Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 560306 - net-misc/openssh: fix openssl[static-libs] dep to only match SLOT=0
Summary: net-misc/openssh: fix openssl[static-libs] dep to only match SLOT=0
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-09-12 21:57 UTC by Rick Farina (Zero_Chaos)
Modified: 2015-09-14 20:57 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments
suggested ebuild patch (openssh-openssl-dep-fixes.patch,1.99 KB, text/plain)
2015-09-12 22:06 UTC, Rick Farina (Zero_Chaos)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Rick Farina (Zero_Chaos) gentoo-dev 2015-09-12 21:57:23 UTC
slot 0 is only openssh 1.x, so having >=openssl-0.9.6d is redundant since openssl:0 will always pull in a version greater than 0.9.6d

may I fix this?
Comment 1 Rick Farina (Zero_Chaos) gentoo-dev 2015-09-12 22:05:40 UTC
additionally, dev-libs/openssl[static-libs(+)] would attempt to build if openssl:0.9.8[static-libs] were set and openssl:0[-static-libs] was set, which would be wrong for openssh[static-libs] so the dep should be changed to dev-libs/openssl:0[static-libs(+)]
Comment 2 Rick Farina (Zero_Chaos) gentoo-dev 2015-09-12 22:06:54 UTC
Created attachment 411754 [details]
suggested ebuild patch

this patch should resolve both issues
Comment 3 Rick Farina (Zero_Chaos) gentoo-dev 2015-09-12 22:08:27 UTC
As requested by robbat2 on irc, I will only fix this if both he and vapier ACK it, otherwise, any base-system member may choose to do it for me.
Comment 4 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2015-09-12 22:27:01 UTC
Rick:
Your patch does NOT apply cleanly, it's got an extra layer of USE-bindist wrapping around the openssl dependencies, that is NOT in the main tree.
Comment 5 SpanKY gentoo-dev 2015-09-12 23:22:07 UTC
we specifically do not change DEPEND values based on the ebuilds that are *currently* available in the tree.  there's nothing stopping people from having installed versions older than that in which case the upgrade is not forced.  while it's true you've made things a little bit simpler by dropping the version dep, i'm not seeing it really being worthwhile.

that said, the openssh INSTALL docs says they require at least 0.9.8f, so we should update the dep to match.
Comment 6 Rick Farina (Zero_Chaos) gentoo-dev 2015-09-13 02:21:45 UTC
(In reply to SpanKY from comment #5)
> we specifically do not change DEPEND values based on the ebuilds that are
> *currently* available in the tree.  there's nothing stopping people from
> having installed versions older than that in which case the upgrade is not
> forced.  while it's true you've made things a little bit simpler by dropping
> the version dep, i'm not seeing it really being worthwhile.
> 
> that said, the openssh INSTALL docs says they require at least 0.9.8f, so we
> should update the dep to match.

the issue is, if the user has two different slots of openssl installed, they can each satisfy the deps partially and portage says it is okay.  please see comment 1.
Comment 7 SpanKY gentoo-dev 2015-09-13 03:56:39 UTC
(In reply to Rick Farina (Zero_Chaos) from comment #6)

i don't know what you're highlighting.  openssh depends on:
        >=dev-libs/openssl-0.9.8f:0[bindist=]
        dev-libs/openssl[static-libs(+)]

it has a SLOT & a version dep.  that means you must have >=openssl-0.9.8f which has SLOT=0.  it doesn't mean you can have >=openssl-0.9.8f:0.9.8 will satisfy the version part while an unrelated openssl:0 version will satisfy the SLOT part.

it also means it needs any version of openssl installed with USE=static-libs enabled.  only SLOT=0 has ever provided that, so in practice only one installed openssl package can satisfy these.
Comment 8 Rick Farina (Zero_Chaos) gentoo-dev 2015-09-13 04:15:49 UTC
(In reply to SpanKY from comment #7)
> it also means it needs any version of openssl installed with USE=static-libs
> enabled.  only SLOT=0 has ever provided that, so in practice only one
> installed openssl package can satisfy these.

https://devmanual.gentoo.org/eclass-reference/ebuild/
"Use (+) to behave as if a missing flag is present and enabled"

This means that a slot 0 package could match >=dev-libs/openssl-0.9.8f:0[bindist=] while any slot package, with or without the static-libs use flag, could match dev-libs/openssl[static-libs(+)]

So each of these two deps could currently be satisfied by a different slot package.  I suspect that is not intended.
Comment 9 SpanKY gentoo-dev 2015-09-13 06:05:53 UTC
(In reply to Rick Farina (Zero_Chaos) from comment #8)

yes, that is true.  so you just want to add :0 to the existing static-libs dep ?  that's not what you talked about in comment #0, and not really what the summary of this bug describes ...
Comment 10 Rick Farina (Zero_Chaos) gentoo-dev 2015-09-13 15:08:11 UTC
(In reply to SpanKY from comment #9)
> (In reply to Rick Farina (Zero_Chaos) from comment #8)
> 
> yes, that is true.  so you just want to add :0 to the existing static-libs
> dep ?  that's not what you talked about in comment #0, and not really what
> the summary of this bug describes ...

Apologies, as my understanding of your goals has evolved my suggested fix has evolved as well.  yes, I want to add :0 to dev-libs/openssl[static-libs(+)]
Comment 12 Rick Farina (Zero_Chaos) gentoo-dev 2015-09-14 20:57:26 UTC
(In reply to SpanKY from comment #11)
> should be fixed by:
> http://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=d449aefe1f6635ea30acc81a5c6732681f89f7f3

awesome, thank you