Re: OpenBSD perl 5.42.3 - Minor update

On Wed, Aug 19, 2026 at 09:00:40AM +0200, Theo Buehler wrote:
> On Tue, Aug 18, 2026 at 03:46:00PM -0700, Andrew Hewus Fresh wrote:
> > On Tue, Aug 18, 2026 at 11:18:37PM +0200, Alexander Bluhm wrote:
> > > On Tue, Aug 18, 2026 at 01:05:10PM -0700, Andrew Hewus Fresh wrote:
> > > > On Tue, Aug 18, 2026 at 09:49:38PM +0200, Alexander Bluhm wrote:
> > > > > Do we have to bump libperl.so to force rebuild and install of the
> > > > > XS modules from packages?
> > > > 
> > > > Yes, but perl minor updates are supposed to be binary compatible, so I'm
> > > > not sure we're supposed to need to.
> > > > 
> > > > Bumps are cheap though, so can if you like.
> > > 
> > > The bump prevents installing XS modules until packages are rebuilt.
> > > 
> > > > I guess I should double check that, I don't recall if I did this time.
> > > 
> > > No significant header in this patch.  Bit you previous CVE-2026-15534
> > > commit contained a struct change in regexp.h.  It installs in
> > > /usr/libdata/perl5/amd64-openbsd/CORE/regexp.h
> > > 
> > > https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb
> > > 
> > > So the Perl update itself looks safe, but maybe we bump anyway to
> > > rebuild after the CVE commit and the update.
> > 
> > Will do.  I did notice this email after, but for some reason the patches
> > were fighting me to apply which apparently meant I didn't actually think
> > enough about that side effect.
> > 
> > https://www.nntp.perl.org/group/perl.perl5.porters/2026/08/msg271140.html
> > 
> 
> I see that libperl was committed with a minor bump. But the changes
> discussed here change the layouts of various public structs, so surely
> this would need a major bump?

I would have expected a major bump, but that was never expressed.
Technically major would have been correct.

> Or was the bump only a hack to force a rebuild of XS modules?

That was the purpose.  We don't know if any module uses this struct
in regexp.h header.  codesearch.debian.net finds regmatch_info only
within Perl itself.  What we have now, will eventually rebuild and
reinstall XS modules.  Users can still run their old modules.  As
this is the best of both worlds, I would keep the minor bump.

bluhm