Finished means it’s feature complete according to the specification and feature frozen. It says nothing of bugs. Bugs are ethereal qualities, subject to opinion and criteria chosen for triage. Sudo is finished, it does what is meant to do. Does it do it bug free? For the most part it does. Doesn’t mean there aren’t any bugs left. But no new bugs are expected to be introduced by active development. Any bugs that arise, and it has been the case for a long time, will be old bugs that haven’t been discovered yet.
Is it feature complete? Sudo is still getting 10-30 commits a month. If those are all bug fixes, maybe it’s buggier than we thought. Otherwise it would seem that many of them are new features.
From the project’s website:
The sudo 1.8 branch is considered the legacy version. It receives no new features, only critical bug fixes. Users are highly encouraged to migrate to the sudo stable branch.
This implies that 1.9 may still get new features. And there may one day be a 1.10.
Here are the latest things fixed in the current patch version of 1.9 branch, 1.9.17p2
Fixed a bug introduced in sudo 1.9.16 that could result in sudo sending SIGHUP to all processes on the system in certain rare cases.
Fixed a bug introduced in sudo 1.9.12 that caused sudo to abort when … [some very specific cases]
Fixed a bug in sudo’s configure script introduced in sudo 1.9.17 that prevented mdoc-format man pages from being used on systems without the mandoc utility.
These are all recently introduced bugs that are results of either previous bug fixes or new features. The oldest mentioned version, 1.9.12 is from 2022, but 1.9.16 and .17 are newer.
This is not meant to be a criticism of the sudo project or Todd. He’s done an excellent job on the security front. But clearly sudo is not feature-frozen and new bugs are still being introduced. Sometimes they’re memory bugs and Rust helps with those (obviously it doesn’t completely eliminate them). Rust is also much nicer to learn than C, meaning it’s going to get easier and easier to find help in a Rust project as opposed to a C one.
Finished means it’s feature complete according to the specification and feature frozen. It says nothing of bugs. Bugs are ethereal qualities, subject to opinion and criteria chosen for triage. Sudo is finished, it does what is meant to do. Does it do it bug free? For the most part it does. Doesn’t mean there aren’t any bugs left. But no new bugs are expected to be introduced by active development. Any bugs that arise, and it has been the case for a long time, will be old bugs that haven’t been discovered yet.
Is it feature complete? Sudo is still getting 10-30 commits a month. If those are all bug fixes, maybe it’s buggier than we thought. Otherwise it would seem that many of them are new features.
From the project’s website:
This implies that 1.9 may still get new features. And there may one day be a 1.10.
Here are the latest things fixed in the current patch version of 1.9 branch, 1.9.17p2
These are all recently introduced bugs that are results of either previous bug fixes or new features. The oldest mentioned version, 1.9.12 is from 2022, but 1.9.16 and .17 are newer.
This is not meant to be a criticism of the sudo project or Todd. He’s done an excellent job on the security front. But clearly sudo is not feature-frozen and new bugs are still being introduced. Sometimes they’re memory bugs and Rust helps with those (obviously it doesn’t completely eliminate them). Rust is also much nicer to learn than C, meaning it’s going to get easier and easier to find help in a Rust project as opposed to a C one.
Also Todd Miller, the author of sudo, has a submitted a pull request to sudo-rs at one point so I suspect he’s also excited about the project to some degree and wanted to help symbolically