Bug 848435 - varnish package requires gcc
varnish package requires gcc
Product: Fedora EPEL
Classification: Fedora
Component: varnish (Show other bugs)
Unspecified Linux
unspecified Severity medium
: ---
: ---
Assigned To: Ingvar Hagelund
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2012-08-15 11:20 EDT by John Franklin
Modified: 2012-08-15 12:15 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-08-15 12:15:36 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description John Franklin 2012-08-15 11:20:41 EDT
Description of problem:
Installing varnish also installs the GCC compiler (and gcc's dependencies), adding a package that does not belong on a production system and a number of unnecessary gcc-dependent packages such as glibc-devel.

Version-Release number of selected component (if applicable):
varnish.x86_64 0:2.1.5-1.el6

How reproducible:

Steps to Reproduce:
1. yum install varnish
2. observe: "--> Processing Dependency: gcc for package: varnish-2.1.5-1.el6.x86_64"
Actual results:
Installs a compiler on what may be a production system.

Expected results:
No compiler.

Additional info:
Perhaps the GCC requirement should be a build requirement.
Comment 1 Ingvar Hagelund 2012-08-15 12:15:36 EDT
This is a FAQ, often asked because one does not know the nature of Varnish. In short, to make Varnish usable, gcc is needed, even on production systems.

Quoting Poul-Henning Kamp, Varnish' main developer: 
( https://www.varnish-cache.org/docs/2.1/faq/general.html )

Why does Varnish require the system to have a C compiler?

The VCL compiler generates C source as output (your config file), and uses the systems C-compiler to compile that into a shared library. If there is no C compiler, Varnish will not work.

Isn’t that security problem?

The days when you could prevent people from running non-approved programs by removing the C compiler from your system ended roughly with the VAX 11/780 computer.

Note You need to log in before you can comment on or make changes to this bug.