Add a CONTRIBUTING.md file

[Leont]

This adds a basic contributing file.

[richardleach]

Maybe add something like: "If the PR touches anything to do with memory allocation or management, including altering the lifecycle of allocations, changing bounds checks, modifying struct definitions, and so on, please ensure that all tests run successfully under asan or valgrind."

[bulk88]

Egh, those are Linux only products AFAIK. A make test on a -DDEBUGGING build is pretty tough on getting it to pass for anything but the simplest of tweaks. It's been a very long time since I've used this feature on Windows, but there is a feature called GFlags which is a blacklist in the registry of exe file names or exe absolute paths which if they start a process, the MS system DLLs and NT Kernel are rewired to be in a slower hyper paranoid asserting verifying everything mode
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/gflags-flag-table

I usually hit the check marks for FLG_ENABLE_HANDLE_EXCEPTIONS
FLG_HEAP_ENABLE_FREE_CHECK
FLG_HEAP_VALIDATE_PARAMETERS
FLG_HEAP_ENABLE_TAIL_CHECK

Poison patterning the entire block on free(), and tail check which adds something like 4, 8, maybe 16 bytes more secret space to the end of the malloc block and keeps a poison pattern in there that is checked on the next realloc() or free() are 2 most important features IMO. Tailcheck would detect an overwrite as small as 1 byte above the whatever the formal byte count was for that block. The Win32 heap has always featured the BSD only msize() feature, which it calls HeapSize(), which could be used as a strlen() replacement in production code but I've never seen any POSIX FOSS or Win32 in life use msize() or HeapSize as an alternative to tracking length explicitly in end developer created fields. Internally/undoced WinOS keeps the number of missing/unrequested user visible bytes below the next allocation granularity boundary in the byte right before the next granularity boundary. 1 bit in the malloc block header says if the block byte size is an aligned unit of 8 or 16 or 24 or 4096ish or has upto 7/15/23 bytes smaller.

make test_porting is the highest importance pre Pull Request task to remember to do in my opinion. It's fast enough, and guarantees a couple perl process launches ran without a SEGV. The P5P GH smoke farm already follows this opinion, but IMO it's alot of visual noise for a PR to be submitted that fails the P5P GH smoke.

Perhaps instead of a generic discouraging "we don't allow anything but 1 line bug fixes without a ballot committe quorum being raised, a motion to schedule a submission, and a vote on docketing the proposal to the proposal committee", there could be a list of prior PRs or mailing list threads of examples which should have been PPC back then had PPC existed back then, or a couple hand picked good (best) examples of PPC changes.

Full time Perl devs or full time Perl and C devs know what PPC is, but a random C dev or random sysadmin will have no idea what the burocracy policy and regulation talk is, and won't bother going through the process to upstream to P5P whatever they did locally with their Perl if the Perl 5 Contribution Policy sounds like 🍎 🍏's or Google's definition of open source software, i.e. we don't allow non-staff intellectual property in our code bases, we only make the source code available for amateur or professional Infosec people to review it for backdoors and exploits, or our software links to 3rd party FOSS libs and those FOSS libs have infective licenses and it's not worth it for us to clean room reimplement them.

[tonycoz]

Egh, those are Linux only products AFAIK

I haven't tried it, but:

https://learn.microsoft.com/en-us/cpp/sanitizers/asan?view=msvc-170

[richardleach]

Perhaps add something like the following?

"Perl can be built for a multitude of architectures and operating systems, using a variety of compilers and standard C libraries, with a flexible configuration system. Pull Requests must not introduce code that only works on a specific subset of these and breaks the build for everything else. If such code is warranted for some reason, it must only be visible to the targeted configuration(s)."

Maybe with a reference to using Configure.

[bulk88]

Maybe with a reference to using Configure.

Configure or metaconfig is a dead end EOLed project IMHO. The vast majority of senior P5P people do not know how to work with it anymore or how to add new probes to metaconfig. New features keep getting added with "remember to add this -DPERL_FOO" in the docs without Configure being made aware of the feature.

Working with Configure could be made easier to do with extensive new API docs and samples and guides, but I think there is a lack of tuits. Last time I read the docs for metaconfig, it's docs subtle implied that it's impossible to add anything new to it.