[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Bug#804047: Build-Depends on gengetopt needed?

From: Simon Josefsson
Subject: Bug#804047: Build-Depends on gengetopt needed?
Date: Tue, 10 Nov 2015 11:08:37 +0100
User-agent: Gnus/5.130014 (Ma Gnus v0.14) Emacs/24.4 (gnu/linux)

Sebastien Bacher <address@hidden> writes:

> Package: libidn
> Version: 1.32-3
> Hey,
> Is the Build-Depends on gengetopt needed? The package seems to build
> fine without it

Gengetopt is required to rebuild idn_cmd.h/idn_cmd.c from the idn.ggo

I believe the Debian best established practice is to always rebuild as
much as possible from source code so that we don't end up in situations
where it is no longer possible to rebuild from source.

If there is ever a security vulnerability in gengetopt, so that it
generates insecure programs, it would be nice for the Debian security
people to be able to patch gengetopt and then simply rebuild libidn,
instead of having to ALSO patch libidn and then rebuild it.

However, in this case, the files won't be rebuilt anyway, since the
idn.ggo file modification timestamp is before the idn_cmd.h/idn_cmd.c
files.  So the attempt to do the right thing is not achieving anything.

All this said, I would prefer a patch that instead of dropping gengetopt
as build dependency, would make sure that the files are rebuilt
properly.  Maybe it is as easy as "touch src/idn.ggo", but I know that
modifying the source tree sometimes leads to other problems.  I'll
experiment a bit.


Attachment: signature.asc
Description: PGP signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]