Debian Bug report logs - #370387
building against libsoup might result in more gnutls libs being used

version graph

Package: libsoup2.2-dev; Maintainer for libsoup2.2-dev is (unknown);

Reported by: Michal Čihař <michal@cihar.com>

Date: Sun, 4 Jun 2006 22:18:09 UTC

Severity: normal

Found in version libsoup/2.2.93-1

Fixed in version libsoup/2.2.93-3

Done: Loic Minier <lool@dooz.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Loic Minier <lool@dooz.org>:
Bug#370387; Package libsoup2.2-dev. Full text and rfc822 format available.

Acknowledgement sent to Michal Čihař <michal@cihar.com>:
New Bug report received and forwarded. Copy sent to Loic Minier <lool@dooz.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Michal Čihař <michal@cihar.com>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: building against libsoup might result in more gnutls libs being used
Date: Mon, 05 Jun 2006 00:10:13 +0200
Package: libsoup2.2-dev
Version: 2.2.93-1
Severity: normal

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi

While preparing update of mpdscribble, I was notified that resulting
binary is built against more libgnutls libraries. This is caused by two
facts in libsoup2.2-dev package:

1. -lgnutls is listed in pkgconfig file, is it really needed there?

2. libsoup2.2-dev depends on libgnutls-dev, however it libgnutls-dev is
also provided by libgnutls11-dev

For fixing this I suggest to make dependendy on libgnutls-dev stricter
(libgnutls-dev > 1.3.0 or something like that).

- -- 
    Michal Čihař | http://cihar.com | http://blog.cihar.com

- -- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.16-raptor
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages libsoup2.2-dev depends on:
ii  libgcrypt11-dev            1.2.2-1       LGPL Crypto library - development 
ii  libglib2.0-dev             2.10.3-1      Development files for the GLib lib
ii  libgnutls-dev              1.3.5-1.1     the GNU TLS library - development 
ii  libgpg-error-dev           1.2-1         library for common error values an
ii  libsoup2.2-8               2.2.93-1      an HTTP library implementation in 
ii  libtasn1-2-dev             1:0.2.17-2    Manage ASN.1 structures (developme
ii  libxml2-dev                2.6.24.dfsg-1 Development files for the GNOME XM
ii  zlib1g-dev                 1:1.2.3-11    compression library - development

libsoup2.2-dev recommends no packages.

- -- no debconf information

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEg1pF3DVS6DbnVgQRApeQAJ4hAH+n4yEnGjS7YicQ+mtmXJLmagCgy8l1
7GvbFzMyEa+dKHkMh3REjZc=
=rWZ+
-----END PGP SIGNATURE-----



Information forwarded to debian-bugs-dist@lists.debian.org, Loic Minier <lool@dooz.org>:
Bug#370387; Package libsoup2.2-dev. Full text and rfc822 format available.

Acknowledgement sent to Loïc Minier <lool@dooz.org>:
Extra info received and forwarded to list. Copy sent to Loic Minier <lool@dooz.org>. Full text and rfc822 format available.

Message #10 received at 370387@bugs.debian.org (full text, mbox):

From: Loïc Minier <lool@dooz.org>
To: Michal Cihar <michal@cihar.com>, 370387@bugs.debian.org
Subject: Re: Bug#370387: building against libsoup might result in more gnutls libs being used
Date: Mon, 5 Jun 2006 10:59:34 +0200
retitle 370387 Split libsoup-2.2.pc's with a Libs.private
stop

        Hi,

On Mon, Jun 05, 2006, Michal Cihar wrote:
> While preparing update of mpdscribble, I was notified that resulting
> binary is built against more libgnutls libraries. This is caused by two
> facts in libsoup2.2-dev package:

 Could you paste the exact warning that you got?

> 1. -lgnutls is listed in pkgconfig file, is it really needed there?

 It's needed for static linking; it could be moved to Libs.private
 instead, and that would prevent linking against gnutls in the dynamic
 linking case you're probably in.  I've retitled the bug report to that
 effect.

