Embeds a modified copy of libyaml

[glondu]

While packaging ocaml-yaml for Debian (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001893), I've realized that it embeds a modified copy of libyaml. This is bad, for many reasons including following new versions, and security updates.

The changes look simple and uncontroversial, so I've made a pull request to libyaml: yaml/libyaml#235

I am opening this issue to inform ocaml-yaml authors of this process, and track the effort of making ocaml-yaml buildable with pristine libyaml.

[avsm]

I really appreciate you taking the time to submit this upstream. Debian packaging wins again, thanks @glondu :-)

[toots]

+1 here as vendored libyaml also won't compile in a cross-compilation environment: https://github.com/ocaml-cross/opam-cross-windows/actions/runs/4009102050/jobs/6884062479

It might be possible to fix it but, frankly, the module should be able to bind (w/o libffi!) on a local libyaml.

Thanks for the hard work nonetheless!

[rwmjones]

FYI we also came across this problem when packaging ocaml-yaml and we're unbundling it here:

https://bugzilla.redhat.com/show_bug.cgi?id=2217729

Basically we patch the system yaml.h with the same changes, delete vendor/*.c, and then modify the dune files so that it links everything with -lyaml.

A better solution would be for ocaml-yaml to detect the system libyaml and use it (once the changes above have gone into libyaml).

[avsm]

Before doing anything about this, I'm generally worried about the state of libyaml upstream maintenance, and several heap overflows reported upstream. Should we just be focussing on a pure OCaml implementation instead of trying to track libyaml?

[rwmjones]

I believe this is a case where a native OCaml version could well be better. (A bit surprised there's not one already ...) I'm sure you're aware that yaml is a minefield of a format so good luck!

[glondu]

I agree with your worries about libyaml upstream maintenance, and that a pure OCaml implementation would be useful.

[glondu]

Maybe a pure OCaml implementation could be done with https://github.com/yaml/yaml-reference-parser