svn commit: r354025 - in head/textproc/rubygem-nokogiri: . files

[Akinori MUSHA]

At Fri, 16 May 2014 15:41:57 +0000,
Steve Wills wrote:
> This is not the correct fix. Please see attached. Please use this fix and
> remove rubygem-mini_portile from ports. The mini_portile gem does it's own
> installing of libraries and other things and this is not how we want ports to
> work, IMHO, so we really should avoid having it in port if possible.

Our libxml2 was updated to 2.9.x after the recent security incidents,
but nokogiri does not fully support that version, i.e. some features
do not function properly.  Using textproc/libxml2 worked only by
chance, that is, it was staying still at 2.8.0 while other
OS/distributions had migrated to 2.9.x a long time ago.

I have to point out that libxml2 is notorious for not releasing a new
version even if a critical bug is found, so it's all up to each
distributor as to which set of patches they merge to their package,
investing their time to track the uptream git repository.

Team Nokogiri has suffered so much with this, and concluded that there
is no way but to maintain its own version to avoid dealing with every
single platform dependent arbitrarily patched libxml2 installation.
Nokogiri uses a wide range of libxml2's features, and is thus subject
to be affected by a tiny incompatibility or bug/bug-fix in libxml2.

Starting from 1.6.2, nokogiri explicitly suggests using bundled
libxml2/libxslt that are properly patched for the gem including
security problems instead of using some unknown version provided by
the platform.

Above is all I can tell you on behalf of Team Nokogiri, and if you
still believe it's not correct, not the way FreeBSD ports should take,
that's fine, you can "fix" it on your own, but please do not expect me
to do that against my will.

Hopefully, when nokogiri is finally updated to support libxml2 2.9.1,
and if libxml2 stops neglecting their new releases, then the situation
may change, but I just can't recommend that at the moment.

--
Akinori MUSHA / https://akinori.org/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP Digital Signature
URL: <http://lists.freebsd.org/pipermail/svn-ports-all/attachments/20140517/67bd5c62/attachment.sig>