enforce the right minimum OCaml version

[avsm]

We need to enforce a proper minimum OCaml version in MirageOS 3 before it comes out of beta:

• we no longer test <4.03 on Travis so if it is 4.02 then we need to add it back
• -ocaml-version-checkin check_ocaml_version still asks for 4.02.3+
• the opam files also require 4.02.

So if we leap to 4.03 as the minimum version we need to fix up the ocaml version checks, and if we stay on 4.02 we need to restore test cases. Personally I am in favour of shifting up to 4.03 given the rapid pace of OCaml releases recently.

CC #695 also for 4.02 compilation fixes

[hannesm]

for the record, I usually like to keep backwards compatibility if it is not too much of a pain. but considering the OCaml releases, I'd be in favour to drop 4.02 (and 4.03 asap). I don't see a reason for MirageOS (due to its small deployment base) to require support for OCaml versions shipped with debian/ubuntu/etc. If we do, we should push them to package OCaml more timely (I had some success in debian, thanks to @infinity0).

Looking from a security angle:

• OCaml 4.03 fixes an issue in String.copy (which has a CVE).
• OCaml 4.04 fixes even more issues (thanks to @yallop for finding and fixing, and @damiendoligez for including them into the 4.04 release!):
• integer overflow in String.concat Fix an overflow bug in String.concat ocaml/ocaml#833
• integer overflow in Array.concat Detect integer overflow in Array.concat ocaml/ocaml#810
• bounds checks in Buffer.add_substring Fix broken bounds check in Buffer.add_substring ocaml/ocaml#814

Other libraries, such as tls/nocrypto/cohttp/... might want to retain compatibility with 4.02.3, 4.01, ...

[avsm]

I don't see a reason for MirageOS (due to its small deployment base) to require support for OCaml versions shipped with debian/ubuntu/etc.

Yes I don't believe that the distribution packaging is much of a concern now -- retaining support for OPAM 1.2.2 (which is mostly packaged now) is more important so that there is a bootstrap procedure on those operating systems. Docker uses quite a few MirageOS libraries and types, so if @djs55 @samoht @yomimono could confirm that a minimum 4.03 is now ok for those deployments, that would be helpful in making the decision.

[djs55]

I think I'm using 4.03 everywhere now so a minimum of 4.03 is fine by me.

[hannesm]

as a comment here, I removed the ocaml version check in #703. This is off-topic for the mirage tool. We can instead use available in the opam file for mirage, and also emit available for the opam files mirage generates.