Bug#688251: dpkg-dev: Need to add support for Built-Using to dpkg-shlibdeps or new similar tool

[Jonathan Nieder <jrnieder@gmail.com>]

Hi,

Nicholas Bamber wrote:

> 	Sorry yes I did not mean to imply that there was a copyright issue
> with the inclusion of debhelper fragments in maintenance scripts, just
> an example of techincally it might happen. The policy explicitly
> mentions "incorporating source code".

Based on <http://bugs.debian.org/688251>, it seems there is some
belief that the policy wording here is broken.  I'm inclined to agree
with that --- it would be lovely to have a table of what binary
packages incorporate code from what source packages to help with
binnmus when there is an important fix, but that would be a pain to
maintain and wasn't the purpose of the Built-Using field that caused
a consensus to form around adding it to policy.

For reference, the current wording is:

	Some binary packages incorporate parts of other packages when
	built but do not have to depend on those packages. Examples
	include linking with static libraries or incorporating source
	code from another package during the build. In this case, the
	source packages of those other packages are a required part of
	the complete source (the binary package is not reproducible
	without them).

	A Built-Using field must list the corresponding source package
	for any such binary package incorporated during the build

I suspect some mention of license requirements or a threshold of
substantial amounts of code copied would help.

[...]
> For a more copyright-heavy example, see how "handlersocket" is  built
> using mysql-source-5.5.

Yes, that is a more typical case where Built-Using is intended to be
useful.

In pseudocode, something like this should work:

	built_using=

	for package in Build-Depends:
		if package name does not match the pattern *-source-*:
			continue
		pkgname=$(dpkg-query -W -f='${source:Package}' $package)
		pkgver=$(dpkg-query -W -f='${source:Version}' $package)
		built_using=${built_using+$built_using, }$pkgname" (= $pkgver)"

	...
	dpkg-genchanges -Vbuilddeps:Built-Using="$built_using" ...

This mechanism should be very useful for some use cases such as safely
adding cross-compilers (which build-depend and incorporate code from
gcc-source) to the archive.

Hoping that clarifies,
Jonathan