Welcome! Log In Create A New Profile

Advanced

[PHP-DEV] [RFC] orphan extensions cleanup

Posted by Stanislav Malyshev 
Christoph M. Becker
Re: [PHP-DEV] Re: [RFC] orphan extensions cleanup
June 14, 2018 04:10PM
On 14.06.2018 at 00:47, Stanislav Malyshev wrote:

>> That said, in my opinion it is too late for 7.3 to move a bundled
>> extension to PECL, except perhaps for unresolved or even unresolvable
>> security reasons. ext/wddx comes to mind, and maybe there are others.
>
> I'd be happy to move wddx if nobody steps up to maintain it. It has tons
> of security issues lately (not even sure all are fixed) and it hard to
> make heads or tails in it without really deep dive, for which I don't
> think I have time, and nobody else seems to. And since it's a kinda
> obscure format which in 99% of cases can be replaced by json I suspect...

*Deprecation* of ext/wddx is part of the “Deprecations for PHP 7.3”
RFC[1] draft. Are you planning to pursue this RFC, Nikita?

Anyhow, I think moving ext/wddx to PECL for PHP 7.3 might be preferable
to a deprecation phase, given that we had discussed this almost a year
before[2], and already had an RFC which would only have deprecated the
object deserialization[3] withdrawn, but had not actually made any progress.

[1] https://wiki.php.net/rfc/deprecations_php_7_3
[2] https://externals.io/message/100183
[3] https://wiki.php.net/rfc/wddx-deprecate-class-instance-deserialization

--
Christoph M. Becker

--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php
Nikita Popov
Re: [PHP-DEV] Re: [RFC] orphan extensions cleanup
June 14, 2018 04:30PM
On Thu, Jun 14, 2018 at 4:00 PM, Christoph M. Becker <[email protected]>
wrote:

> On 14.06.2018 at 00:47, Stanislav Malyshev wrote:
>
> >> That said, in my opinion it is too late for 7.3 to move a bundled
> >> extension to PECL, except perhaps for unresolved or even unresolvable
> >> security reasons. ext/wddx comes to mind, and maybe there are others.
> >
> > I'd be happy to move wddx if nobody steps up to maintain it. It has tons
> > of security issues lately (not even sure all are fixed) and it hard to
> > make heads or tails in it without really deep dive, for which I don't
> > think I have time, and nobody else seems to. And since it's a kinda
> > obscure format which in 99% of cases can be replaced by json I suspect....
>
> *Deprecation* of ext/wddx is part of the “Deprecations for PHP 7.3”
> RFC[1] draft. Are you planning to pursue this RFC, Nikita?
>

Thanks for the reminder, I do plan to pick this up. I'll try to submit this
RFC as soon as possible.


> Anyhow, I think moving ext/wddx to PECL for PHP 7.3 might be preferable
> to a deprecation phase, given that we had discussed this almost a year
> before[2], and already had an RFC which would only have deprecated the
> object deserialization[3] withdrawn, but had not actually made any
> progress.
>

I think our general procedure is to always deprecate prior to moving to
PECL, to ensure that the PECL use also throws deprecation warnings (it is
an unmaintained extension at that point after all).

I'd personally be fine with deprecate+move in 7.3 though, for all the
reasons we discussed last time.

Nikita
Johannes Schlüter
Re: [PHP-DEV] Re: [RFC] orphan extensions cleanup
June 19, 2018 02:40PM
Hi,

On Di, 2018-06-12 at 13:54 +0200, Christoph M. Becker wrote:

> > https://wiki.php.net/rfc/umaintained_extensions
>
> I think it is *very* important to finally tackle this topic.  Since
> it


It's a good subject to think about, but we should be careful not to end
with a process and then following it without thought and we have to
look at those things individually.

For instance with readline this contains two things. For one the
`readline()` and related userspace functions, which I assume are not
used thaaaat often, but also the interactive shell mode (`php -a` with
CLI+readline enabled) and I think the later is quie important to many
users and should see similar common responsibility as those key SAPIs,
main/ and so on. (I once moved that functionality from SAPI/cli to
ext/readline to satisfy distributors who didn't want to statically link
readline for license and related reasons)

johannes

--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php
Yasuo Ohgaki
Re: [PHP-DEV] Re: [RFC] orphan extensions cleanup
June 19, 2018 03:30PM
On Tue, Jun 19, 2018 at 9:37 PM, Johannes Schlüter <[email protected]>
wrote:

> Hi,
>
> On Di, 2018-06-12 at 13:54 +0200, Christoph M. Becker wrote:
>
> > > https://wiki.php.net/rfc/umaintained_extensions
> >
> > I think it is *very* important to finally tackle this topic. Since
> > it
>
>
> It's a good subject to think about, but we should be careful not to end
> with a process and then following it without thought and we have to
> look at those things individually.
>
> For instance with readline this contains two things. For one the
> `readline()` and related userspace functions, which I assume are not
> used thaaaat often, but also the interactive shell mode (`php -a` with
> CLI+readline enabled) and I think the later is quie important to many
> users and should see similar common responsibility as those key SAPIs,
> main/ and so on. (I once moved that functionality from SAPI/cli to
> ext/readline to satisfy distributors who didn't want to statically link
> readline for license and related reasons)
>
> johannes


CLI without readline isn't good.
--with-libedit is there to replace readline lib.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net
Sorry, only registered users may post in this forum.

Click here to login