Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103171
MIME-Version: 1.0
References: <381a49ae-eed5-889a-8d0c-bec4b4531d82@gmx.de>
In-Reply-To: <381a49ae-eed5-889a-8d0c-bec4b4531d82@gmx.de>
Date: Mon, 17 Sep 2018 19:07:27 +0200
Message-ID: <CAF+90c-8TS9JGRPC2dtjFzpr4494whXJ5g=7P97iEz3gu-DXfw@mail.gmail.com>
To: Christoph Becker <cmbecker69@gmx.de>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000e110b705761435ce"
Subject: Re: [PHP-DEV] Unbundle libsqlite3?
From: nikita.ppv@gmail.com (Nikita Popov)

--000000000000e110b705761435ce
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Sep 17, 2018 at 3:16 PM Christoph M. Becker <cmbecker69@gmx.de>
wrote:

> Hi!
>
> We bundle an unmodified libsqlite3 for at least two years.  Since then
> all updates go into any dev, alpha and beta releases, while security
> patches (usually backports from libsqlite3) go into stable branches.
>
> ext/sqlite3 requires libsqlite =E2=89=A5 3.3.9[1] which has been released=
 on
> 2007-01-04[2] (i.e. more than eleven years ago!).  ext/pdo_sqlite has no
> specific version requirement; there is a check for sqlite3_open()[3]
> which I believe is available since 3.0.0.
>
> So is there any particular reason why we still bundle libsqlite3?
>
> [1]
> <
> https://github.com/php/php-src/blob/php-7.3.0RC1/ext/sqlite3/config0.m4#L=
37-L47
> >
> [2] <https://sqlite.org/oldnews.html#2007_01_04>
> [3]
> <
> https://github.com/php/php-src/blob/php-7.3.0RC1/ext/pdo_sqlite/config.m4=
#L55-L58
> >
>

+1 on unbundling libsqlite. If we a) don't patch a library and b) it is
widely available in distros, then we have no business bundling the library.
Bundled libraries are extra maintenance work for us and a security risk for
users (we are slower at updating bundled libraries than distros).

Three more libraries that we (as far as I know) bundle without modification
are:
 * libzip: Unbundling was already planned for 7.3 but held up due to some
CI issues. Next try at https://github.com/php/php-src/pull/3532.
 * oniguruma
 * pcre

I'm not sure how widely available libonig and libpcre2 are.

Nikita

--000000000000e110b705761435ce--