Re: CVE check for Octave dependencies

[c.]

On 19 Dec 2013, at 08:36, John W. Eaton <address@hidden> wrote:

> On 12/19/2013 02:23 AM, c. wrote:
>> 
>> On 19 Dec 2013, at 07:52, Reza Housseini <address@hidden> wrote:
>> 
>> 
>>> That's a good idea. Can someone also provide names of the packages to 
>>> install for other systems? For example Cygwin, Fedora, etc.?
>>> I was also wondering why LLVM isn't on the list from the webpage?
>> 
>> 
>> Here's the complete recursive list of dependecies for Octave 3.8.0-rc1 on 
>> Mac OSX 10.9 +macports:
> 

jwe, 


> If you want to list dependencies for Octave in the manual or on the wiki, I 
> think it makes sense to just list the direct dependencies.

I think the full list of non-system packages is useful 
in order to work on the build system for OSX.

For example if at some point soemeone will want to make the MXE build 
system work on OSX (Jordi?), all of those dependencies will have
to be fetched and built by the build scripts.

I think the reason why Anirhuda's build script is not currently
portable is that he had installed macports and he was assuming
that many of those ports were not required just because he had 
them installed in the macports tree.

> Or, if you think it is necessary to list them all, then I think it would be 
> beset to list them in some kind of tree structure so it is easy to see which 
> ones are secondary dependencies and so on.

yes, that would be much better. 
I'll look into a way to get a 
more structured list.

> At what point do you stop listing the sub-dependencies?  

As far as OSX is concerned I think a good rule of thumbs would be that 
it is useful to know about any dependencies that are not installed by default 
with the system.

> Does (nearly) every package ultimately depend on the C library and kernel?

According to the rule of thumbs above, I would not list the kernel but I did 
have 
to list the c and c++ standard libraries as Octave won't link to the ones 
shipped
by default with the mac.

> jwe

c.