Perl minimum version

[hlandau]

Currently NOTES-PERL.md documents us as requiring 5.10.0 or later. But it occurs to me we don't actually have a policy on this, or when we can bump this. We have a platform policy, but that's something often orthogonal.

It seems like it would also be prudent to test whatever we are documenting as our minimum Perl version in CI also.

[beldmit]

We may have different requirements for running Configure and running tests. It may be worth keeping the Configure version as low as possible to make possible building on legacy platforms

[levitte]

I habitually check that any perl module is a core module since 5.10 or before. The command corelist is very practical for this.

[hlandau]

Some food for thought:

• JSON::PP becomes core in 5.13.9.
• As far as I can tell OpenVMS and NonStop have Perl versions more recent than this. (cc @rsbeckerca)

It's not something I need currently but the fact that we can't handle JSON in our primary build automation and codegen scripting language feels a bit strange. I noticed this while developing CI tests for qlog.

[levitte]

I could certainly see an update of the minimum perl version.

Glancing at Wikipedia, I can see several options (all just as arbitrary):

• v5.16: That's the latest that's still legacy
• v5.20: Nice round number, just like v5.10 was back when we set that minimum version.
  To boot, that release is almost 10 years ago, which also has a nice ring to it.
• v5.24: This is the perl version on Debian 9, which is legacy at this point (it's the release before oldoldstable at this point in time)

I wouldn't go further than that for now, as people with legacy systems (which OpenSSL is still renowned for supporting) will scream bloody murder the more modern the minimum requirement becomes.

[levitte]

Something to note is that when we decided to set the perl minimum version to 5.10.0, it was just a little more than 8 years old.

Refs:

• commit de81282
• perl v5.10.0 was released in December 2007

[rsbeckerca]

Some food for thought:

* JSON::PP becomes core in 5.13.9.

* As far as I can tell OpenVMS and NonStop have Perl versions more recent than this. (cc @rsbeckerca)

It's not something I need currently but the fact that we can't handle JSON in our primary build automation and codegen scripting language feels a bit strange. I noticed this while developing CI tests for qlog.

I can confirm that the supported versions of perl on NonStop are more recent. ia64 stops at 5.26.3 (beyond that, we are off the map), and x86 are at 5.26.3 through 5.30 for most recent. 5.30 was just released and is not available except on the most recent OS release (which my x86 build system has). My ia64 build system has 5.26.3, and will be at that version until decommissioned - I don't have a date for that but it is at least 2 years out.

[sevan]

On OS X, 5.38.2 works just fine out of the box all the way back on Darwin 8 (OS X 10.4), with Darwin 7 (OS X 10.3), 5.38.2 builds fine but has a some tests failing ( over 80% pass rate) regard unicode and regex I think but is sufficient for building OpenSSL 3 (reminds me that I have a bug to file for OpenSSL).
For Darwin 6 (OS X 10.2) you have to resort to bleeding edge Perl atm, but it can be made to build as a static version without XS support. So in theory you can go back 20 years worth of releases and still have a version of modern Perl.
I've not yet attempted going back all the way to the first 2 OS X releases (10.0 & 10.1)

[sevan]

Btw, while the minimum requirement is set to Perl 5.10, there's actually a Test::More 0.96 (or higher) dependency, which means you have to resort to cpan. Having Perl 5.10 alone is not sufficient as discovered trying to build OpenSSL 3.x on Darwin 10 (OS X 10.6).

[rsbeckerca]

As a word of caution, once we bring CPAN in, we have to be careful about including CPAN dependencies that are not necessarily available everywhere. While Test::More is a core module, would that require OTC approval to be included at a specific version more recent than included with a specific perl version? CPAN itself is not configured by default on my platforms.

[sevan]

As a word of caution, once we bring CPAN in, we have to be careful about including CPAN dependencies that are not necessarily available everywhere. While Test::More is a core module, would that require OTC approval to be included at a specific version more recent than included with a specific perl version? CPAN itself is not configured by default on my platforms.

So the reality is that the minimum requirement for Perl version is actually whichever release included Test::More 0.96 as a core module.

https://perldoc.perl.org/Test::More#COMPATIBILITY

EDIT: Looks like it is already documented

[levitte]

Btw, while the minimum requirement is set to Perl 5.10, there's actually a Test::More 0.96 (or higher) dependency, which means you have to resort to cpan. Having Perl 5.10 alone is not sufficient as discovered trying to build OpenSSL 3.x on Darwin 10 (OS X 10.6).

Yes, we know this. It was deemed OK for testing purposes. In other words, we're stricter for building and installing.

EDIT: and @sevan already pointed out that this is actually documented

[levitte]

Another question is, in what OpenSSL version should we upgrade the minimum version for Perl?

Side note: considering the mention of Test::More, I'm actually using Test2 (next major version of that test framework, and oh boy it's quite an upgrade) in projects of my own. It appeared in perl v5.25.1. Food for more thought, but also perhaps something that should wait 'til OpenSSL 4.

[hlandau]

@holger-dengler @ifranzki @opensslonzos-github Can you confirm what versions of Perl are available to you on z/OS?

Another question is, in what OpenSSL version should we upgrade the minimum version for Perl?

Side note: considering the mention of Test::More, I'm actually using Test2 (next major version of that test framework, and oh boy it's quite an upgrade) in projects of my own. It appeared in perl v5.25.1. Food for more thought, but also perhaps something that should wait 'til OpenSSL 4.

I'd actually argue we don't need to be as conservative as we do for ABI here, if we can establish that bumping it won't cause problems for anything on our platform list.

Perhaps we could start by advertising an intention to bump the required minimum in CHANGES.md in a minor release, and then do it in the following one.

[levitte]

Perhaps we could start by advertising an intention to bump the required minimum in CHANGES.md in a minor release, and then do it in the following one.

That's a viable idea. +1

[ifranzki]

Can you confirm what versions of Perl are available to you on z/OS?

Neither me nor @holger-dengler do know this. But I forwarded this question to someone who could possibly know, and asked to answer in this issue.

[rsbeckerca]

If there is a minimum dependency requirement set (like c99, perl 5.10) documented, would it also make sense to document upgrade plans there? And this also sounds like a discussion instead of an issue at this stage.

[levitte]

Regarding C:

openssl/INSTALL.md

Line 54 in ace3afa

* an ANSI C compiler

(ANSI C = C89, for all intents and purposes)

Regarding Perl:

openssl/NOTES-PERL.md

Line 28 in ace3afa

You MUST have at least Perl version 5.10.0 installed. This minimum

... but also:

openssl/NOTES-PERL.md

Lines 78 to 83 in ace3afa

	* `Test::More` this is required *for testing*
	We require the minimum version to be 0.96, which appeared in Perl 5.13.4,
	because that version was the first to have all the features we're using.
	This module is required for testing only! If you don't plan on running
	the tests, you don't need to bother with this one.