Re: Packaging DSO symlinks

[Tomasz Kłoczko]

On 29 January 2018 at 15:11, Igor Gnatenko <ignatenkobrain(a)fedoraproject.org
>  wrote: 
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA256
>
>  Hello,
>
>  You might have seen that we are trying to eliminate /sbin/ldconfig from
>  scriptlets which would speedup installation / upgrade of packages
>  **significantly**.
>
>  One of cases Florian brought that in case of libcrypt/libcrypt-nss,
>  libraries
>  didn't have symlinks, so if it would not call ldconfig in its scriptlet,
>  then
>  any packages which depend on libcrypt.so would fail to execute.
>
>  In 99% (this number came just out of my head, not a real investigation) of
>  packages, we always package those symlinks.
>
>  So I'm going to push change to glibc which during build process executes
>  ldconfig in buildroot which is forcing to create those symlinks and your
>  package would fail to build with something like:
>  error: Installed (but unpackaged) file(s) found:
>     /usr/lib64/libhello.so.1
>
>  To disable this you would need to use `%undefine __brp_ldconfig` and you
>  really
>  need to make sure that you have %post/%postun scriptlets with
>  /sbin/ldconfig.
>
>  The plan is to get this in, then get transfiletrigger in glibc which would
>  execute ldconfig just **once per transaction** and then start removing
>  scriptlets from packages.
>  
Just FTR: it is one very good reason why those DSO SONAME symlinks *must be
packaged*.
If those files will be not packaged simple "rpm -Va" cannot verify those
symlinks that they've for example been repointed to some other DSO files
with some malware.

In other words: any Fedora package which does not package DSO SONAME
symlinks it is broken package, and it is completely independent fact from
whole ldconfig discussion.

kloczek
-- 
Tomasz Kłoczko | LinkedIn: *http://lnkd.in/FXPWxH <http://lnkd.in/FXPWxH>*