Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 752153 - sys-apps/portage: build time slot operator dependencies do not trigger rebuilds (golang packages for example)
Summary: sys-apps/portage: build time slot operator dependencies do not trigger rebuil...
Alias: None
Product: Portage Development
Classification: Unclassified
Component: Core - Interface (emerge) (show other bugs)
Hardware: All All
: Normal normal with 1 vote (vote)
Assignee: Portage team
Depends on:
Blocks: 155723
  Show dependency tree
Reported: 2020-11-01 21:10 UTC by Zac Medico
Modified: 2022-08-04 04:44 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Zac Medico gentoo-dev 2020-11-01 21:10:37 UTC
Since build time dependencies are considered optional for built/installed packages, build time slot operator deps do not necessarily trigger rebuilds. For example, following a dev-lang/go subslot upgrade, this can prevent rebuilds of packages that have a build time dev-lang/go:= dependency.
Comment 1 Larry the Git Cow gentoo-dev 2020-11-01 21:11:58 UTC
The bug has been referenced in the following commit(s):

commit 075c1951e1ac84e99a2219ff14be4a366d274f36
Author:     Georgy Yakovlev <>
AuthorDate: 2020-10-16 19:43:54 +0000
Commit:     Zac Medico <>
CommitDate: 2020-11-01 21:11:09 +0000

    cnf/sets/portage.conf: add new sets for go rebuilding go packages
    go-built binaries may contain security
    vulnerabilities if a binary built with vulnerable compiler.
    go is known to embed vulnerable code to all binaries it builds, if
    vulnerability was present in the compiler or one of standard libraries.
    This commit adds `golang-rebuild` set, which allows easy
    rebuild of most go-compiled system packages.
    simple 'emerge @golang-rebuild' should rebuild everything affected.
    a prompt to run this command can be added to postinst message in
    dev-lang/go ebuild.
    Signed-off-by: Georgy Yakovlev <>
    Signed-off-by: Zac Medico <>

 cnf/sets/portage.conf | 6 ++++++
 1 file changed, 6 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2020-11-02 02:01:33 UTC
The bug has been referenced in the following commit(s):

commit 43cc36f055d6c4fd9c8761ecb50f57027180a1dd
Author:     Zac Medico <>
AuthorDate: 2020-11-02 01:57:51 +0000
Commit:     Zac Medico <>
CommitDate: 2020-11-02 01:58:00 +0000

    sys-apps/portage: Bump to version 3.0.9
     #199722 Enable QA Notice for deprecated hasq/useq in *rm phases
     #704498 Fix pid-sandbox to handle Ctrl+Z correctly
     #752066 Add emerge --quickpkg-direct-root option
     #752147 Fix make.conf to expand special *ROOT variables
     #752153 Add @golang-rebuild package set
    Package-Manager: Portage-3.0.9, Repoman-3.0.2
    Signed-off-by: Zac Medico <>

 sys-apps/portage/Manifest             |   1 +
 sys-apps/portage/portage-3.0.9.ebuild | 267 ++++++++++++++++++++++++++++++++++
 2 files changed, 268 insertions(+)
Comment 3 Larry the Git Cow gentoo-dev 2020-11-15 05:56:42 UTC
The bug has been referenced in the following commit(s):

commit e9c0ef7609e8e2068af8c9c7138f1a2dc22fcfb0
Author:     Zac Medico <>
AuthorDate: 2020-11-15 04:25:22 +0000
Commit:     Zac Medico <>
CommitDate: 2020-11-15 05:54:37 +0000

    Add slot operator := BDEPEND unit tests for bug 752153
    Test these two distinct cases:
    1) Regular dev-lang/go upgrade, with rebuild of packages that
    have dev-lang/go:= in BDEPEND.
    2) Rebuild of packages that have dev-lang/go:= in BDEPEND, after
    the built slot operator deps have already been broken by an
    earlier dev-lang/go upgrade.
    Signed-off-by: Zac Medico <>

 .../tests/resolver/     | 209 +++++++++++++++++++++
 1 file changed, 209 insertions(+)
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-28 05:26:28 UTC
I think this is arguably a PMS issue (or Go and Rust packages should (R)DEPEND w/ := on Go/Rust to allow the rebuilds, but that would be pretty annoying for some, I guess.)