ABI change in 2.2.0 without soname change

[babelouest]

Hello

A change in the function oauth_verify_token signature in recent 2.2.0 release has caused package builds failed in Debian.

1125723

 bool oauth2_token_verify(oauth2_log_t *log, oauth2_http_request_t *request,
			 oauth2_cfg_token_verify_t *verify, const char *token,
-			 json_t **json_payload);
+			 json_t **json_payload,
+			 oauth2_http_status_code_t *status_code);

Would it be possible to fix this?

One way would be to set a new function with the new parameter and restore the old function with the original parameters.

[zandbelt]

I don't think this is feasible: there will be more ABI changes and I don't want to keep adding functions; the older versions of modules (and other dependents) should restrict the version number of liboauth2 that they work with through package dependency management (fwiw: I'm not sure if/how the soname is managed through configure.ac but correct me if I'm wrong)

[babelouest]

Hello,

If I understand correctly Debian Policy on shared libraries, I will have to change the package name on every ABI break:

Every time the shared library ABI changes in a way that could break binaries linked against older versions of the shared
library, the SONAME of the library and the corresponding name for the binary package containing the runtime shared library
should change. Normally, this means the SONAME should change any time an interface is removed from the shared library
or the signature of an interface (the number of parameters or the types of parameters that it takes, for example) is changed.
This practice is vital to allowing clean upgrades from older versions of the package and clean transitions between the old ABI
and new ABI without having to upgrade every affected package simultaneously.

That's possible, but it will make the transition to newer liboauth2 version slower in Debian.

[ararslan]

I'm not sure if/how the soname is managed through configure.ac but correct me if I'm wrong

libtool will set the soname, and you can tell it what to set it to (and thus change as needed) like so: https://github.com/jedisct1/libsodium/blob/589f0426233f0f252a0b8692dc4c864821e1e82d/configure.ac#L281-L290

(I'm not affiliated with that project, it's just a random example I found. 😅) I think it would be straightforward to add to your configure.ac, the only added overhead for maintainers going forward would be to remember to bump the soname version whenever a breaking change is made to the ABI.

[zandbelt]

https://github.com/OpenIDC/liboauth2/releases/tag/v2.2.1