[CDRIVER-2610] Debian package for libmongoc 1.9.-0+ should require libresolv Created: 12/Apr/18  Updated: 27/Oct/23  Resolved: 13/Apr/18

Status: Closed
Project: C Driver
Component/s: debian
Affects Version/s: 1.9.0
Fix Version/s: 1.9.5

Type: Bug Priority: Major - P3
Reporter: A. Jesse Jiryu Davis Assignee: Roberto Sanchez
Resolution: Works as Designed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified


 Description   

Roberto I noticed while reading CDRIVER-2603 that our latest Debian package doesn't depend on libresolv, although the C Driver now uses libresolv if available, in order to look up SRV records (CDRIVER-2257). Do we need a libresolv dependency in our Debian package now?



 Comments   
Comment by A. Jesse Jiryu Davis [ 13/Apr/18 ]

Thanks very much!

Comment by Roberto Sanchez [ 13/Apr/18 ]

jesse, the short answer here is, "yes, the RPM build system properly handles library dependencies like this" (though it does so in a different way). The bottom line is that this bug (CDRIVER-2610) can definitely be closed as invalid, as everything in the Debian package is properly specified and no change is required. It also looks like CDRIVER-2603 can be closed, since the RPM spec file is not maintained in the mongo-c-driver repository and the issue being reported is the responsibility of the maintainer of that file. Read on for a more detailed analysis and explanation.

The wording of the bug report (linked from CDRIVER-2603) is clear that the problem is with the mongo-c-driver-devel-1.9.3-1 package, which contains a pkg-config script listing several libraries which the package itself does not list as Requires (the equivalent of Depends for a Debian package). Note that this refers to a dependency that must be in place in order to build against mongo-c-driver, which is different from a Build-Requires (or Build-Depends for Debian), which is required in order to build mongo-c-driver itself. Sphinx would be an example of a Build-Requires that is not needed in Requires.

The bug report further lists the specific items which are missing from the Requires section of the mongo-c-driver-devel RPM. Comparing the two most recent RPM versions (1.9.3-1 and 1.9.4-1), you can see the change that was made:

1.9.3-1: https://koji.fedoraproject.org/koji/rpminfo?rpmID=13434394

Requires	
/usr/bin/pkg-config
libmongoc-1.0.so.0()(64bit)
mongo-c-driver(x86-64) = 1.9.3-2.fc28
pkgconfig
pkgconfig(libbson-1.0)
pkgconfig(libmongoc-1.0)
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rpmlib(PayloadIsXz) <= 5.2-1

1.9.4-1: https://koji.fedoraproject.org/koji/rpminfo?rpmID=13681137

Requires	
/usr/bin/pkg-config
libmongoc-1.0.so.0()(64bit)
mongo-c-driver(x86-64) = 1.9.4-1.fc28
openssl-devel
pkgconfig
pkgconfig(libbson-1.0)
pkgconfig(libbson-1.0) > 1.9
pkgconfig(libmongoc-1.0)
pkgconfig(libsasl2)
pkgconfig(snappy)
pkgconfig(zlib)
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rpmlib(PayloadIsXz) <= 5.2-1

You can see that all that was done was to add openssl-devel, libsasl2, snappy, and zlib. That addition was made in the Requires section of the mongo-c-driver-devel package, so that when someone installs mongo-c-driver-devel those additional packages will also be installed if they are not already. That sort of thing is normal as the packaging systems for neither Debian nor RPM packages handle automatically figuring out which development package dependencies any given development package requires. Specifying hat has always been the responsibility of the package maintainer.

For example, if you look at the Package: libmongoc-dev entry in debian/control, you will see that libssl-dev, zlib1g-dev, and libsnappy-dev are all explicitly listed there. Compare that with Package: libmongoc-1.0-0 which uses the special shlibs:Depends substitution variable to allow the packaging system to compute the necessary library dependencies.

Comment by A. Jesse Jiryu Davis [ 13/Apr/18 ]

Great, thanks! Do you happen to know if the same automatic dependency tracking is implemented for RPMs? If not, that would explain CDRIVER-2603.

Comment by Roberto Sanchez [ 12/Apr/18 ]

jesse, the short answer is, "no."

The Debian packaging scripts automatically create dependencies on appropriate library packages based on the symbols present in a packages binaries and libraries. It is only necessary to specify a manual dependency if the package uses a library in a way that the scripts can determine, as might be the case with a library used via dlopen().

In our case, libresolv is part of libc6 (which is a required package).

user@debian:~$ locate libresolv
/lib/i386-linux-gnu/libresolv-2.24.so
/lib/i386-linux-gnu/libresolv.so.2
/lib/x86_64-linux-gnu/libresolv-2.24.so
/lib/x86_64-linux-gnu/libresolv.so.2
/usr/lib/x86_64-linux-gnu/libresolv.a
/usr/lib/x86_64-linux-gnu/libresolv.so
user@debian:~$ dpkg -S /lib/x86_64-linux-gnu/libresolv.so.2
libc6:amd64: /lib/x86_64-linux-gnu/libresolv.so.2
user@debian:~$ apt-cache show libc6 |grep ^Priority
Priority: required

In any event, I am relatively certain that if an important library dependency were missing that someone would have filed a big about it by this point.

Generated at Wed Feb 07 21:15:46 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.