Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:119508
MIME-Version: 1.0
References: <Y+TIlliuIwRyZX8L@swift.blarg.de> <CALKiJKrxkUP_9H+xiw+_=1qh+=4eJhSNNowFToAJDJ7x+FQN2Q@mail.gmail.com>
 <Y+TxnQXFbIzaa+za@swift.blarg.de>
In-Reply-To: <Y+TxnQXFbIzaa+za@swift.blarg.de>
Date: Thu, 9 Feb 2023 15:29:59 +0000
Message-ID: <CALKiJKqHCP7=Z8nTWhb5rxQXBSzPX5DPXWNWpoVtovX4Q59M0A@mail.gmail.com>
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary="00000000000080bb9105f4460e50"
Subject: Re: [PHP-DEV] How to deal with bugs in vendored libraries?
From: rowan.collins@gmail.com (Rowan Tommins)

--00000000000080bb9105f4460e50
Content-Type: text/plain; charset="UTF-8"

On Thu, 9 Feb 2023 at 13:14, Max Kellermann <max+php@blarg.de> wrote:

> The issue still exists, and I'm here
> for your advice on how to resolve this.  I'm desperate.
>


Is this a critical security issue? If not, there's no need to be desperate;
just take a breath, explain what you were trying to achieve, and be
genuinely open to discussion and suggestions. In your head, I'm sure it's
very clear what you're working on, and why it's the right thing to do; but
clearly, it doesn't seem as obvious to everyone involved.



> That's why I asked whether "secret" reverts without discussion are
> considered good behavior.  Maybe you believe maintainers should do
> that - but that would be surprising for me.
>


This is where I'm suggesting you assume good faith: what looks like a
"secret revert" probably feels like something entirely different to Derick.



>
> > Thirdly, it's not clear to me which of the following statements is true
> of
> > this change, and it might help the conversation to clarify more
> precisely:
> > a) The code you removed *violates* the C99 spec?
>
> This.  The code in question declares typedefs that are reserved words
> in the C99 spec section 7.26.8; not just reserved, they conflict with
> actual typedefs from <stdint.h>.
>


OK, that seems clear. As far as I can see, this is the first time on this
thread or either of the PR threads that you've actually explained that
violation.


> b) The code you removed is *guaranteed to be pointless* under the C99 spec
> > (but does not violate it)?
>
> No.  It is not pointless.  Those declarations occupy reserved words,
> and that is not allowed.
>


OK, so follow-up question: what gives you confidence that the change is
*safe*? Sometimes, technical violations of a spec are necessary for the
practical realities of the situation. I think you've answered this question
in the PR thread, but I'm trying to get the explanation all in one place,
because you've mentioned different details at different times.

Regards,
-- 
Rowan Tommins
[IMSoP]

--00000000000080bb9105f4460e50--