public inbox for [email protected]help / color / mirror / Atom feed
PLV8 yum packages 3+ messages / 2 participants [nested] [flat]
* PLV8 yum packages @ 2018-02-26 19:03 Jerry Sievert <[email protected]> 2018-02-26 21:23 ` Re: PLV8 yum packages Devrim Gündüz <[email protected]> 0 siblings, 1 reply; 3+ messages in thread From: Jerry Sievert @ 2018-02-26 19:03 UTC (permalink / raw) To: pgsql-pkg-yum Hi, I’m the maintainer of PLV8, and I’m wondering what it will take to get the postgres yum repositories up to date. There are a couple of things that you need to know: 1) V8 was affected by Spectre/Meltdown, and the version that has the remediation is 6.4.388.40 2) the version of v8 that the official postgres yum repos use is 3.14, which is 5 years out of date, and only compiles against the unsupported 1.4 branch of plv8 (current is 2.3.0) 3) the v8 build system no longer supports shared object creation under linux (this is a big one), and thus plv8 has moved to a static build by default, leaving a make shared for platforms that can still build (I believe they have managed to not break the older build system for macOS, but that seems to be it) So, given all of that, I’m hoping we can work together to get plv8 updated on the yum repos. There have been a huge amount of changes over the last 5 years, ranging from major speed increases, updated language for es6/es7, and bug fixes (I back port any security issues to the 1.4 and 1.5 branches, but the v8 api is no longer compatible). Please let me know how I can help, it would be great to see plv8 in the modern world. Thanks! Attachments: [application/pgp-signature] signature.asc (833B, 2-signature.asc) download ^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: PLV8 yum packages 2018-02-26 19:03 PLV8 yum packages Jerry Sievert <[email protected]> @ 2018-02-26 21:23 ` Devrim Gündüz <[email protected]> 2018-02-26 21:39 ` Re: PLV8 yum packages Jerry Sievert <[email protected]> 0 siblings, 1 reply; 3+ messages in thread From: Devrim Gündüz @ 2018-02-26 21:23 UTC (permalink / raw) To: Jerry Sievert <[email protected]>; pgsql-pkg-yum Hi Herry, On Mon, 2018-02-26 at 11:03 -0800, Jerry Sievert wrote: > I’m the maintainer of PLV8, Nice to e-meet you! > and I’m wondering what it will take to get the postgres yum repositories up > to date. Well, see below: > There are a couple of things that you need to know: > > 1) V8 was affected by Spectre/Meltdown, and the version that has the > remediation is 6.4.388.40 Wow, even Fedora 27 has 6.2.91 :-( (Even more, Fedora rawhide also has the same version) EPEL has 3.14 :( > 2) the version of v8 that the official postgres yum repos use is 3.14, which > is 5 years out of date, and only compiles against the unsupported 1.4 branch > of plv8 (current is 2.3.0) Unfortunately, the packaging policy is to use OS libraries to build or install the packages. This is why I got stuck. > 3) the v8 build system no longer supports shared object creation under linux > (this is a big one), and thus plv8 has moved to a static build by default, > leaving a make shared for platforms that can still build (I believe they have > managed to not break the older build system for macOS, but that seems to be > it) I think that explains why I cannot build 2.3.0 on my build machines anymore. We have 2.1.0 at the moment. So in short: Unless EPEL and Fedora updates v8, we are unlikely to update the plv8 package :( Regards, -- Devrim Gündüz EnterpriseDB: https://www.enterprisedb.com PostgreSQL Consultant, Red Hat Certified Engineer Twitter: @DevrimGunduz , @DevrimGunduzTR Attachments: [application/pgp-signature] signature.asc (833B, 2-signature.asc) download ^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: PLV8 yum packages 2018-02-26 19:03 PLV8 yum packages Jerry Sievert <[email protected]> 2018-02-26 21:23 ` Re: PLV8 yum packages Devrim Gündüz <[email protected]> @ 2018-02-26 21:39 ` Jerry Sievert <[email protected]> 0 siblings, 0 replies; 3+ messages in thread From: Jerry Sievert @ 2018-02-26 21:39 UTC (permalink / raw) To: Devrim Gündüz <[email protected]>; +Cc: pgsql-pkg-yum >> There are a couple of things that you need to know: >> >> 1) V8 was affected by Spectre/Meltdown, and the version that has the >> remediation is 6.4.388.40 > > Wow, even Fedora 27 has 6.2.91 :-( (Even more, Fedora rawhide also has the same > version) > > EPEL has 3.14 :( > And fedora’s package is broken for embedding - I’ve had to guide plenty of people through getting plv8 built on fedora because of that. The biggest issue is that it’s not possible to even compile a version as a shared object any longer (see notes below). And the version shipping with fedora is susceptible to meltdown and spectre, and thus are major security risks at this point. >> 2) the version of v8 that the official postgres yum repos use is 3.14, which >> is 5 years out of date, and only compiles against the unsupported 1.4 branch >> of plv8 (current is 2.3.0) > > Unfortunately, the packaging policy is to use OS libraries to build or install > the packages. This is why I got stuck. > hm. How does this affect a project that simply cannot be compiled into a library any longer (v8)? Not only does google themselves specifically say not to do it, but it’s not supported at all in the build system any longer. I suspect if someone were to spend a few weeks going through the build system, they may be able to get a custom build script written to create shared libraries, but this would likely break with a minor version update (one of the pains of supporting plv8 is that v8 makes major breaking changes without warning on minor version updates). I’m trying to find some sort of middle ground. >> 3) the v8 build system no longer supports shared object creation under linux >> (this is a big one), and thus plv8 has moved to a static build by default, >> leaving a make shared for platforms that can still build (I believe they have >> managed to not break the older build system for macOS, but that seems to be >> it) > > I think that explains why I cannot build 2.3.0 on my build machines anymore. We > have 2.1.0 at the moment. > Yes - you have to use ninja and v8gen.py at this point (check out the Makefile for the examples, including the specific configuration to get it working - you can make modifications to compile with ICU, it’s off by default due to spotty ubuntu support). > So in short: Unless EPEL and Fedora updates v8, we are unlikely to update the > plv8 package :( > As noted, that’s not even possible at this point - that option no longer exists, and google themselves (via the v8 team) keep saying not to do it. For more context, see: https://github.com/plv8/plv8/issues/251 <https://github.com/plv8/plv8/issues/251; - there are some links to some tweets by the v8 team in there, as well as some comments from Christoph (who I’ve contacted today as well, to try to work through this issue again). Thanks much! > Regards, > > -- > Devrim Gündüz > EnterpriseDB: https://www.enterprisedb.com > PostgreSQL Consultant, Red Hat Certified Engineer > Twitter: @DevrimGunduz , @DevrimGunduzTR Attachments: [application/pgp-signature] signature.asc (833B, 3-signature.asc) download ^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2018-02-26 21:39 UTC | newest] Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2018-02-26 19:03 PLV8 yum packages Jerry Sievert <[email protected]> 2018-02-26 21:23 ` Devrim Gündüz <[email protected]> 2018-02-26 21:39 ` Jerry Sievert <[email protected]>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox