On Wed, Aug 19, 2026 at 10:28:04AM +0200, Alexander Bluhm wrote:
> On Wed, Aug 19, 2026 at 09:00:40AM +0200, Theo Buehler wrote:
> > On Tue, Aug 18, 2026 at 03:46:00PM -0700, Andrew Hewus Fresh wrote:
> > > On Tue, Aug 18, 2026 at 11:18:37PM +0200, Alexander Bluhm wrote:
> > > > On Tue, Aug 18, 2026 at 01:05:10PM -0700, Andrew Hewus Fresh wrote:
> > > > > On Tue, Aug 18, 2026 at 09:49:38PM +0200, Alexander Bluhm wrote:
> > > > > > Do we have to bump libperl.so to force rebuild and install of the
> > > > > > XS modules from packages?
> > > > > 
> > > > > Yes, but perl minor updates are supposed to be binary compatible, so I'm
> > > > > not sure we're supposed to need to.
> > > > > 
> > > > > Bumps are cheap though, so can if you like.
> > > > 
> > > > The bump prevents installing XS modules until packages are rebuilt.
> > > > 
> > > > > I guess I should double check that, I don't recall if I did this time.
> > > > 
> > > > No significant header in this patch.  Bit you previous CVE-2026-15534
> > > > commit contained a struct change in regexp.h.  It installs in
> > > > /usr/libdata/perl5/amd64-openbsd/CORE/regexp.h
> > > > 
> > > > https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb
> > > > 
> > > > So the Perl update itself looks safe, but maybe we bump anyway to
> > > > rebuild after the CVE commit and the update.
> > > 
> > > Will do.  I did notice this email after, but for some reason the patches
> > > were fighting me to apply which apparently meant I didn't actually think
> > > enough about that side effect.
> > > 
> > > https://www.nntp.perl.org/group/perl.perl5.porters/2026/08/msg271140.html
> > > 
> > 
> > I see that libperl was committed with a minor bump. But the changes
> > discussed here change the layouts of various public structs, so surely
> > this would need a major bump?
> 
> I would have expected a major bump, but that was never expressed.
> Technically major would have been correct.
> 
> > Or was the bump only a hack to force a rebuild of XS modules?
> 
> That was the purpose.  We don't know if any module uses this struct
> in regexp.h header.  codesearch.debian.net finds regmatch_info only
> within Perl itself.  What we have now, will eventually rebuild and
> reinstall XS modules.  Users can still run their old modules.  As
> this is the best of both worlds, I would keep the minor bump.

It was only sort-of on purpose, I knew it deserved a major, by my
subconscious would not apparently let me do it and when I realized I had
done it, I was away from the computer.

In any case, thanks bluhm for fixing the file lists.