Bug 848435 - varnish package requires gcc
Summary: varnish package requires gcc
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: varnish
Version: el6
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Ingvar Hagelund
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-08-15 15:20 UTC by John Franklin
Modified: 2012-08-15 16:15 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-08-15 16:15:36 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description John Franklin 2012-08-15 15:20:41 UTC
Description of problem:
Installing varnish also installs the GCC compiler (and gcc's dependencies), adding a package that does not belong on a production system and a number of unnecessary gcc-dependent packages such as glibc-devel.

Version-Release number of selected component (if applicable):
varnish.x86_64 0:2.1.5-1.el6

How reproducible:
Always

Steps to Reproduce:
1. yum install varnish
2. observe: "--> Processing Dependency: gcc for package: varnish-2.1.5-1.el6.x86_64"
3.
  
Actual results:
Installs a compiler on what may be a production system.

Expected results:
No compiler.


Additional info:
Perhaps the GCC requirement should be a build requirement.

Comment 1 Ingvar Hagelund 2012-08-15 16:15:36 UTC
This is a FAQ, often asked because one does not know the nature of Varnish. In short, to make Varnish usable, gcc is needed, even on production systems.

Quoting Poul-Henning Kamp, Varnish' main developer: 
( https://www.varnish-cache.org/docs/2.1/faq/general.html )

Why does Varnish require the system to have a C compiler?

The VCL compiler generates C source as output (your config file), and uses the systems C-compiler to compile that into a shared library. If there is no C compiler, Varnish will not work.

Isn’t that security problem?

The days when you could prevent people from running non-approved programs by removing the C compiler from your system ended roughly with the VAX 11/780 computer.


Note You need to log in before you can comment on or make changes to this bug.