Bug 2360992
| Summary: | rpm 6.0 pulls gnupg2 and a dozen dependencies into minimal rawhide buildroot | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Fabio Valentini <decathorpe> |
| Component: | rpm | Assignee: | Panu Matilainen <pmatilai> |
| Status: | ASSIGNED --- | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | code, igor.raits, mdomonko, ngompa13, packaging-team-maint, pmatilai, ssorce |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Fabio Valentini
2025-04-18 15:56:15 UTC
rpm-sign-libs is not a dependency of *rpm*, it's a dependency of *rpm-build*. But yeah that would affect the minimal buildroot somewhat. The hard dependency on gnupg2 is kinda wrong now though, it could now be "gnupg2 or sequoia-sq". The latter pulling considerably less fubar with it, but since the choice between gnupg/sequoia is a user configurable thing, expressing it through dependencies isn't going to work well. Maybe the build-time autosigning feature should just use dlopen() instead of linking to librpmsign and just have a recommends on it instead, that'd basically put us back to the previous situation. The gnupg/sq dependency issue within rpm-libs-sign is a kind of a separate issue. > since the choice between gnupg/sequoia is a user configurable thing, expressing it through dependencies isn't going to work well
In that case - would it make sense to depend on *neither*, and let users pull in the dependency manually that matches their configuration?
This comment was flagged as spam, view the edit history to see the original text if required. This comment was flagged as spam, view the edit history to see the original text if required. This comment was flagged as spam, view the edit history to see the original text if required. This comment was flagged as spam, view the edit history to see the original text if required. This comment was flagged as spam, view the edit history to see the original text if required. This comment was flagged as spam, view the edit history to see the original text if required. This comment was flagged as spam, view the edit history to see the original text if required. (In reply to Panu Matilainen from comment #1) > rpm-sign-libs is not a dependency of *rpm*, it's a dependency of > *rpm-build*. But yeah that would affect the minimal buildroot somewhat. > > The hard dependency on gnupg2 is kinda wrong now though, it could now be > "gnupg2 or sequoia-sq". The latter pulling considerably less fubar with it, > but since the choice between gnupg/sequoia is a user configurable thing, > expressing it through dependencies isn't going to work well. Shouldn't this be addressable by a provides (let's call it "rpm-signing") in gnupg2 and sequoia-sq and ten have rpm-build depend on "rpm-signing" instead of gnpg2 ? As far as I can tell, this has the same problems as "Requires: (gnupg2 or sequoia-sq)", just with extra steps. And in both cases, there is either an an implicit (alphabetical?) or explicit (Suggests: ...) preference. |