FS#77706 - [libepoxy] Missing dependency: libglvnd

Attached to Project: Arch Linux
Opened by Balló György (City-busz) - Friday, 03 March 2023, 02:31 GMT
Last edited by Toolybird (Toolybird) - Friday, 26 May 2023, 23:24 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Laurent Carlier (lordheavy)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

libepoxy uses dlopen() to open the libraries (libGL.so.1, libEGL.so.1) provided by libglvnd, so it's a runtime dependency:
https://github.com/anholt/libepoxy/blob/8db879f810e2dbc63824c43c17eeea0d3dbca1a2/src/dispatch_common.c
#L547-L559

Please add libglvnd to depends=() of libepoxy.
This task depends upon

Closed by  Toolybird (Toolybird)
Friday, 26 May 2023, 23:24 GMT
Reason for closing:  Fixed
Additional comments about closing:  libepoxy 1.5.10-2
Comment by Toolybird (Toolybird) - Friday, 03 March 2023, 04:42 GMT
Hmm, it's a grey area. The whole point of dlopen() is "dynamic" loading i.e. the modules do not necessarily need to exist. Adding to depends() defeats the original author's intent of using dlopen in the first place. I sense potential trouble in some QEMU use cases for example. Thoughts?
Comment by Balló György (City-busz) - Friday, 03 March 2023, 10:02 GMT
If the library/application can be used without the library opened with dlopen(), then it can be an optdepend. Omitting it completely is not recommended.

But in this case, you can't use libepoxy without libglvnd, it's an essential dependency. It's also added as a requirement to the pkg-config file for the reason you don't need libglvnd during the build, but you definitely need it to run any dependent code:
https://github.com/anholt/libepoxy/blob/master/src/meson.build#L98-L107

And requirements specified in pkg-config files should be added as dependencies, as it was stated on arch-dev-public mailing list:
https://lists.archlinux.org/archives/list/arch-dev-public%40lists.archlinux.org/thread/A2MV7T3NDHVHWX6WHIHH2DKH4YSWSIIX/
Comment by Toolybird (Toolybird) - Monday, 06 March 2023, 06:47 GMT
So this is all quite dubious. Anything that relies on determining runtime deps via pkg-config is broken by design. I've outlined my reasons why here [1]. namcap folks are free to disagree...but they'd be wrong :)

[1] https://gitlab.archlinux.org/pacman/namcap/-/issues/29#note_89781

Loading...