[aur-general] know what dependencies in PKGBUILD - Aur-general - lists.archlinux.org

newer
[aur-general] Spam in AUR Comments

[aur-general] know what dependencies in PKGBUILD

older
[aur-general] SPAM in AUR comment:...

Budi

23 Jul 2020 23 Jul '20

1:10 p.m.

h\How to know what dependencies only need to put (surely not all)

Show replies by thread

alad

23 Jul 23 Jul

1:17 p.m.

Am 23/07/2020 um 15:10 schrieb Budi via aur-general:

h\How to know what dependencies only need to put (surely not all)

I proceed as follows: 1. ignore anything in base-devel 2. include libraries listed in ldd, if the package includes a compiled executable 3. include external commands if they are required (and not already in base-devel) The second point is not mandated (you can depend on a package fulfilling the needed library depends, transitively), though helpful when listing rebuilds. Otherwise, see the packaging guidelines on the wiki. (inb4 10 pages of discussion after a 1-sentence question)

Eli Schwartz

1:45 p.m.

On 7/23/20 9:17 AM, alad via aur-general wrote:

Am 23/07/2020 um 15:10 schrieb Budi via aur-general:

...
h\How to know what dependencies only need to put (surely not all)

I proceed as follows:

1. ignore anything in base-devel

base-devel is for makedepends only, base is for depends.

2. include libraries listed in ldd, if the package includes a compiled executable

This is wrong. If myprog links *only* to libfoo.so, and internally libfoo.so links to libbar.so, ldd will show both libfoo.so and libbar.so Instead use readelf -d and look for lines containing "NEEDED". Or use lddtree (from the pax-utils package) to get a tree-based view of a program's dependencies. ldd is completely inaccurate and misleading for this purpose.

3. include external commands if they are required (and not already in base-devel)

The second point is not mandated (you can depend on a package fulfilling the needed library depends, transitively), though helpful when listing rebuilds. Otherwise, see the packaging guidelines on the wiki.

(inb4 10 pages of discussion after a 1-sentence question)

-- Eli Schwartz Bug Wrangler and Trusted User

alad

8:07 p.m.

On 23/07/2020 15:45, Eli Schwartz via aur-general wrote:

...
Am 23/07/2020 um 15:10 schrieb Budi via aur-general:

...
h\How to know what dependencies only need to put (surely not all) I proceed as follows:

1. ignore anything in base-devel

On 7/23/20 9:17 AM, alad via aur-general wrote: base-devel is for makedepends only, base is for depends. So? base-devel contains programs that can be used during runtime, like gawk.

...
2. include libraries listed in ldd, if the package includes a compiled executable This is wrong. If myprog links *only* to libfoo.so, and internally libfoo.so links to libbar.so, ldd will show both libfoo.so and libbar.so

Instead use readelf -d and look for lines containing "NEEDED". Or use lddtree (from the pax-utils package) to get a tree-based view of a program's dependencies.

ldd is completely inaccurate and misleading for this purpose.

Hmm, you're right - last I checked libraries (for neomutt), I used readelf -d. I guess it's been too long. Alad

...
3. include external commands if they are required (and not already in base-devel)

The second point is not mandated (you can depend on a package fulfilling the needed library depends, transitively), though helpful when listing rebuilds. Otherwise, see the packaging guidelines on the wiki.

(inb4 10 pages of discussion after a 1-sentence question)

Eli Schwartz

8:23 p.m.

On 7/23/20 4:07 PM, alad via aur-general wrote:

On 23/07/2020 15:45, Eli Schwartz via aur-general wrote:

...
...
Am 23/07/2020 um 15:10 schrieb Budi via aur-general:

...
h\How to know what dependencies only need to put (surely not all) I proceed as follows:

1. ignore anything in base-devel

On 7/23/20 9:17 AM, alad via aur-general wrote: base-devel is for makedepends only, base is for depends. So? base-devel contains programs that can be used during runtime, like gawk.

Or 'which', or 'sudo'. If they are used during runtime, you can't exactly leave them out of depends=() on the rationale that people who installed base-devel to build packages, won't have errors running it. Unless I've misunderstood what you're suggesting here? (gawk is covered by the base metapackage, though. So that is okay to omit, but not because of -devel.) -- Eli Schwartz Bug Wrangler and Trusted User

Knut Ahlers

8:50 p.m.

On Thu, Jul 23, 2020 at 10:24 PM Eli Schwartz via aur-general wrote:

On 7/23/20 4:07 PM, alad via aur-general wrote:

...
On 23/07/2020 15:45, Eli Schwartz via aur-general wrote:

...
...
Am 23/07/2020 um 15:10 schrieb Budi via aur-general:

...
h\How to know what dependencies only need to put (surely not all) I proceed as follows:

1. ignore anything in base-devel

On 7/23/20 9:17 AM, alad via aur-general wrote: base-devel is for makedepends only, base is for depends. So? base-devel contains programs that can be used during runtime, like gawk.

