[mono-packagers] mono-find-(provides|requires)

[Jo Shields]

On Fri, 2008-12-12 at 08:56 -0700, Andrew Jorgensen wrote:
> There are some significant problems with the mono-find-(provides|requires) scripts as they exist now.  Some examples will illustrate the problem best:
> 
> smuxi requires mono(log4net) which is provided by log4net but it is also provided by mojoportal.  If you install mojoportal and then smuxi you will not get log4net and smuxi will not run.  As a stop-gap we currently filter the provides to remove things likelog4net from the provides list of mojoportal, for instance, but this is hacky and difficult to maintain.
> 
> The first logical step is to modify mono-find-provides so that it does not emit a provides for anything which is not in the gac.  This has the following problem:
> 
> monodevelop-boo requires mono(MonoDevelop.Core) but if mono-find-provides does not emit provides for things not installed in the gac then nothing provides mono(MonoDevelop.Core).
> 
> We could manually say that monodevelop provides mono(MonoDevelop.Core) but this would be error-prone and difficult to maintain, particularly as API versions may change between releases and the packager has no easy way to see that change.
> 
> Perhaps there's a way to check if a particular requirement is going tobe satisfied from the gac or from some other location and not emit arequires if it's not satisfied by the gac?  Then packagers would have to manually add a requires on the package that provides the assembly.  Also not desirable I think.
> 
> Another option would be to insist that MonoDevelop installMonoDevelop.Core to the gac but maybe that's undesirable.  Or maybe itis?  Please let me know if that's a good solution.
> 
> I don't know how best to solve this issue but it needs to be solved.  As more mono-based packages are added to linux distributions the problem will grow.  Please share your well-reasoned ideas and / or proposed patches.

I'll bite.

1) Why does mojoportal provide mono(log4net)? If it's a private bundled
lib which is not added to the GAC, then why lie and say it's provided
when it isn't?

If something isn't hitting the GAC, don't say you provide it, because
you simply don't. If you need to depend on a specific non-GAC app, then
depend on that app - don't muck about with putting things where they
don't belong, or with badly formed automatic dependency. Just say "I
require monodevelop, y'all"

2) Why does mojoportal even bundle that lib? Every bundled lib is a
security liability. If you didn't have ten copies of every lib across
ten different packages, you wouldn't have a problem.