Hi Michael, On Sun, 2015-01-04 20:20:40 +0100, Michael Haubenwallner <michael.haubenwall...@ssi-schaefer.com> wrote: > (CC'ing build machinery maintainers, maybe I should have done this initially)
Good point, that's my oversight and I'm quite undecided what to do. > Am 2014-12-31 um 11:45 schrieb Janne Blomqvist: > > On Fri, Dec 19, 2014 at 2:56 PM, Michael Haubenwallner > > <michael.haubenwall...@ssi-schaefer.com> wrote: > > > On the way to prepare some (aix) libtool patch for toplevel > > > libtool.m4 I've discovered that different versions of automake > > > were used to generate files across various libs: > > > > > > most libs: automake-1.11.1 > > > libatomic r211747: automake-1.11.6 > > > libgfortran r204654: automake-1.11.3 > > > r215741: automake-1.11.6 > > > > > > Doesn't feel like there were specific reasons to use newer > > > versions, but OTOH I've failed to find some docs on which > > > versions to use, so I'd be fine with updating others to 1.11.6 > > > instead as well. > > > > I'm far from an autotools expert, but one justification for > > updating to 1.11.6 would be CVE-2012-3386, see > > https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html . > > > > Whatever version we end up choosing, the docs should say it so > > that there won't be such misconceptions in the future, IMHO. > IMHO, changing an autotool's version in general should be up to > (review by) the build machinery maintainers. > > And it should be done across the whole tree, not just for various > subdirectories. > > However, each update listed here feels like happened by accident, > using the version installed on the more or less up-to-date host OS. > > Am 2014-12-28 um 05:20 schrieb Bernd Edlinger: > > On Fri, 19 Dec 2014 13:56:50, Michael Haubenwallner wrote: > > > > <text above> > > > > Michael proposes to change everything to automake-1.11.1. > > But the helper files "missing" and friends were updated to automake-1.14.1 > > by: > > > > 2014-11-16 Jan-Benedict Glaw <jbg...@lug-owl.de> > > > > * compile: Sync with upstream Automake. > > * depcomp: Ditto. > > * install-sh: Ditto. > > * missing: Ditto. > > * mkinstalldirs: Ditto. > > * ylwrap: Ditto. > > > > > > Actually I thought that was in preparation to move everything to > > automake 1.14.1 > > > > If I see that right, calling automake without parameters does not > > touch these helper files, but "automake --add-missing --copy > > --force-missing" would replace them with the copy from the > > automake installation additionally to just rewriting the > > Makefile.in. I actually updated `missing' by hand from upstream (thus sync'ing in the current upstream version), later on regenerated the files. So this is my fault to not keep proper tool's vs. helper files's versions together. > > I think we should have all automake files from the same version, > > either 1.11.1 or 1.14.1. > > > > What do you think? I think I totally agree. > Updating to 1.14 might require more work like updating some .in > files as well. I've seen automake-1.11 being explicitly used, so for > now we really want 1.11.6 eventually? Probably yes, we may want to stick to a well-known version. (Maybe another way could be to really upgrade to current versions, with is, I guess, more work than just sync files and rerun. That might be fruitful (ie. to not stick to older versions), but this is a change I don't see in the current stage.) To cut a long story short: * Do we actually see *problems* from the version inconsistencies already introduced by me and/or others? * ...and: Do we want to stick to known versions, or update if? (Probably not in such a late stage, though...) MfG, JBG -- Jan-Benedict Glaw jbg...@lug-owl.de +49-172-7608481 Signature of: 17:44 <@uschebit> Evangelist ist doch ein Vertriebler the second : für unverkäufliche Produkte, oder? (#korsett, 20120821)
signature.asc
Description: Digital signature
