[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bad practice to make a package depend on a specific kernel image

On Mon, 2007-01-01 at 21:51 -0500, Roberto C. Sanchez wrote:
> On Tue, Jan 02, 2007 at 01:48:57PM +1100, Robert Collins wrote:
> > > > 
> > > Yes.  But enough people build non-packaged kernels that it is not really
> > > fair to exclude them.  Add to that the fact that the presence of a
> > > particular kernel image package in no way guarantees that it is that
> > > particular kernel that is running, and you it is plain that it is not
> > > necessary to depend on a particular kernel.
> > 
> > This is true, and irrelevant: the presence of a packaged library version
> > does not in any way guarantee that the files from that will be the ones
> > picked up by the runtime loader, and so on and so forth for executables,
> > dynamic language modules, images etc.
> > 
> It is quite relevant.  If someone installs a library package and then
> changes the files, that is their own problem.  You can also in many
> cases have multiple versions of a library available and have them all be
> usable simultaneously.  With a kernel, you boot A and kernel B is no
> longer running or accessible.  You boot B and A is no longer running or
> accessible.  By accessible, I mean for runtime use.
> This is not true of a library.

I think you are arguing around the issue. An example may help. Consider
an application that needs 'libhello' built with ssl support. i.e.
Depends: libhello-ssl0

That installs /usr/lib/libhello.so

Now, if I fiddle with the system: change the runtime library path,
dpkg-divert /usr/lib/libhello.so, or do other tricks, the application
will stop working.

The point of packaging is to let things work as well as possible by
default. Its not true to say that kernels and libraries are identical in
their constraints : and I haven't claimed that. What I have claimed is
that in no case is there any guarantee that what dpkg *thinks* is
present actually is. 

But where we can signal to it that something is *not* present, that is
useful, as dpkg can then signal to the user that intervention is


GPG key available at: <http://www.robertcollins.net/keys.txt>.

Attachment: signature.asc
Description: This is a digitally signed message part

Reply to: