Re: [gpsd-dev] libgps?

[Bernd Zeimetz]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 03/21/2015 04:26 PM, Greg Troxel wrote:
> 
> Do we really have platforms where chrpath is not available?  How about 
> making chrpath a hard dependency, except on named list of places where it's
> known not to work?  Then on most platforms this issue will go away.

I'm still a big fan of getting rid of chrpath. autotools and friends handle
such things just fine without chrpath, the only reason for this discussion is
the incomplete thing called scons.
One way to fix all problems would be to re-link all binaries at install time.
Or to install them into a .foo folder and provide wrapper scripts which do the
proper thing like libtool does. You can even run gdb with them if you read the
documentation.

> Packaging systems are not ok with making things that link with gpsd 
> statically link gpsd libraries.  That means that the scope of security 
> patching is much bigger; one can't just update the library with the bug. 
> (gpsd has a very low rate of this, but that's not the point.)

yes and no. For libgpsd it would be okayish to link it statically as it is
shipped with the same source and nobody is supposed to use it. It would be
just a waste of memory if programs can't share the library.

For libgps[^d]* we need a shared library, there is no way around that as every
upload of gpsd would result in a rebuild of several hundreds of MB of source 
code.

> So if you're talking about local copies for testing being static, and the 
> installed versions still dynamic, that does not seem super problematic, 
> other than accepting functional regressions due to hatred of libtool :-)

Which is not far from what I suggested above and in various other discussions
about chroot and scons on this list - re-link files in an appropriate way at
install time.

cheers,

bernd

- -- 
 Bernd Zeimetz                            Debian GNU/Linux Developer
 http://bzed.de                                http://www.debian.org
 GPG Fingerprint: ECA1 E3F2 8E11 2432 D485  DD95 EB36 171A 6FF9 435F
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJVDeEQAAoJEOs2Fxpv+UNf2xcQAKVJJJ7noQcDm9uIalJArPvv
5OSbvTs86Lr+LwiKACN+UPAWD/l1QxFY6giDmjSzE5t3HcGVKi0SZ8uo54lvWX94
fNVS80WZn3gm/GIn+rVZOVNPMswwQO6IR435otz78ABTKMwkmSvHIWUyZLoXhWSn
VOqVGB2bLhxDQl/kDAl4i5wMOp8+zbyDyPGO1f0Ozpo5nAXmqJ5eMSjcbRS9c3r6
oKvZjvv43cWBekuDvxBN3Nqkc2JxU+/tEB4eS9ZAbNdokyJq2Uj6V95w29x4PfWR
T/nhM3t8ryS9IqA4mW4/d0Uullboc6sqqgIJRgIxmrbTuaRAaZloBWGZ9bjxfvCJ
euBK1Ua+J1klhOrF0cSkmvZqY3jjcBSW0evKVYCB8BiprBjVGPSzUGEBxg9WoR4M
dTB5g4rrlEXMB6wCEoCtcAzFqNQsDv9+L88G7VvIGCSGyG+2vDbJ170oxFpsp7FX
JslWRyFxBlsmNY+9FdcmiQDnXSS/dmWS/mFqVPf3Sg7bkKIIh5vIK9JVW58BcLod
nY8s5cIi6EF92/3LnOB94uamLwy44anxHeTD2TMPHhu97XBrzSrEocvnLKS0fa2W
zqiw5i8kK+Zflw28c1bh1xhnFHXz+QHbbQwVajv/Xg3R0n/oZoP8l7PulL0vrANA
WdTeu7NXIcC6ZILNTZQA
=5wWe
-----END PGP SIGNATURE-----