Bug#1000004: pcre-ocaml: depends on obsolete pcre3 library

[Stéphane Glondu <glondu@debian.org>]

tags 1000004 + help
thanks

Hello,

Le 18/11/2021 à 12:49, Matthew Vernon a écrit :
> Your package still depends on the old, obsolete PCRE3[0] libraries
> (i.e. libpcre3-dev). This has been end of life for a while now, and
> upstream do not intend to fix any further bugs in it. Accordingly, I
> would like to remove the pcre3 libraries from Debian, preferably in
> time for the release of Bookworm.
> 
> The newer PCRE2 library was first released in 2015, and has been in
> Debian since stretch. Upstream's documentation for PCRE2 is available
> here: https://pcre.org/current/doc/html/
> 
> Many large projects that use PCRE have made the switch now (e.g. git,
> php); it does involve some work, but we are now at the stage where
> PCRE3 should not be used, particularly if it might ever be exposed to
> untrusted input.

I had a look, and the new API looks very different. Is there a porting
guide somewhere?

Besides, I'm not sure it makes sense to port pcre-ocaml to pcre2 while
keeping the same OCaml API, which mimics the PCRE one. Moreover,
pcre-ocaml is widely used and has many reverse dependencies in Debian:

  approx
  ben
  caml-crush
  cduce
  coccinelle
  eliom
  galax
  liquidsoap
  mikmatch
  nurpawiki
  oasis
  ocaml-benchmark
  ocaml-cpu
  ocaml-duppy
  ocaml-expect
  ocaml-http
  ocaml-inifiles
  ocaml-lastfm
  ocaml-parany
  ocamldap
  ocamlmod
  ocamlnet
  ocamlrss
  ocsigenserver
  pxp
  xmlrpc-light

One solution could be to port these to another library (ocaml-re comes
to mind)... but this will take time, more than the Bookworm release
cycle I think.

I'm still unsure on which strategy to adopt.


Cheers,

-- 
Stéphane