Or 'which', or 'sudo'.

If they are used during runtime, you can't exactly leave them out of depends=() on the rationale that people who installed base-devel to build packages, won't have errors running it.

IMO you should add them as omitting packages required to run the program will cause issues for people. Packages should request everything they need to run. As an example: All AUR packages I'm using on my machines are built on a CI system in containers. All of them do have a clean environment - of course containing devel packages. My machines do not have devel packages installed as long as they are not used for development as they don't require them. So an AUR package built through the CI system installed on a machine without devel packages will miss some of its dependencies and will be broken. Also I know of repos maintained by TUs containing AUR packages: For them the same applies and while in a worst-case szenario I can patch the build before building it users relying on those AUR repos listed in the Wiki will get broken packages. -- Knut Ahlers Software & Infrastructure Developer Web & Blog: https://ahlers.me/ GPG-Key: 0xD34BE99E

Kusoneko

8:59 p.m.

On July 23, 2020 8:50:43 PM UTC, Knut Ahlers wrote:

On Thu, Jul 23, 2020 at 10:24 PM Eli Schwartz via aur-general wrote:

...
On 7/23/20 4:07 PM, alad via aur-general wrote:

...
On 23/07/2020 15:45, Eli Schwartz via aur-general wrote:

...
On 7/23/20 9:17 AM, alad via aur-general wrote:

...
Am 23/07/2020 um 15:10 schrieb Budi via aur-general:

...
h\How to know what dependencies only need to put (surely not

...
...
...
...
I proceed as follows:

1. ignore anything in base-devel base-devel is for makedepends only, base is for depends. So? base-devel contains programs that can be used during runtime,

all) like

...
...
gawk. Or 'which', or 'sudo'.

If they are used during runtime, you can't exactly leave them out of depends=() on the rationale that people who installed base-devel to build packages, won't have errors running it.

IMO you should add them as omitting packages required to run the program will cause issues for people. Packages should request everything they need to run.

As an example: All AUR packages I'm using on my machines are built on a CI system in containers. All of them do have a clean environment - of course containing devel packages. My machines do not have devel packages installed as long as they are not used for development as they don't require them. So an AUR package built through the CI system installed on a machine without devel packages will miss some of its dependencies and will be broken.

Also I know of repos maintained by TUs containing AUR packages: For them the same applies and while in a worst-case szenario I can patch the build before building it users relying on those AUR repos listed in the Wiki will get broken packages.

-- Knut Ahlers Software & Infrastructure Developer

Web & Blog: https://ahlers.me/ GPG-Key: 0xD34BE99E

That's an interesting setup, I'd be curious to know how to set that up?

Eli Schwartz

9:11 p.m.

On 7/23/20 4:50 PM, Knut Ahlers wrote:

IMO you should add them as omitting packages required to run the program will cause issues for people. Packages should request everything they need to run.

Isn't that exactly what I said?

As an example: All AUR packages I'm using on my machines are built on a CI system in containers. All of them do have a clean environment - of course containing devel packages. My machines do not have devel packages installed as long as they are not used for development as they don't require them. So an AUR package built through the CI system installed on a machine without devel packages will miss some of its dependencies and will be broken.

Also I know of repos maintained by TUs containing AUR packages: For them the same applies and while in a worst-case szenario I can patch the build before building it users relying on those AUR repos listed in the Wiki will get broken packages.

Never mind CI systems or TU repos. The official repos operate on exactly this rule already. All official repo packages are intended to be installed on systems with "base" installed but not "base-devel". -- Eli Schwartz Bug Wrangler and Trusted User

Knut Ahlers

9:50 p.m.

On Thu, Jul 23, 2020 at 11:11 PM Eli Schwartz via aur-general wrote:

On 7/23/20 4:50 PM, Knut Ahlers wrote:

...
IMO you should add them as omitting packages required to run the program will cause issues for people. Packages should request everything they need to run.

Isn't that exactly what I said?

Yep indeed. I totally misunderstood your mail to the opposite of what you've said… So: yes, we completely agree on that! -- Knut Ahlers Software & Infrastructure Developer Web & Blog: https://ahlers.me/ GPG-Key: 0xD34BE99E

1374

Age (days ago)

1374

Last active (days ago)

Download

8 comments

5 participants

tags

participants (5)

alad
Budi
Eli Schwartz
Knut Ahlers
Kusoneko