> 2. libsoup2.2-dev depends on libgnutls-dev, however it libgnutls-dev is
> also provided by libgnutls11-dev

 Yes, and this is IMO correct:
 bee% grep-dctrl -F Build-Depends -s Package libgnutls-dev <
 /var/lib/apt/lists/*Sources | wc -l
 93
 bee% grep-dctrl -F Build-Depends -s Package libgnutls11-dev <
 /var/lib/apt/lists/*Sources | wc -l
 20

 Please note that libgnutls-dev is a real package which Replaces
 libgnutls11-dev.

> For fixing this I suggest to make dependendy on libgnutls-dev stricter
> (libgnutls-dev > 1.3.0 or something like that).

 Hmm, I think this would be incorrect as libsoup is buildable with
 libgnutls11-dev as well.

 Let me know why you think this is the correct approach.

   Bye,
-- 
Loïc Minier <lool@dooz.org>



Information forwarded to debian-bugs-dist@lists.debian.org, Loic Minier <lool@dooz.org>:
Bug#370387; Package libsoup2.2-dev. Full text and rfc822 format available.

Acknowledgement sent to Michal Čihař <michal@cihar.com>:
Extra info received and forwarded to list. Copy sent to Loic Minier <lool@dooz.org>. Full text and rfc822 format available.

Message #15 received at 370387@bugs.debian.org (full text, mbox):

From: Michal Čihař <michal@cihar.com>
To: Loïc Minier <lool@dooz.org>, 370387@bugs.debian.org
Subject: Re: Bug#370387: building against libsoup might result in more gnutls libs being used
Date: Mon, 5 Jun 2006 11:49:42 +0200
[Message part 1 (text/plain, inline)]
Hi

On Mon, 5 Jun 2006 10:59:34 +0200
Loïc Minier <lool@dooz.org> wrote:

> On Mon, Jun 05, 2006, Michal Cihar wrote:
> > While preparing update of mpdscribble, I was notified that resulting
> > binary is built against more libgnutls libraries. This is caused by two
> > facts in libsoup2.2-dev package:
> 
>  Could you paste the exact warning that you got?

It's warning from linda that binary is linked against two version of
same library.

> > 2. libsoup2.2-dev depends on libgnutls-dev, however it libgnutls-dev is
> > also provided by libgnutls11-dev
> 
>  Yes, and this is IMO correct:

IMO no because of libgnutls.so symlink in libgnutls11-dev which points
to another version than libsoup is using. This will break static
linkage and results in strange results in dynamic linkage.

>  Please note that libgnutls-dev is a real package which Replaces
>  libgnutls11-dev.

I know that it is real package, however nothing forces me to upgrade
and deps of libsoup2.2-dev are satisfied also with libgnutls11-dev what
can lead to problems (I expect this is temporary until libgnutls11
vanishes from archives).

>  Hmm, I think this would be incorrect as libsoup is buildable with
>  libgnutls11-dev as well.

So the dependency should be filled in on build time.

-- 
	Michal Čihař | http://cihar.com | http://blog.cihar.com
[signature.asc (application/pgp-signature, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Loic Minier <lool@dooz.org>:
Bug#370387; Package libsoup2.2-dev. Full text and rfc822 format available.

Acknowledgement sent to Loïc Minier <lool+debian@via.ecp.fr>:
Extra info received and forwarded to list. Copy sent to Loic Minier <lool@dooz.org>. Full text and rfc822 format available.

Message #20 received at 370387@bugs.debian.org (full text, mbox):

From: Loïc Minier <lool+debian@via.ecp.fr>
To: Debian Devel <debian-devel@lists.debian.org>, 370387@bugs.debian.org
Subject: Correct dependencies on libgnutls-dev? (#370387)
Date: Sun, 18 Jun 2006 20:10:15 +0200
        Hi,

 I received #370387 claiming that I should version my libgnutls-dev dep
 because libgnutls11-dev provides libgnutls-dev and this can cause
 multiple versions of libgnutls to be linked to a binary (e.g. the
 version pulled by libsoup, and the version pulled by -lgnutls when the
 binary is built).

 I consider all of this is normal even if it indeed allows binaries to
 end up linked with multiple versions of gnutls.

 If we were to force all binaries to link to one and only one gnutls,
 then we wouldn't allow two or three gnutls versions in the archive at
 the same time.

 Is this correct?  Am I missing something?

   Thanks for comments,
-- 
Loïc Minier <lool@dooz.org>



Information forwarded to debian-bugs-dist@lists.debian.org, Loic Minier <lool@dooz.org>:
Bug#370387; Package libsoup2.2-dev. Full text and rfc822 format available.

Acknowledgement sent to Goswin von Brederlow <brederlo@informatik.uni-tuebingen.de>:
Extra info received and forwarded to list. Copy sent to Loic Minier <lool@dooz.org>. Full text and rfc822 format available.

Message #25 received at 370387@bugs.debian.org (full text, mbox):

From: Goswin von Brederlow <brederlo@informatik.uni-tuebingen.de>
To: Debian Devel <debian-devel@lists.debian.org>
Cc: 370387@bugs.debian.org
Subject: Re: Correct dependencies on libgnutls-dev? (#370387)
Date: Mon, 19 Jun 2006 00:22:30 +0200
Loïc Minier <lool+debian@via.ecp.fr> writes:

>         Hi,
>
>  I received #370387 claiming that I should version my libgnutls-dev dep
>  because libgnutls11-dev provides libgnutls-dev and this can cause
>  multiple versions of libgnutls to be linked to a binary (e.g. the
>  version pulled by libsoup, and the version pulled by -lgnutls when the
>  binary is built).

Provided package can never be versioned since dpkg does not support
that. Also, if 2 or more packages provide a virtual package then you
may not Build-Depend on that virtual package but must use "real |
virt". But I don't think this is the case for libgnutls-dev.

I think you are correct to depend on the virtual libgnutls-dev. If
libsoup needs a specific version of libgnutls to be used when linking
then libsoup-dev should depend on the stricter libgnutls11-dev package
to force linking against the correct one. I don't think it is the
packages job to guess what sub libraries their libraries need.

If you Build-Depend on libgnutls11-dev and libsoup updates to
libgnutls12 your package will become instantly FTBFS while with
libgnutls-dev it will just need a binNMU to transition.

>  I consider all of this is normal even if it indeed allows binaries to
>  end up linked with multiple versions of gnutls.

Happens all the time, at least with different versions with the same
abi/soname of a library. Mixing libfoo1 and libfoo2 is usualy bad.

>  If we were to force all binaries to link to one and only one gnutls,
>  then we wouldn't allow two or three gnutls versions in the archive at
>  the same time.

If the symbols in libgnutls are properly versioned you could even mix
libraries linked against different versions of libgnutls. But not
every library is that clean, most require a combined transition of all
libs in a binary at once.

>  Is this correct?  Am I missing something?

Don't think so.

>    Thanks for comments,

MfG
        Goswin



Information forwarded to debian-bugs-dist@lists.debian.org, Loic Minier <lool@dooz.org>:
Bug#370387; Package libsoup2.2-dev. Full text and rfc822 format available.

Acknowledgement sent to Loïc Minier <lool+debian@via.ecp.fr>:
Extra info received and forwarded to list. Copy sent to Loic Minier <lool@dooz.org>. Full text and rfc822 format available.

Message #30 received at 370387@bugs.debian.org (full text, mbox):

From: Loïc Minier <lool+debian@via.ecp.fr>
To: Debian Devel <debian-devel@lists.debian.org>, 370387@bugs.debian.org
Subject: Re: Correct dependencies on libgnutls-dev? (#370387)
Date: Mon, 19 Jun 2006 10:10:59 +0200
        Hi,

On Mon, Jun 19, 2006, Goswin von Brederlow wrote:
> >  I received #370387 claiming that I should version my libgnutls-dev dep
> >  because libgnutls11-dev provides libgnutls-dev and this can cause
> >  multiple versions of libgnutls to be linked to a binary (e.g. the
> >  version pulled by libsoup, and the version pulled by -lgnutls when the
> >  binary is built).
> Provided package can never be versioned since dpkg does not support
> that. Also, if 2 or more packages provide a virtual package then you
> may not Build-Depend on that virtual package but must use "real |
> virt". But I don't think this is the case for libgnutls-dev.

