Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 906809

Summary: sys-apps/portage: allow merging RDEPEND after merging a package
Product: Portage Development Reporter: Sam James <sam>
Component: Core - DependenciesAssignee: Portage team <dev-portage>
Status: CONFIRMED ---    
Severity: normal CC: esigra, flow, gentoo, pacho, pms
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
See Also: https://bugs.gentoo.org/show_bug.cgi?id=647824
https://issuetracker.google.com/issues/283464020
https://bugs.gentoo.org/show_bug.cgi?id=279623
https://bugs.gentoo.org/show_bug.cgi?id=902207
https://bugs.gentoo.org/show_bug.cgi?id=663324
Whiteboard:
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 155723, 184128, 835380    

Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-05-20 07:57:24 UTC
PMS says a package's DEPEND must be present at the time of merge, but it doesn't say that for RDEPEND.

ulm dug up the following interesting changes over time to the phrasing in PMS:
- https://gitweb.gentoo.org/proj/pms.git/commit/?id=f7028c2758d8da7c1339ba33d89d21b3e720e0bb
- https://gitweb.gentoo.org/proj/pms.git/commit/?id=2f0989d0b6ee10d60593f4d800a1cf5b662f450f
- https://gitweb.gentoo.org/proj/pms.git/commit/?id=b7079f361efcc44d774b525b8907ae8d1a329b27
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-05-20 07:58:19 UTC
We've had a note about this in the devmanual for a long time at https://devmanual.gentoo.org/general-concepts/dependencies/#runtime-dependencies:

"""
Items which are in RDEPEND but not DEPEND could in theory be merged after the target package. Portage does not currently do this. 
"""

Prompted by spotting https://issuetracker.google.com/issues/283464020 (although the phrasing there might be slightly different to what we want?)
Comment 2 Mike Gilbert gentoo-dev 2023-05-20 17:47:29 UTC
This seems like a bad idea to me. Despite what PMS says, there are likely packages that require the current behavior. And I think the current behavior makes more sense anyway. I think PMS should be updated, not Portage.

For example, see bug 902207. There, we have acct-group packages which are in RDEPEND in acct-user packages. The groups MUST be merged before the users, or useradd will fail.

Listing the acct-group packages in DEPEND is wrong, and will be ineffective for binpkg installations.

Listing the acct-group packages in IDEPEND is wrong when BROOT != ROOT.