Mailing-List: contact dev-help@apr.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (nike.apache.org: domain of jorton@redhat.com designates
 66.187.233.31 as permitted sender)
Date: Tue, 15 Apr 2008 20:57:41 +0100
From: Joe Orton <jorton@redhat.com>
To: dev@apr.apache.org
Subject: Re: veto on addition of ssl, evp code
Message-ID: <20080415195741.GA4791@redhat.com>
Mail-Followup-To: dev@apr.apache.org
References: <20080414204254.GA16014@redhat.com> <4803CFFA.1030400@sharp.fm>
 <20080415093722.GA4469@redhat.com> <48048F10.9020302@sharp.fm>
 <5c902b9e0804150508g5de7e127v32ed7f0b25647900@mail.gmail.com>
 <4804A5DA.103@sharp.fm>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <4804A5DA.103@sharp.fm>
User-Agent: Mutt/1.5.17 (2007-11-01)
Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor,
 Berkshire, SL4 1TE, United Kingdom.
  Registered in UK and Wales under Company Registration No. 03798903
  Directors: Michael Cunningham (USA), Brendan Lane (Ireland),
 Matt Parson (USA), Charlie Peters (USA)

On Tue, Apr 15, 2008 at 02:55:54PM +0200, Graham Leggett wrote:
> Justin Erenkrantz wrote:
>
>> No, as Joe said, you ignored prior comments - this isn't the first
>> time that these concerns have been raised.
>
> I did not ignore prior comments, I responded to the comments, and my 
> responses were ignored.

Without wanting to get into a he-said-she-said argument, I've looked 
through the mail thread again to see if this is a fair claim.

A theme of the responses is effectively to stonewall: "this is a wider 
problem in the SSL code."  Well, sure, fine, I agree completely.  What 
do you expect me to say?  I am not going to try to convince you to spend 
time fixing the problems if you don't feel so inclined; your time, your 
choice.  But if nobody spends time fixing the code, the problems will 
still be there.  That is the basis of my veto.

For at least two of the five issues in my veto which concern the EVP 
code, those labelled (h) and (i), in fact no further discussion seemed 
necessary because you indicated intent to fix the issues in question:

 "Again, this is the underlying toolkit's problem. Will document 
better." 
    ...
 "Again, this was modelled on the existing code, and I wasn't happy 
with it either. Will change both the apr_ssl_* and the apr_evp_* 
factories to be more specific."

So again, I guess I presumed back then, and would still now, that these 
problems were understood and were going to be addressed.  But that 
didn't actually happen; the problems are still there.  Again, that is 
the basis of my veto.

I am sorry if I failed to do enough to help explain or discuss the 
problems last year, and as a result of that the veto seems unduly harsh.

Regards,

joe