[postgis-devel] Can we put back GEOS 3.5 support in 3.0?

[Raúl Marín Rodríguez]

Hi,

> the ABI never changes, there’s never a reason to not just dump the latest GEOS into place. What can we do to convince packagers we are sincere?

This isn't completely true:
```
$ ldd /usr/lib/postgresql/postgis-3.so
[...]
       libgeos-3.8.0.so => /usr/lib/libgeos-3.8.0.so (0x00007f8a80163000)
[...]
```
Since linking against the c API means algo linking against the C++
library, updating geos means rebuilding postgis and any other package
that depends on it (in my system gdal and qgis). If I understand
correctly, the C++ ABI isn't stable so, because of how the dependency
propagates, the C ABI isn't stable either. Please correct me if I'm
missing something.


> - report a CVE / security bug, so that it's handled by security team (can become just a three-line backpatch though).

In my experience, backpatching is the norm (and the safest path for LTS).


On thing I want to highlight is that packagers normally update to
major versions if available when they are preparing a new distribution
release. The problem comes from the fact that people want the latest
Postgis / QGIS in their old LTS distribution without packaging
anything themselves. I won't say that supporting this model is wrong,
but I don't think that is the best place to expend my efforts; I would
rather work in adding a new feature or improving an existing one than
supporting old releases.


-- 
Raúl Marín Rodríguez
carto.com