Re: Removing dead code (was: Retrospective by 'gpg.fail' authors)

[Jacob Bachmeyer <jcb62281 () gmail com>]

On 9/16/26 22:08, Peter Gutmann wrote:
> [...]  Given that it's open source with an unknown number of downstream users
> doing unknown things with it, there's no way to tell whether it's safe to
> remove or not.

I actually have a very rare counterexample to that, from DejaGnu.

DejaGnu is a software testing framework, and more-or-less cannot have 
security issues by definition, as its purpose is to execute arbitrary 
code from trusted testsuites.  DejaGnu once "had" a feature that was 
supposed to catch tests that failed to run to completion.

A Tcl variable, "testcnt" could be set to the expected number of test 
results.  However, the code that handled checking that the actual 
results matched the expected results would crash the framework with a 
Tcl error if it were ever actually run.  (It would be run only if 
"testcnt" had been set.)

Since no had ever complained (in 24 years) about the feature being 
broken, it was safe to say that the feature had never been used.  :-)


-- Jacob