[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: possible MBF: automatically detecting unused build dependencies

On Mon, Jul 07, 2014 at 08:05:06PM +0200, Johannes Schauer wrote:
> Quoting Steve Langasek (2014-07-07 18:36:50)
> > There seem to still be some false positives here.  pam is on the list because
> > of a build-dependency on libdb-dev, freetds and unixodbc are there because of
> > a build-dependency on libreadline-dev.  Both of these are metapackages that
> > pull in version-specific -dev packages.  So something seems to be wrong with
> > the detection of "empty" packages yet?

> Empty packages are not "detected". The first phase will find empty
> packages because they do not contain any files and thus they are detected
> as build dependencies of which no files were used.  Since empty packages
> are mostly meta packages and we do not want to include them, we replace
> them by a fake equivs package without dependencies.  If the build still
> succeeds, that means that the meta package is indeed not needed.

Ah.  No, it only means that the package build does not *fail* if the
build-dependency is removed.  That is not the same thing as saying that the
build-dependency is not used.

It would of course be better if packages were resilient against breakage in
their build-dependencies, instead of misbuilding with features disabled or
with wrong fallback code.  But this isn't easy to do in all build systems,
and anyway this isn't something we routinely audit about our packages; we
shouldn't regard this as a bug to be reported without a lot more discussion
of how we're going to systematically stay on top of those issues in the

For your purposes, a better method would be:

 - identify those build-dependencies which are empty except for
 - for each such package, look at the contents of its direct dependencies
 - check the build against those contents

> Lets find out what happens here. Steps to reproduce:

> $ sudo debootstrap sid debian-sid
> # the pam build needs /proc mounted
> $ sudo mount -o bind /proc debian-sid/proc
> $ sudo chroot debian-sid
> $ echo "deb-src http://ftp.us.debian.org/debian sid main" >> /etc/apt/sources.list
> $ apt-get update
> $ apt-get install build-essential equivs
> $ apt-cache show libdb-dev | grep -v "^Depends:" | grep -v "^Conflicts:" | equivs-build -
> $ dpkg -i libdb-dev_5.3.0_amd64.deb
> $ apt-get build-dep pam
> $ dpkg -l | grep libdb
> ii  libdb-dev      5.3.0    amd64 Dummy package to fulfill package dependencies
> ii  libdb5.3:amd64 5.3.28-5 amd64 Berkeley v5.3 Database Libraries [runtime]
> $ apt-get source --build pam
> [...]
> $ echo $?
> 0

> I get the same effect when replacing pam by freetds and unixodbc and libdb-dev
> by libreadline-dev.

> Can you point out at which step my error is?

For the case of pam, I would be interested in seeing the full build log to
understand how in the world this built successfully without libdb.  That's
definitely a packaging error on my part, because without libdb,
pam_userdb.so should not build, which in turn *should* be treated as a build
failure.  But I guess I'm not accounting for individual modules in the build
output, since in general the greater risk is failing to keep this list in
sync with new upstream modules, rather than misbuilding and losing a module
from the tree.

Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
slangasek@ubuntu.com                                     vorlon@debian.org

Attachment: signature.asc
Description: Digital signature

Reply to: