Re: [Pkg-javascript-devel] Status of libv8?
Hi Jonas, On Fri, Jan 18, 2019 at 08:04:33PM +0100, Jonas Smedegaard wrote: > Quoting Andreas Tille (2019-01-18 18:39:34) > > I'd prefer > > > > - change nodejs to build its v8 as a shared lib, and provide it it > >makes sense because upstream nodejs do all the work of keeping ABI > >stability, > > The libv8 part of Nodejs is currently included in Debian as a _private_ > shared library part of libnode. > > I guess you can try link with that private library - as an alternative > to waiting for someone to refactor packages, have ftpmasters approve new > package names, and then have it available in experimental. I admit I do not understand what exactly I need to do to use that private shared library. I checked the content of the packages libnode-dev and libnode64 and did not found anything that looks like libv8. Could you give any more verbose hint how I can link against the private shared library you mentioned? Kind regards Andreas. -- http://fam-tille.de -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Status of libv8?
Le lun. 21 janv. 2019 à 10:08, Andreas Tille a écrit : > Hi Jonas, > > On Fri, Jan 18, 2019 at 08:04:33PM +0100, Jonas Smedegaard wrote: > > Quoting Andreas Tille (2019-01-18 18:39:34) > > > I'd prefer > > > > > > - change nodejs to build its v8 as a shared lib, and provide it it > > >makes sense because upstream nodejs do all the work of keeping ABI > > >stability, > > > > The libv8 part of Nodejs is currently included in Debian as a _private_ > > shared library part of libnode. > > > > I guess you can try link with that private library - as an alternative > > to waiting for someone to refactor packages, have ftpmasters approve new > > package names, and then have it available in experimental. > > I admit I do not understand what exactly I need to do to use that > private shared library. I checked the content of the packages > libnode-dev and libnode64 and did not found anything that looks > like libv8. Could you give any more verbose hint how I can link > against the private shared library you mentioned? > The headers are in libnode-dev /usr/include/nodejs/deps/v8/include/ and the link flag is -lnode (v8 being inside node). But can that work ? Jérémy -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Status of libv8?
Quoting Andreas Tille (2019-01-18 18:39:34) > I'd prefer > > - change nodejs to build its v8 as a shared lib, and provide it it >makes sense because upstream nodejs do all the work of keeping ABI >stability, The libv8 part of Nodejs is currently included in Debian as a _private_ shared library part of libnode. I guess you can try link with that private library - as an alternative to waiting for someone to refactor packages, have ftpmasters approve new package names, and then have it available in experimental. - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: signature -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Status of libv8?
On Fri, Jan 18, 2019 at 01:46:13PM +0100, Jérémy Lal wrote: > Le ven. 18 janv. 2019 à 13:04, Andreas Tille a écrit : > > > > > > Possible solutions (besides not using it at all): > > > - bundle it - nodejs bundles it > > > - change nodejs to build its v8 as a shared lib, and provide it > > > it makes sense because upstream nodejs do all the work of keeping ABI > > > stability, > > > backporting security fixes, choosing the right version, and so on. > > > - take over maintenance and distribute it independently of nodejs > > > > This sounds like a pretty sensible solution. I see you and Jonas are > > also uploaders for nodejs. It would be really great if you could do > > this. > > > Which one ? I'd prefer - change nodejs to build its v8 as a shared lib, and provide it it makes sense because upstream nodejs do all the work of keeping ABI stability, I admit I do not fully understand what you mean by - bundle it - nodejs bundles it (sounds similar to what you write above. I think the "take over maintenance and distribute it" has no real future considering that an RC bug in libv8 did not even received an answer. I guess the reason for this is that you have other things to play with. ;-) > Also i won't upload new nodejs versions until it goes to testing, of course. What about experimental for the moment? Kind regards Andreas. -- http://fam-tille.de -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Status of libv8?
