own version to avoid dealing with every > single platform dependent arbitrarily patched libxml2 installation. > Nokogiri uses a wide range of libxml2's features, and is thus subject > to be affected by a tiny incompatibility or bug/bug-fix in libxml2. > > Starting from 1.6.2, nokogiri explicitly suggests using bundled > libxml2/libxslt that are properly patched for the gem including > security problems instead of using some unknown version provided by > the platform. Thanks for the info, I wasn't aware of that. Wouldn't it be better to get the libxml2 from ports updated with the bug fixes instead of having one buggy version in ports and one non-buggy version bundled with nokogiri? Can you please send me the fixes that libxml2 needs? > Above is all I can tell you on behalf of Team Nokogiri, and if you > still believe it's not correct, not the way FreeBSD ports should take, > that's fine, you can "fix" it on your own, but please do not expect me > to do that against my will. > > Hopefully, when nokogiri is finally updated to support libxml2 2.9.1, > and if libxml2 stops neglecting their new releases, then the situation > may change, but I just can't recommend that at the moment. So are you saying nokogiri doesn't build with libxml2 2.9.1? Or doesn't work at all with libxml2 2.9.1? Or partially broken? Or is it not supported due to missing fixes, which we could easily add in ports? Steve P.S. Resending because I realized I forgot the CC on my reply, apologies for the duplicate mail.