RFC: Explicit Requires without comments

[Michael Schwendt]

Hello everyone!

Can we please enhance the packaging guidelines and request packagers to
add comments to explicit Requires more often than not?

Explicit Requires on package names are fragile. The contents of the
required package may move to a different (sub)package.

Uncommented Requires don't give a hint about why they have been added and
what inside a package is needed (with obvious exceptions, such as one
Python based package requiring another Python based package). What inside
a package is required? An executable? A directory? A datadir? A DBus
service? JavaScript files?

There's just
  https://fedoraproject.org/wiki/Packaging:Guidelines#Explicit_Requires
but it focuses on library deps and in particular specific versions.

What do you think?

[Mario Blättermann]

Am Sonntag, 25. August 2013, 01:02:21 schrieb Michael Schwendt:
>  Hello everyone!
>  
>  Can we please enhance the packaging guidelines and request packagers to
>  add comments to explicit Requires more often than not?
>  
>  Explicit Requires on package names are fragile. The contents of the
>  required package may move to a different (sub)package.
>  
Especially in case of scripting languages, rpm is unable to find the runtime 
deps automatically in almost all cases. So we have to add them anyway. Well, 
if the extra dep provides extra features which are not needed for the basic 
functionality of the software, then we should move this to a subpackage which 
pulls the extra dep and keep it off the main package. This would help to reduce 
the deps, and users can decide what they really need.

>  Uncommented Requires don't give a hint about why they have been
> added and
>  what inside a package is needed (with obvious exceptions, such as one
>  Python based package requiring another Python based package). What inside
>  a package is required? An executable? A directory? A datadir? A DBus
>  service? JavaScript files?
>  
If rpm adds its requirements due to library calls, it even doesn't comment 
this ;) But I agree with you, it would be helpful to have some explanation 
what a dependency is for. In most cases we can consult the docs in the tarball 
or the project homepage, but sometimes the packager stumbles upon a missing 
dep during the tests. At least in that case, the dep should be commented.

Best Regardsm
Mario

[Michael Schwendt]

On Sun, 25 Aug 2013 13:52:27 +0200, Mario Blättermann wrote:

>  
>  > Uncommented Requires don't give a hint about why they have been added and
>  > what inside a package is needed (with obvious exceptions, such as one
>  > Python based package requiring another Python based package). What inside
>  > a package is required? An executable? A directory? A datadir? A DBus
>  > service? JavaScript files?
>  >
>  If rpm adds its requirements due to library calls, it even doesn't comment 
>  this ;) But I agree with you, it would be helpful to have some explanation 
>  what a dependency is for. 
Well, the automatic Requires rpmbuild adds are strict dependencies and are
only added for stuff that is really detected as being required. Especially
for libraries. The library may move to a different package without breaking
the dependency.

On the contrary, a manually added dependency on a package name is a weak
dependency. What part of the package is needed? A library perhaps? If that
library gets moved into a -libs subpackage, that breaks the dependency.

>  In most cases we can consult the docs in the tarball 
>  or the project homepage, but sometimes the packager stumbles upon a missing 
>  dep during the tests. At least in that case, the dep should be commented. 
Good catch. I've missed that scenario.

I even think we've had it before that a packager dropped a comment-less
Requires again at some point, reintroducing a missing dependency, and a good
comment in the spec file would have prevented that (with a hint/explanation
about why the dep is needed).