On 2023-10-14 00:08, ASSI via Cygwin-apps wrote:
Cygwin nghttp2 Maintainer via Cygwin-announce writes:
* libnghttp2_14 1.57
This library pulls in a lot of build dependencies, but then does not
have any actual dependencies on anything. You seem to be building a
static library? If so, please stop doing that.
As the library is dynamically linked from its utilities, curl and wget2 and
their libraries, it is obviously not static, it is merely independent and
self-contained, as with any well designed library!
It would be more helpful if, rather than stating an assumption, and telling me
to stop (something? - maintaining the package?), you explained why you perceive
an issue, and how I could detect, diagnose, prevent, and correct the issue you
perceive.
The /library/ package libnghttp2_14 and cygnghttp2_14.dll do not pull in
dependencies, but the *utilities* package nghttp2 does, as do its main users
curl and wget2 and their libraries, and the 140+ packages that use it and/or
libcurl4; see:
https://cygwin.com/packages/summary/nghttp2-src.html
https://cygwin.com/packages/summary/nghttp2.html
https://cygwin.com/cgit/cygwin-packages/nghttp2/
https://cygwin.com/cgi-bin2/jobs.cgi?srcpkg=nghttp2
https://cygwin.com/cgi-bin2/jobs.cgi?srcpkg=mingw64-x86_64-nghttp2
and linked commits, updates, patches, and build logs.
Curl and (lib)nghttp2 had high/critical/0day security vulnerabilities disclosed
and widely publicised this week, requiring immediate attention, and this package
had Cygwin and Mingw build problems, which I hacked to get them to build, check,
upload, and announce ASAP.
I have since been working to refactor and rationalize patches to submit
upstream.
So it is not unreasonable for you or me to suspect there may be issues with
these "prompt" releases.
If you think there are any issues with this or any of my packages, please
explain to me any issue you see, and perhaps suggest how to, or a better
approach to, detect, diagnose, or prevent the issue(s), and to deal with them.
I will put in the effort to learn, and do the work required, to correct and
improve my approach and results!
[Life should be about doing, learning, improving, and *enjoying* the journey!]
--
Take care. Thanks, Brian Inglis Calgary, Alberta, Canada
La perfection est atteinte Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer but when there is no more to cut
-- Antoine de Saint-Exupéry
