Mailing List Archive

Re: removal of PCRE
On 16 Jan 2008, at 13:53, John Jetmore wrote:
> Is this a good idea? Is the motivation primarily ease of
> maintenance or
> is there perceived value to the end user? This change will
> significantly
> increase my own server maintenance and I don't even maintain that many
> servers. I love the fact that exim has always been self contained if
> desired.

Its definitely an ease of maintenance win - we don't have to track PCRE
releases (there has been another one since 4.69 came out).

I would argue its also a win for the end user/admin as they then know
that they have to maintain PCRE on a box, and if there is an issue with
that package they just need to update PCRE rather than potentially exim,
php, java...

Additionally the vast majority of exim installations I believe already
patch out the embedded PCRE and use a system one (for example this is
done on all the linux distros I have checked).

This is basically the same argument we saw 10ish years ago relating to
moving to using GIF or DB libraries rather than compiling the code into
your package.

> If there's already been a discussion of this let me know and I'll
> revie
> but I don't remember seeing it.

I have discussed this with a few people, but it was off-list. I did put
it in the 4.69 release information.

> My gut feeling is that this is related to some security fixes that
> forced
> pushing out the last release before it really had anything good in
> it and
> before the release process was streamlined, but it kind of feels
> like a
> web form that doesn't allow dashes in a credit card number - saved the
> developer 5 minutes but collectively cost the end users hours/days/
> years
> depending on how popular it is.

How many systems actually don't have PCRE available as a system library
- for heavens sake its even in Solaris (SUNWpcre package) - and they
have a 1980s runtime.

Nigel.

--
[ Nigel Metheringham Nigel.Metheringham@InTechnology.co.uk ]
[. - Comments in this message are my own and not ITO opinion/policy - ]


--
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
Re: removal of PCRE [ In reply to ]
FWIW, I used to be a "roll-my-own" exim user. But as once decent rpm's
and other packaged versions came along I moved across to those, usually
making some changes to the .spec file to suit my needs (especially once
Fedora dropped support for SA-Exim.....)

If I was still roll-my-own, I'd nevertheless support this move.

Mike

John Jetmore wrote:
> On Thu, 17 Jan 2008, Nigel Metheringham wrote:
>
>> How many systems actually don't have PCRE available as a system library
>> - for heavens sake its even in Solaris (SUNWpcre package) - and they
>> have a 1980s runtime.
>
> I was going to mention the Solaris 2.5.1 box I have Exim on. But I just
> remembered I was finally allowed to decom that box a month ago, which
> fills me with great joy.
>
> I'm not going to put up a fight here - I acknowledge this will reduce the
> strain on packagers (since they won't have to maintain their own patches
> to use an external library) and will generally be a win for people who use
> distribution packages for everything. I don't do this but my intention
> was not to complain about work to me, but to the userbase as a whole.
>
> I'm not convinced of Exim's use demographics, but if you guys (who are
> doing the real work) feel that this is truly a win for the majority of the
> users and not just pushing developer work off to end users then I can
> accept that.
>
> Thanks
> --John
>

--
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
Re: removal of PCRE [ In reply to ]
Mike Pellatt <mike@pellatt.co.uk> said
(on Thu, Jan 17, 2008 at 03:47:40PM +0000):
> FWIW, I used to be a "roll-my-own" exim user. But as once decent rpm's
> and other packaged versions came along I moved across to those,
> [...]
> If I was still roll-my-own, I'd nevertheless support this move.

I'm the same, on the boxes I own.

However, there is a non-techie issue worth saying explicitly...

I've introduced exim as the MTA-of-choice to clients who like to
security-approve[1] all installed programs, and typically they build from
source to avoid introducing extra potential security holes which may creep
in at the packaging step.

If PCRE is going to be a separate install, then it probably means an extra
(potentially show-stopping, time-taking, bureaucractic, possibly redundant)
hoop or two to jump through to get it security approved in those organisations.

Such exim users can be good adverts for exim's widespread use (one client
was a very large ISP), and forcing them to try to consider this extra
paperwork should be considered a small risk.

On balance, though, I'm definitely *for* the de-coupling.


[1] not look at the code, exactly, but have security/risk documentation
to say that they've considered doing so ;-)
--
Geraint A. Edwards (aka "Gedge")
gedge@yadn.org

--
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
Re: removal of PCRE [ In reply to ]
On Thu, 17 Jan 2008, Mike Pellatt wrote:
>
> FWIW, I used to be a "roll-my-own" exim user.

I still am :-) The PCRE build is easy and doesn't have the kinds of bugs I
often find in configure scripts, so I didn't have any problems updating my
Exim build script to cope with an external PCRE.

Tony.
--
<fanf@exim.org> <dot@dotat.at> http://dotat.at/ ${sg{\N${sg{\
N\}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}\
\N}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}

--
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
Re: removal of PCRE [ In reply to ]
On 1/22/08 11:29 AM, "Tony Finch" <dot@dotat.at> wrote:

> On Thu, 17 Jan 2008, Mike Pellatt wrote:
>>
>> FWIW, I used to be a "roll-my-own" exim user.
>
> I still am :-) The PCRE build is easy and doesn't have the kinds of bugs I
> often find in configure scripts, so I didn't have any problems updating my
> Exim build script to cope with an external PCRE.

And we're a mix. On servers with generic needs, we use the Exim which the
current CentOS distribution supplies. Or even let sendmail do the work. On
the inbound and outbound and submission machines, we build Exim from source
to our needs.

I have no problem with removing PCRE from the Exim source.

At one time, having it embedded was somewhere on the scale from "tolerable"
to "a good idea". I think that ended when maintenance of PCRE and
maintenance of Exim ceased to be done by the same person (happy retirement,
Philip!).

--John



--
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##