Le ven. 18 janv. 2019 à 18:39, Andreas Tille a écrit : > On Fri, Jan 18, 2019 at 01:46:13PM +0100, Jérémy Lal wrote: > > Le ven. 18 janv. 2019 à 13:04, Andreas Tille a écrit > : > > > > > > > > Possible solutions (besides not using it at all): > > > > - bundle it - nodejs bundles it > > > > - change nodejs to build its v8 as a shared lib, and provide it > > > > it makes sense because upstream nodejs do all the work of keeping ABI > > > > stability, > > > > backporting security fixes, choosing the right version, and so on. > > > > - take over maintenance and distribute it independently of nodejs > > > > > > This sounds like a pretty sensible solution. I see you and Jonas are > > > also uploaders for nodejs. It would be really great if you could do > > > this. > > > > > Which one ? > > I'd prefer > > - change nodejs to build its v8 as a shared lib, and provide it > > >it makes sense because upstream nodejs do all the work of keeping ABI > > >stability, > > I admit I do not fully understand what you mean by > > - bundle it - nodejs bundles it > > (sounds similar to what you write above. > > I think the "take over maintenance and distribute it" has no real future > considering that an RC bug in libv8 did not even received an answer. I > guess the reason for this is that you have other things to play with. ;-) > > > Also i won't upload new nodejs versions until it goes to testing, of > course. > > What about experimental for the moment? > Yes, i will have a look at this. I have no idea how, for now. Jérémy -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Status of libv8?
Le ven. 18 janv. 2019 à 13:04, Andreas Tille a écrit : > Hi Jérémy, > > On Fri, Jan 18, 2019 at 11:51:38AM +0100, Jérémy Lal wrote: > > > However, when reading > > > > > >https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773671#59 > > > > > > it might rather the best idea to remove this lib from Debian at all and > > > I need to see how I can avoid depending from this package. > > > > Indeed, i am sorry for this bad state of things; i thought i could handle > > it, > > but obviously i couldn't. > > > > Possible solutions (besides not using it at all): > > - bundle it - nodejs bundles it > > - change nodejs to build its v8 as a shared lib, and provide it > > it makes sense because upstream nodejs do all the work of keeping ABI > > stability, > > backporting security fixes, choosing the right version, and so on. > > - take over maintenance and distribute it independently of nodejs > > This sounds like a pretty sensible solution. I see you and Jonas are > also uploaders for nodejs. It would be really great if you could do > this. > > Which one ? Also i won't upload new nodejs versions until it goes to testing, of course. Jérémy -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
Re: [Pkg-javascript-devel] Status of libv8?
Le ven. 18 janv. 2019 à 11:37, Andreas Tille a écrit : > Hi, > > I just realised that one of my packages does not migrate to testing due > to its dependency from r-cran-v8 and in turn from libv8-devel. I > realised that while libv8 has 3 security bugs which are set to > stretch-ignore (#760385, #773623, #773671 - should this somehow also be > set to buster-ignore??? - I had no idea that we ignore CVEs at all but > anyway) it probably can not migrate to testing since it does not even > build: > >#853512 libv8-3.14: ftbfs with GCC-7 > > This bug is RC since 6 months but there is no response from any > uploader. So I tried to clone the repository from Salsa and realised > that there is none at the place I would have expected > (https://salsa.debian.org/js-team/libv8). Is there any other place > (besides digging into Alioth archives where I could find the > repository?) I admit I'm not motivated to find out how to restore > old repositories but would rather use > >gbp import-dscs --ignore-repo-config --debsnap --pristine-tar libv8 > > instead. Any information about the status of this package would be > really welcome. > > However, when reading > >https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773671#59 > > it might rather the best idea to remove this lib from Debian at all and > I need to see how I can avoid depending from this package. > Indeed, i am sorry for this bad state of things; i thought i could handle it, but obviously i couldn't. Possible solutions (besides not using it at all): - bundle it - nodejs bundles it - change nodejs to build its v8 as a shared lib, and provide it it makes sense because upstream nodejs do all the work of keeping ABI stability, backporting security fixes, choosing the right version, and so on. - take over maintenance and distribute it independently of nodejs Jérémy -- Pkg-javascript-devel mailing list Pkg-javascript-devel@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
