FS#61719 - vercmp should avoid linking to libalpm.so for robustness

Attached to Project: Pacman
Opened by Dave Reisner (falconindy) - Monday, 11 February 2019, 11:53 GMT
Last edited by Eli Schwartz (eschwartz) - Thursday, 21 March 2019, 22:51 GMT
Task Type Bug Report
Category Backend/Core
Status Closed
Assigned To Eli Schwartz (eschwartz)
Architecture All
Severity Low
Priority Normal
Reported Version git
Due in Version 5.2.0
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Upgrading Arch today, I saw the following (with irrelevant packages omitted):

( 2/21) upgrading libidn2
( 6/21) upgrading systemd
vercmp: error while loading shared libraries: libidn2.so.4: cannot open shared object file: No such file or directory
vercmp: error while loading shared libraries: libidn2.so.4: cannot open shared object file: No such file or directory
vercmp: error while loading shared libraries: libidn2.so.4: cannot open shared object file: No such file or directory
vercmp: error while loading shared libraries: libidn2.so.4: cannot open shared object file: No such file or directory
vercmp: error while loading shared libraries: libidn2.so.4: cannot open shared object file: No such file or directory
vercmp: error while loading shared libraries: libidn2.so.4: cannot open shared object file: No such file or directory
( 7/21) upgrading curl

vercmp breaks when libidn2 is upgraded, and is fixed again after curl is upgraded.

This is because vercmp depends on libidn2 through the path:

vercmp -> libalpm.so -> libcurl.so -> libidn2.so

vercmp is a tiny binary, and only depends on a single symbol from libalpm. It's also a fairly critical binary that really needs to Just Work™ during upgrades. We should include lib/libalpm/version.c with the vercmp sources and drop the libalpm.so linkage.
This task depends upon

Closed by  Eli Schwartz (eschwartz)
Thursday, 21 March 2019, 22:51 GMT
Reason for closing:  Fixed
Additional comments about closing:  https://git.archlinux.org/pacman.git/com mit/?id=477a66cd0e7a1b8f5fb7d3b79d977da2 771ee09a
Comment by Dave Reisner (falconindy) - Monday, 11 February 2019, 12:00 GMT
On closer inspection, this is a difference between meson and autotools builds. autotools doesn't have the libalpm dependency.

Loading...