 (Please note there is a real libgnutls-dev package, only
 libgnutls11-dev Provides libgnutls-dev, there's no libgnutls12- or
 13-dev packages; that's why I don't need "real | virt", I use "real".)

 Thanks for your comments, I'll close this bug as I think this is
 regular practice.
-- 
Loïc Minier <lool@dooz.org>



Reply sent to Loïc Minier <lool@dooz.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Michal Čihař <michal@cihar.com>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #35 received at 370387-done@bugs.debian.org (full text, mbox):

From: Loïc Minier <lool@dooz.org>
To: Michal Cihar <michal@cihar.com>
Cc: 370387-done@bugs.debian.org
Subject: Re: Bug#370387: building against libsoup might result in more gnutls libs being used
Date: Mon, 19 Jun 2006 12:37:48 +0200
        Hi,

On Mon, Jun 05, 2006, Michal Cihar wrote:
> It's warning from linda that binary is linked against two version of
> same library.

 This is supposed to work, especially with libraries with versionned
 symbols such as libgnutls.

> IMO no because of libgnutls.so symlink in libgnutls11-dev which points
> to another version than libsoup is using. This will break static
> linkage and results in strange results in dynamic linkage.

 It's not supposed to break, and even it it would, libsoup only needs a
 bin NMU to fix it.

> I know that it is real package, however nothing forces me to upgrade
> and deps of libsoup2.2-dev are satisfied also with libgnutls11-dev what
> can lead to problems (I expect this is temporary until libgnutls11
> vanishes from archives).

 I think sbuild will pull libgnutls-dev, as virtual packages are not
 supported.

> So the dependency should be filled in on build time.

 This looks quite dangerous.

 I brought the discussion to debian-devel@ldo, and Goswin von Brederlow
 supported my position:
    <http://lists.debian.org/debian-devel/2006/06/thrd2.html#00808>

 I am closing the bug for now, as I believe what I'm doing is regular
 and expected practice.

 If you think this is incorrect, please argument on debian-devel@ and
 reopen this bug if necessary.

   Bye,
-- 
Loïc Minier <lool@dooz.org>



Information forwarded to debian-bugs-dist@lists.debian.org, Loic Minier <lool@dooz.org>:
Bug#370387; Package libsoup2.2-dev. Full text and rfc822 format available.

Acknowledgement sent to Goswin von Brederlow <brederlo@informatik.uni-tuebingen.de>:
Extra info received and forwarded to list. Copy sent to Loic Minier <lool@dooz.org>. Full text and rfc822 format available.

Message #40 received at 370387@bugs.debian.org (full text, mbox):

From: Goswin von Brederlow <brederlo@informatik.uni-tuebingen.de>
To: Debian Devel <debian-devel@lists.debian.org>
Cc: 370387@bugs.debian.org
Subject: Re: Correct dependencies on libgnutls-dev? (#370387)
Date: Tue, 20 Jun 2006 12:36:32 +0200
Loïc Minier <lool+debian@via.ecp.fr> writes:

>         Hi,
>
> On Mon, Jun 19, 2006, Goswin von Brederlow wrote:
>> >  I received #370387 claiming that I should version my libgnutls-dev dep
>> >  because libgnutls11-dev provides libgnutls-dev and this can cause
>> >  multiple versions of libgnutls to be linked to a binary (e.g. the
>> >  version pulled by libsoup, and the version pulled by -lgnutls when the
>> >  binary is built).
>> Provided package can never be versioned since dpkg does not support
>> that. Also, if 2 or more packages provide a virtual package then you
>> may not Build-Depend on that virtual package but must use "real |
>> virt". But I don't think this is the case for libgnutls-dev.
>
>  (Please note there is a real libgnutls-dev package, only
>  libgnutls11-dev Provides libgnutls-dev, there's no libgnutls12- or
>  13-dev packages; that's why I don't need "real | virt", I use "real".)
>
>  Thanks for your comments, I'll close this bug as I think this is
>  regular practice.

