Comment by roryirvine
2 months ago
Digging into it further, it looks like there's a mix - backported bugfixes, Apple-specific fixes, and security issues which may or may not have been fixed by upstream long ago.
Some of it almost certainly would be useful upstream (eg. the clang warnings, and any unfixed security issues), and some might warrant being reimplemented in a different way (those Apple-specific ifdefs in the middle of platform-independent code blocks). But that's not ever going to happen, because of the way Apple jumbles it all together.
We have contributed a number of upstream fixes
The main reason we have a fork at all is that upstream libxml2 has broken source and binary compatibility in various ways, and we can't take those changes because libxml2 is public API on our platforms. We do make an effort to upstream all security fixes, though we sometimes get to it only after we ship.
I do appreciate you showing up and clarifying that effort to upstream fixes are made! But is your fork developed in the open?
I think the root issue here is that Apple takes from the commons and then (at best) throws the leftovers over the fence.
If there is a poster child for why BSD/MIT licenses lead to less desirable outcomes, it's BSD being endlessly forked.