Policy should require _pic libraries for static-only libraries
Gerrit Pape wrote:
> Nothing forces a maintainer to provide a _pic.a library, original
> upstream says that this is not what the library is intended for.
Checked djb's website; he says absolutely nothing about _pic.a libraries.
There is no claim there that "that is not what the library is intended for".
He writes:
"Packages that need to read cdb files should incorporate the necessary
portions of the cdb library rather than relying on an external cdb library."
Now, this makes security support more difficult for no apparent reason, but
let's accept it!
If you're making a shared library, "incorporat[ing] the necessary portions of
the cdb library" is normally done by linking in the _pic.a library. So why
isn't there a _pic.a library?
> I
> can't see how you justify severity serious, not through policy AFAIK.
Good point. Let's amend policy to require that a _pic.a library be provided
for any static-only library; it seems to be an unreasonable omission. I
wouldn't consider a library package which can't be used by any shared library
to be releasable. Would anyone else?
Reply to: