<div dir="ltr"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>That said, I presume there's a strong overall consensus that on
current hardware, we run the current (supported) versions of
software, and that older operating systems and hardware are
supported only on a "if it doesn't hurt anything" basis.</div></blockquote><div><br></div><div>I'm not sure this is 100% accurate, either. I think it's pretty much up to the maintainers of each individual port, but I know that at least for me, since I have some hardware that, for example, can't be upgraded beyond 10.11, I tend to maintain my ports using a "try our very best to make the current version of the software work on older macOSes" mentality (hence the existence of things like the legacysupport PortGroup). In some cases, that may mean making a version-numbered subport of an older release that still works on an older macOS, like what we have had to do with MoltenVK.</div><div><br></div><div>Is this potentially a risk when there are security patches that only work on newer macOSes? Yes, but using an older version of macOS in and of itself can be considered a security risk, so I think it's up to the user to make the decision whether to run an out-of-date version of some piece of software that is still being made available through MacPorts.<br></div><div><br></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>-- </div><div>Jason Liu<br></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Oct 10, 2023 at 3:26 PM Perry E. Metzger <<a href="mailto:perry@piermont.com" target="_blank">perry@piermont.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<p>And Mascguy didn't seem to care to explain the situation, which I
clearly didn't understand. Okay, That makes more sense and is
acceptable.</p>
<p>That said, I presume there's a strong overall consensus that on
current hardware, we run the current (supported) versions of
software, and that older operating systems and hardware are
supported only on a "if it doesn't hurt anything" basis.</p>
<p>Perry<br>
</p>
<p><br>
</p>
<div>On 10/10/23 14:08, Gregorio Litenstein
wrote:<br>
</div>
<blockquote type="cite">
<div name="messageBodySection">
<div dir="auto">In general terms I (who am absolutely nobody)
agree with you, but there's one thing I believe you're not
taking into account and it's that this is a fallback version
for users with ancient hardware.<br>
<br>
The main `librsvg` port is currently at `2.56.3`, which was
released two months ago<br>
<br>
@Chris, I belive OP didn't realize it's not the main port.</div>
</div>
<div name="messageSignatureSection"><br>
<div dir="auto"><br>
<table style="font-family:Tahoma;font-size:12px;border-collapse:collapse;border:1px solid black">
<tbody>
<tr style="border:1px ridge black;border-collapse:collapse">
<td style="border:1px ridge black;border-collapse:collapse;font-weight:bold">Gregorio
Litenstein Goldzweig</td>
<td rowspan="5" style="border:1px ridge black;border-collapse:collapse"><img alt="glit_qr_4.png"></td>
</tr>
<tr style="border:1px ridge black;border-collapse:collapse">
<td style="border:1px ridge black;border-collapse:collapse">Médico Cirujano</td>
</tr>
<tr style="border:0px ridge black;border-collapse:collapse">
<td style="border:0px ridge black;border-collapse:collapse"> </td>
</tr>
<tr style="border:1px ridge black;border-collapse:collapse">
<td style="border:1px ridge black;border-collapse:collapse;text-align:left">
<ul style="list-style-type:none;text-align:left;padding-left:5%">
<li><span style="font-weight:bold">Fono:</span> +56
9 96343643</li>
<li><span style="font-weight:bold">E-Mail:</span> <a href="mailto:g.litenstein@gmail.com" target="_blank">g.litenstein@gmail.com</a></li>
</ul>
</td>
</tr>
<tr style="border:1px ridge black;border-collapse:collapse">
<td><br>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div name="messageReplySection">On 10 Oct 2023 15:07 -0300, Chris
Jones <a href="mailto:jonesc@hep.phy.cam.ac.uk" target="_blank"><jonesc@hep.phy.cam.ac.uk></a>, wrote:<br>
<blockquote type="cite" style="border-left:thin solid grey;margin:5px;padding-left:10px">Hi,<br>
<br>
I am not sure what you are complaining about. Version 2.56.3,
whilst not the absolute latest version a pretty up to date
rust based version, is already used on Darwin 10 and newer.
Your mail below seems to imply the old C version is used
everywhere, which just isn't the case. What am I missing here
?<br>
<br>
Chris<br>
<br>
<blockquote type="cite">On 10 Oct 2023, at 6:48 pm, Perry E.
Metzger <a href="mailto:perry@piermont.com" target="_blank"><perry@piermont.com></a> wrote:<br>
<br>
See the following thread:
<a href="https://github.com/macports/macports-ports/pull/20744" target="_blank">https://github.com/macports/macports-ports/pull/20744</a> — but
to summarize, Mascguy does not want to update librsvg to a
safe / modern one because ancient versions of MacOS can't
support Rust.<br>
<br>
So I don't want to be a pain in the neck, but I have little
interest in MacPorts if the point is to preserve
compatibility with MacOS 10.5 at the expense of having the
thousands of users of current Macs and current MacOS have a
dangerously insecure version of a basic SVG graphics library
that other things depend on.<br>
<br>
(The upstream librsvg maintainers have washed their hands of
the old C version and don't support it any more, and for
good reason. The Rust version of the library provides a far
more secure codebase.)<br>
<br>
I don't know how other people feel here, but I don't work on
MacPorts because I like retrocomputing, but rather because I
want to use Unix tools on my modern Macs.<br>
<br>
If we're all on the same page that the priority is current
MacOS users, then we need to make sure that policy is well
understood by all and we need to update ports that are being
held back for the benefit of people using an OS from 2007.<br>
<br>
If the consensus is that we prioritize ancient versions of
MacOS with three users (or sometimes none) over the
experience the bulk of the users have, that's fine, and I'll
accept it, but then I'm switching to Brew, and I will advise
others to do the same, and will explain that current
versions of MacPorts cannot be trusted to have safe software
because the people involved prioritize support for ancient
versions of the operating system.<br>
<br>
I will accept whatever the consensus is.<br>
<br>
Perry<br>
<br>
<br>
</blockquote>
</blockquote>
</div>
</blockquote>
</div>
</blockquote></div>