Dear maintainer,

Your package still depends on the old, obsolete PCRE3[0] libraries
(i.e. libpcre3-dev). This has been end of life for a while now, and
upstream do not intend to fix any further bugs in it. Accordingly, I
would like to remove the pcre3 libraries from Debian, preferably in
time for the release of Bookworm.

The newer PCRE2 library was first released in 2015, and has been in
Debian since stretch. Upstream's documentation for PCRE2 is available
here: https://pcre.org/current/doc/html/

Many large projects that use PCRE have made the switch now (e.g. git,
php); it does involve some work, but we are now at the stage where
PCRE3 should not be used, particularly if it might ever be exposed to
untrusted input.

This mass bug filing was discussed on debian-devel@ in
https://lists.debian.org/debian-devel/2021/11/msg00176.html

Regards,

Matthew [0] Historical reasons mean that old PCRE is packaged as
pcre3 in Debian

tags 1000004 + help
thanks

Hello,

Le 18/11/2021 à 12:49, Matthew Vernon a écrit :

I had a look, and the new API looks very different. Is there a porting
guide somewhere?

Besides, I'm not sure it makes sense to port pcre-ocaml to pcre2 while
keeping the same OCaml API, which mimics the PCRE one. Moreover,
pcre-ocaml is widely used and has many reverse dependencies in Debian:

  approx
  ben
  caml-crush
  cduce
  coccinelle
  eliom
  galax
  liquidsoap
  mikmatch
  nurpawiki
  oasis
  ocaml-benchmark
  ocaml-cpu
  ocaml-duppy
  ocaml-expect
  ocaml-http
  ocaml-inifiles
  ocaml-lastfm
  ocaml-parany
  ocamldap
  ocamlmod
  ocamlnet
  ocamlrss
  ocsigenserver
  pxp
  xmlrpc-light

One solution could be to port these to another library (ocaml-re comes
to mind)... but this will take time, more than the Bookworm release
cycle I think.

I'm still unsure on which strategy to adopt.


Cheers,

Hi,

I'm afraid not - I did ask upstream to consider this
https://github.com/PhilipHazel/pcre2/issues/51 but I don't think one is
going to be forthcoming.

I don't know how tricky it will be to port pcre-ocaml to pcre2; I know a
number of languages have successfully ported their PCRE bindings to
PCRE2 (e.g. PHP who wrote about it
https://wiki.php.net/rfc/pcre2-migration ). The regex syntax itself
hasn't changed.

Regards,

Matthew

Hi,

Status update : I've started migrating reverse-dependencies to use the
pure-OCaml re library, which has a (imperfect) compatibility layer.
However, camlp5's upstream has expressed reluctance [1] to this move.

[1] https://github.com/camlp5/camlp5/issues/101#issuecomment-1678163219

Someone did the port of pcre-ocaml to pcre2 [2], which I've packaged as
pcre2-ocaml.

[2] https://github.com/mmottl/pcre-ocaml/issues/25#issuecomment-1483806201


Cheers,

Dear submitter,

as the package pcre-ocaml has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/1093087

The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.

Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Paul Tagliamonte (the ftpmaster behind the curtain)