runtime dependencies not in Requires spec section

[Germano Massullo]

I am one of the keepassxc maintainers. Bugreport

"Missing dependency: qt5-qtsvg libQt5Svg.so.5"
https://bugzilla.redhat.com/show_bug.cgi?id=1911210

made me wonder about the following thing:

I just installed a basic Fedora server to do a test concerning keepassxc
libs. Keepassxc spec file [1] does not contain any Requires dependency,
but when I install it, it triggers the installation of these libraries
[2] that are needed at runtime.

My question is: how can keepassxc trigger the installation of such
libraries if the spec file does not contain any Requires dependency that
should be the attribute to identify runtime dependencies that are needed
by the package?

Thank you

[1]:
https://src.fedoraproject.org/rpms/keepassxc/blob/master/f/keepassxc.spec

[2]:

fontconfig freetype glx-utils graphite2 harfbuzz langpacks-core-font-en
libICE libSM libX1 libX11-common libX11-xcb libXau libXdamage libXext
libXfixes libXi libXtst libXxf86vm libdrm libevdev libglvnd libglvnd-egl
libglvnd-glx libinput libjpeg-turbo libpciaccess libsodium libwacom
libwacom-data libwayland-client libwayland-server libxcb
libxkbcommon-x11 libxshmfence libyubikey llvm-libs mesa-filesystem
mesa-libEGL mesa-libGL mesa-libgbm mesa-libglapi mtdev pcre2-utf16
qt-settings qt5-qtbase qt5-qtbase-common qt5-qtbase-gui qt5-qtsvg
qt5-qtx11extras quazip-qt5 xcb-util xcb-util-image xcb-util-keysyms
xcb-util-renderutil xcb-util-wm xml-common ykpers Weak dependencies:
mesa-dri-drivers

[Jerry James]

On Wed, Dec 30, 2020 at 2:49 PM Germano Massullo
<germano.massullo(a)gmail.com&gt; wrote:
>  I am one of the keepassxc maintainers. Bugreport
>
>  "Missing dependency: qt5-qtsvg libQt5Svg.so.5"
> https://bugzilla.redhat.com/show_bug.cgi?id=1911210
>
>  made me wonder about the following thing:
>
>  I just installed a basic Fedora server to do a test concerning keepassxc libs. Keepassxc
> spec file [1] does not contain any Requires dependency, but when I install it, it triggers
> the installation of these libraries [2] that are needed at runtime.
>
>  My question is: how can keepassxc trigger the installation of such libraries if the spec
> file does not contain any Requires dependency that should be the attribute to identify
> runtime dependencies that are needed by the package? 

RPM can query ELF objects (executables and shared libraries) to find
DT_NEEDED fields.  That gives it a list of libraries that are depended
on directly.  It generates Requires for those dependencies
automatically; see /usr/lib/rpm/find-requires.  So the keepassxc
package does contain Requires, they just don't appear explicitly in
the spec file (and shouldn't).
-- 
Jerry James
http://www.jamezone.org/

[Vitaly Zaitsev]

On 30.12.2020 23:01, Jerry James wrote:
>  RPM can query ELF objects (executables and shared libraries) to find
>  DT_NEEDED fields.  That gives it a list of libraries that are depended
>  on directly. 
Except for Qt5Svg, because it is a Qt runtime plugin.

-- 
Sincerely,
   Vitaly Zaitsev (vitaly(a)easycoding.org)

[Germano Massullo]

Jerry James wrote:
>  RPM can query ELF objects (executables and shared libraries) to find
>  DT_NEEDED fields.  That gives it a list of libraries that are depended
>  on directly.  It generates Requires for those dependencies
>  automatically; see /usr/lib/rpm/find-requires.  So the keepassxc
>  package does contain Requires, they just don't appear explicitly in
>  the spec file (and shouldn't). 
So this explains the difference with Python packages that instead many
times need Requires.


Vitaly Zaitsev wrote:
>  On 30.12.2020 23:01, Jerry James wrote:
> > RPM can query ELF objects (executables and shared libraries) to find
> > DT_NEEDED fields.  That gives it a list of libraries that are depended
> > on directly.
>
>  Except for Qt5Svg, because it is a Qt runtime plugin. 
Actually Qt5Svg does not need Requires
https://bugzilla.redhat.com/show_bug.cgi?id=1911210#c1

[Zbigniew Jędrzejewski-Szmek]

On Sat, Jan 02, 2021 at 04:13:56PM +0100, Germano Massullo wrote:
>  Jerry James wrote:
>  > RPM can query ELF objects (executables and shared libraries) to find
>  > DT_NEEDED fields.  That gives it a list of libraries that are depended
>  > on directly.  It generates Requires for those dependencies
>  > automatically; see /usr/lib/rpm/find-requires.  So the keepassxc
>  > package does contain Requires, they just don't appear explicitly in
>  > the spec file (and shouldn't).
>  
>  So this explains the difference with Python packages that instead many
>  times need Requires. 
They used to, but not anymore. Modern Python packaging autogenerates
Provides/Requires based on the native Python metadata, at least in the
simple cases.

>  Vitaly Zaitsev wrote:
>  > On 30.12.2020 23:01, Jerry James wrote:
>  >> RPM can query ELF objects (executables and shared libraries) to find
>  >> DT_NEEDED fields.  That gives it a list of libraries that are depended
>  >> on directly.
>  >
>  > Except for Qt5Svg, because it is a Qt runtime plugin.
>  
>  Actually Qt5Svg does not need Requires
>  https://bugzilla.redhat.com/show_bug.cgi?id=1911210#c1 
Zbyszek

[Vitaly Zaitsev]

On 30.12.2020 22:49, Germano Massullo wrote:
>  My question is: how can keepassxc trigger the installation of such 
>  libraries if the spec file does not contain any Requires dependency that 
>  should be the attribute to identify runtime dependencies that are needed 
>  by the package? 
Yes, it must. Qt5Svg is a Qt runtime plugin, so it will not be added 
automatically by rpmbuild.

-- 
Sincerely,
   Vitaly Zaitsev (vitaly(a)easycoding.org)

[Rex Dieter]

Vitaly Zaitsev via devel wrote:

>  On 30.12.2020 22:49, Germano Massullo wrote:
> > My question is: how can keepassxc trigger the installation of such
> > libraries if the spec file does not contain any Requires dependency that
> > should be the attribute to identify runtime dependencies that are needed
> > by the package?
>  
>  Yes, it must. Qt5Svg is a Qt runtime plugin, so it will not be added
>  automatically by rpmbuild. 
It's a linked library, so *yes*, rpmbuild will add it.

-- Rex

[Kevin Kofler]

Rex Dieter wrote:
>  It's a linked library, so *yes*, rpmbuild will add it. 
Depends on whether the application links directly to libQt5Svg.so.5 or 
whether it uses it only through the plugin-based imageformats API 
(libqsvg.so). (And there's also the iconengines/libqsvgicon.so plugin.)

        Kevin Kofler

[Rex Dieter]

Kevin Kofler via devel wrote:

>  Rex Dieter wrote:
> > It's a linked library, so *yes*, rpmbuild will add it.
>  
>  Depends on whether the application links directly to libQt5Svg.so.5 or
>  whether it uses it only through the plugin-based imageformats 
In this context, for the software/package in question, I verified that it 
links libQt5Svg.so.5

-- Rex