diff mbox series

[wrynose,35/79] perl: inherit upstream-stable-release-point

Message ID fdc97ca7ef68103d498e7d2549ff248c0dade5a3.1789681419.git.yoann.congal@smile.fr
State New
Headers show
Series [wrynose,01/79] rootfs.py: fix run-postinsts removal on multilib images | expand

Commit Message

Yoann Congal Sept. 17, 2026, 10:06 p.m. UTC 
From: Daniel Turull <daniel.turull@ericsson.com>

perlpolicy documents a strict maintenance-branch policy: new releases of
a maint branch may only contain security/CVE fixes, crashing bugs,
regressions, build and install blockers, portability fixes and factual
documentation corrections, and must not contain patches that "add or
remove features", "break binary compatibility", or "add new warnings or
errors or deprecate features". New dual-life module versions are
explicitly deferred to the next stable series. So upgrades within a
major.minor are stable point upgrades per the OE-Core stable release
policy (ref-manual, "Stable Point Release Upgrades"). Long-lived
per-even-minor maint branches back this up, maint-5.6 through maint-5.42,
with a documented back-porting vote process.

  https://docs.yoctoproject.org/dev/ref-manual/release-process.html#stable-point-release-upgrades
  https://github.com/Perl/perl5/blob/v5.42.2/pod/perlpolicy.pod#L259

Checked the last two point releases for feature creep. perldelta makes
this easy to see, as maint releases carry no "Core Enhancements" section
at all:

  5.42.2 (Mar 29 2026): one CVE in a vendored dependency, CVE-2026-4176
  in Compress::Raw::Zlib, plus module version bumps. States "There are no
  changes intentionally incompatible with 5.42.1".
  5.42.1 (Mar 08 2026): four fixes -- a Configure fix so POSIX locale
  values can be passed in for cross-compilation, an AIX thread-safe
  locale workaround, a Win32 build fix, and module version bumps. States
  "There are no changes intentionally incompatible with Perl 5.42.0".
  5.42.0 (Jul 02 2025) is the series-opening release, not a point
  release: it adds seven language-level features, confirming X.Y.0 bumps
  are feature bumps that must stay outside the regex.

Cross-checked the previous series the same way: 5.40.1, 5.40.2 and 5.40.3
all show the same profile, with security, module, documentation, test and
bug-fix sections only and no Core Enhancements.

The policy forbidding binary-compatibility breaks in maint releases also
covers the ABI concern directly.

Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 5.34.1 -> 5.34.3 and
scarthgap 5.38.2 -> 5.38.4 are both in-series point bumps. wrynose is
still at 5.42.0 while master is at 5.42.2, so it is missing the
CVE-2026-4176 fix -- exactly the tracking gap --stable is meant to close.

AI-Generated: Kiro with Claude Opus 5
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Adapted for wrynose: applied to perl_5.42.0.bb (upstream: perl_5.44.0.bb).
(cherry picked from commit 73ae055e5a05078225226355f1545fc9e464e78d)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-devtools/perl/perl_5.42.0.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/perl/perl_5.42.0.bb b/meta/recipes-devtools/perl/perl_5.42.0.bb
index 6f0092c1cc7..886eaaaa379 100644
--- a/meta/recipes-devtools/perl/perl_5.42.0.bb
+++ b/meta/recipes-devtools/perl/perl_5.42.0.bb
@@ -35,7 +35,7 @@  SRC_URI[perl.sha256sum] = "e093ef184d7f9a1b9797e2465296f55510adb6dab8842b0c3ed53
 
 B = "${WORKDIR}/perl-${PV}-build"
 
-inherit upstream-version-is-even update-alternatives
+inherit upstream-version-is-even update-alternatives upstream-stable-release-point
 
 DEPENDS += "perlcross-native bzip2 zlib virtual/crypt"
 DEPENDS:append:class-native = " bzip2-replacement-native"