Re: RFC: Bump minimum Perl to 5.18.0 for next major release of both Autoconf and Automake

[Paul Eggert]

On 1/29/21 12:03 PM, Zack Weinberg wrote:

> Perl 5.18.0 was released in May 2013.  (Perl 5.6.0 was released in
> March 2000.)  I selected it as the minimum because the Perl
> maintainers recommend all users of older interpreters upgrade to at
> least this version, due to security fixes (see
> https://perldoc.perl.org/perlsec#Algorithmic-Complexity-Attacks --
> inputs to Autoconf and Automake are trusted, but this rationale means
> it's hard to find a CI platform that offers anything older than 5.18,

This seems pretty conclusive.

The laggards in this area are the old, stable software distros like Red 
Hat. For example, although RHEL 7.7 (supported through August) still 
ships with Perl 5.16.3 (with patches), Red Hat ships and supports Perl 
5.30.1 for this platform as part of the Red Hat Software Collections. I 
would hope for something similar among the other distros.

An extreme case of this would be Solaris 10, still shipping perl 5.8.4 
(2004) with patches, and still supported by Oracle until January 2024. 
But anyone who wants to build on this old platform already needs to 
bring in recent-enough GNU m4, so adding Perl to the list shouldn't faze 
them much.