Removed the bundled sources from release package after Ruby 3.2
We shipped release package with the 3rd party source for mswin environment especially.
The current status is here:
- libyaml: psych gem, ruby repo and package always bundled it.
- libffi: only ruby package bundled it. fiddle gem and repo are not bundled.
- zlib: gem, ruby repo and package don't bundled.
I propose we stop bundling the third-party source for security and maintenance reasons. Because we have vcpkg for mswin environment today. So, vcpkg provides the runtime for psych, fiddle and zlib.
Updated by hsbt (Hiroshi SHIBATA) 11 months ago
- Status changed from Open to Assigned
- Assignee set to hsbt (Hiroshi SHIBATA)
We decided on the following policy.
- We will remove the bundled sources from ruby repo.
- @hsbt (Hiroshi SHIBATA) is working now for psych and fiddle.
- If users put the third-party source under the ruby packages, ruby build system use them.
Updated by hsbt (Hiroshi SHIBATA) 4 months ago
I and nobu added
--with-xxx-source-dir option for psych and fiddle instead of
The users who want to use newer version of libyaml or libffi environment can use this option like
gem install psych -- --with-libyaml-source-dir=$(pwd)/libyaml-0.2.5.