Re: [gentoo-dev] the state of dev-lang/lua

["Michał Górny" <mgorny@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 2038 bytes --]

On Sun, 2019-03-24 at 12:44 -0500, William Hubbs wrote:
> On Sun, Mar 24, 2019 at 02:26:35PM +0100, Andreas K. Huettel wrote:
> > Am Samstag, 23. März 2019, 22:23:27 CET schrieb William Hubbs:
> > > Hi all,
> > > 
> > > Soon I will be working on fixing up the state of dev-lang/lua, and there
> > > are a couple of things I want to mention.
> > > 
> > > The first thing is liblua as a shared library. If you are using lua
> > > internally in a program, upstream strongly recommends not linking it
> > > this way; it is supposed to be statically linked into the executable.
> > > Because of this, and because of the amount of custom patching we do to
> > > maintain liblua as a shared library, I plan to stop creating the shared
> > > library.
> > > 
> > 
> > Please dont. Static linking is a security nightmare.
> > 
> > I'd much rather consider removing the static library, and fix programs broken 
> > by that. (No matter what silly opinions lua upstream has.)
> 
> Here is what upstream says, so let me know how you interpret it.
> 
> http://www.lua.org/manual/5.3/readme.html

They don't provide any rationale, and they say to use shared libraries
on Windows.  To me, it looks like they didn't want to figure out how to
build shared libs for various unix flavors, and took the easy way out.

> Also, there is this in our ebuilds:
> 
> # Using dynamic linked lua is not recommended for performance
> # reasons. http://article.gmane.org/gmane.comp.lang.lua.general/18519
> # Mainly, this is of concern if your arch is poor with GPRs, like x86
> # Note that this only affects the interpreter binary (named lua), not the lua
> # compiler (built statically) nor the lua libraries (both shared and static
> # are installed)
> 
> It looks like the link is dead, so I don't have any idea what
> performance issues they are talking about.
> 

Probably the performance loss resulting from use of -fPIC.  Which we're
forcing anyway nowadays, so no loss to us.

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 963 bytes --]