On Mon, Oct 09, 2006 at 08:22:25PM -0700, Mark Mitchell wrote: > Kaveh R. GHAZI wrote: > >Has there been any thought to including GMP/MPFR in the GCC repository > >like we do for zlib and intl? > > I do not think we should be including more such packages in the GCC > repository. It's complicated from an FSF perspective and it bloats our > software. GCC is a complicated piece of software, and to build it you > need a lot of stuff installed on your system. I think we should just > accept that. :-)
Should we consider removing zlib and intl? In particular, zlib 1.2.3 was released on 19 Jul 05 and included 2 fixes for security issues. GCC did not update zlib until 12 Sep 05. Whether the security issues in GCC's version of zlib could be exploited, I do not know. I do know a 2 month lag time seems inappropriate. > I do think we should do is provide a known-good version (whether via a > tag in some version control system, or via a tarball) of these libraries > so that people can easily get versions that work. I support this position. Unfortunately, the first patch I submitted (several months ago) that upped the requirement to mpfr 2.2.0 for gfortran resulted in several people expressing objections about requiring a newer version of mpfr. In fact, I suspect the only reason that my recent changes to toplevel configure to require 2.2.0 were accepted is because I had 2 gfortran bug fixes that required that version. -- Steve
