Re: autoconf-2.62 doesn't build on RHEL4

[Eric Blake]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

According to Ralf Corsepius on 4/21/2008 11:49 PM:
| I am not upgrading the distro. I want to enable to developers to work on
| my sources. Therefore, I am shipping autoconf+automake add-on packages
| (Installed to /opt/...).
|
| ... now, autoconf is forcing me to also ship gm4.
|
| To me, this is a massive regression on autoconf's part.

I'm sorry you feel this is a regression, but autoconf has required gm4 for
ages, and only now are we enforcing that gm4 is new enough to not silently
generate broken configure files.

|
| What will be next - bash-X, gawk-Y?

No.  The resulting configure scripts do not depend on a particular bash or
gawk version, so why should autoconf itself?  In other words, it could be
considered a regression if we added a dependence on a tool that we had not
previously depended on.  But we have depended on working gm4 and perl for
YEARS.

|
| These distros are ultra-conservative, ... security fixes only, and
| hardly any upgrades ever.

And m4 1.4.4 and earlier have KNOWN security bugs.  Your distro is doing
you a disservice by not upgrading it.  Even m4 1.4.10 has a known stack
overrun/arbitrary code execution bug when abusing the -F option that was
only fixed in 1.4.11.  And guess what - autoconf uses the -F option (at
least autoconf doesn't tickle the m4 bug in the normal use case of
portable file names).

- --
Don't work too hard, make some time for fun as well!

Eric Blake             address@hidden
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkgN138ACgkQ84KuGfSFAYBN3gCg1DaVTF3WSJ6Z3oBJUpj2lRk2
GxQAnA4WcbZRpaQkJJfOP7yqoVYXZMuM
=vgD3
-----END PGP SIGNATURE-----