Re: lua40 and Debian

[Enrico Tassi <gareuselesinge@...>]

On Mon, Feb 18, 2008 at 06:56:01PM -0300, Luiz Henrique de Figueiredo wrote:
> > The Lua library is unique in terms of how stable each release is, how
> > apps can embed it and become bound to a certain version indefinitely,
> 
> Hence our recommendation that Lua be statically linked to apps...
> On the other hand, I see that apps might be interested in using bug-fix
> releases of the same Lua version without being forced to relink. Not an
> easy decision...

Lua proved to be almost bug free, but for a distro like Debian, static
linking is not an option. It is already a too widely abused practice.

The Debian security team keeps track of a list of embedded copies of 
software libraries, and whenever one of those exposes a security-related
bug they have to fix all the embedded copies.

We provide a statically linked lua5.1 interpreter, but liblua5.1 client
applications link the lua code dynamically. The same practice is
followed by perl and other interpreted (almost embeddable) languages.

Cheers
-- 
Enrico Tassi