Ahh, sorry, I missed that libgnutls-dev itself exists too. If you use
a versioned Build-Depends on it that will prevent libgnutls11-dev to
be taken instead accidentaly. So I guess that is a good idea.

MfG
        Goswin



Bug reopened, originator not changed. Request was from Loic Minier <lool@dooz.org> to control@bugs.debian.org. Full text and rfc822 format available.

Reply sent to Loic Minier <lool@dooz.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Michal Čihař <michal@cihar.com>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #47 received at 370387-close@bugs.debian.org (full text, mbox):

From: Loic Minier <lool@dooz.org>
To: 370387-close@bugs.debian.org
Subject: Bug#370387: fixed in libsoup 2.2.93-3
Date: Sun, 25 Jun 2006 11:02:17 -0700
Source: libsoup
Source-Version: 2.2.93-3

We believe that the bug you reported is fixed in the latest version of
libsoup, which is due to be installed in the Debian FTP archive:

libsoup2.2-8_2.2.93-3_i386.deb
  to pool/main/libs/libsoup/libsoup2.2-8_2.2.93-3_i386.deb
libsoup2.2-dev_2.2.93-3_i386.deb
  to pool/main/libs/libsoup/libsoup2.2-dev_2.2.93-3_i386.deb
libsoup2.2-doc_2.2.93-3_all.deb
  to pool/main/libs/libsoup/libsoup2.2-doc_2.2.93-3_all.deb
libsoup_2.2.93-3.diff.gz
  to pool/main/libs/libsoup/libsoup_2.2.93-3.diff.gz
libsoup_2.2.93-3.dsc
  to pool/main/libs/libsoup/libsoup_2.2.93-3.dsc



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 370387@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Loic Minier <lool@dooz.org> (supplier of updated libsoup package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 24 Jun 2006 16:47:24 +0200
Source: libsoup
Binary: libsoup2.2-doc libsoup2.2-8 libsoup2.2-dev
Architecture: source all i386
Version: 2.2.93-3
Distribution: unstable
Urgency: medium
Maintainer: Loic Minier <lool@dooz.org>
Changed-By: Loic Minier <lool@dooz.org>
Description: 
 libsoup2.2-8 - an HTTP library implementation in C -- Shared library
 libsoup2.2-dev - an HTTP library implementation in C -- Development files
 libsoup2.2-doc - an HTTP library implementation in C -- API Reference
Closes: 370387
Changes: 
 libsoup (2.2.93-3) unstable; urgency=medium
 .
   * Build-depend on libgnutls-dev (>= 1.4.0) since the broken libgnutls-dev
     Provide is here for a while. (Closes: #370387)
   * Depend on libgnutls-dev (>= 1.4.0) due to the above change.
   * Build-conflict and conflict with libgnutls11-dev for additional safety, as
     I'm not sure how the lack of support for versionned Provides might behave
     here.
Files: 
 2bd29fbe2975b5fb6855e4e3302d76e9 1548 devel optional libsoup_2.2.93-3.dsc
 339e14aea46168438a7666d7df491703 4577 devel optional libsoup_2.2.93-3.diff.gz
 957bb93a64eed7804ceb04089e196b29 111720 devel optional libsoup2.2-doc_2.2.93-3_all.deb
 6e2f64d4c99cdd00276f82476fdbaa5f 152492 devel optional libsoup2.2-dev_2.2.93-3_i386.deb
 b032c89bde60c3aa2c4b1bf92bf2781f 121096 libs optional libsoup2.2-8_2.2.93-3_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEnY0I4VUX8isJIMARAo/FAJ4uMjybeId/C9QhASvC30rGLoIxjgCgrqVi
FebAuAx2SOeN3Cvn/bhCVgQ=
=11VD
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Wed, 27 Jun 2007 00:00:09 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Thu Apr 17 01:35:49 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.