-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Robert Osfield wrote: > Well many other projects are using /usr/local/lib for 64bit libs, I'm > afraid from my experience that it's more prevalent than installing > locally compiled libraries in /usr/local/lib64. Much as you may > infer that /usr/local/lib64 is the standard and the convention, it > certainly doesn't seem to be the dominant convention. Technically I > would say I'd suggest /usr/local/lib64 is a better convention, but I > think asserting /usr/local/lib for 64bit libs isn't appropriate is > rather a stretch given it's widespread usage.
You are not taking into account that 64bit systems are far less prevalent than 32bit ones, even though most machines sold in the last two years are capable of running 64bit code. So your assertion does not really carry that much weight here. > Searching the archives it looked likes Debian used not add > /usr/local/lib on the default library search path either, but now > does. I can't imagine that there is really a security issue though, > as you need super user to install to /usr/local/lib just as you do to > /usr/lib so if a dodgy lib wants to infiltrate your system then > /usr/lib is just an easy/hard a target as /usr/local/lib. That is only partially true - /usr hierarchy can be mounted over NFS and may not be writable even by root (common in clusters or computer labs). /usr/local hierarchy should never be mounted from a network share and therefore can be locally compromised. However, it is quite an esoteric issue and if someone has gained root on your machine, you have probably much worse problems than this. I recall seeing the argument against the local being searched by default being made before. It makes sense from the "deny all/off by default" security philosophy - i.e. enable only what you need and not more. Anyhow, it is not something we can really solve. > It's curious one would create a /usr/local/lib64 and then not provide > a library path to it... It makes sense in a way - if there is nothing installed, there is no need for the path, unlike /usr/lib*. It is the responsibility of the software being installed to set itself up appropriately. > For OSG-2.8 I would really like to be able to get it into all the > major Linux distribution repositories. Do you have a link to the > Mandriva details on OSG? Mandriva has/used to have version 1.0 in the contrib repositories (i.e. community supported package, not company supported), packaged by Stefan van der Eijk <stefan at mandriva dot org> and later by Per Øyvind Karlsen <pkarlsen at mandriva dot com>. However, if I recall correctly, Per has stopped working on anything Mandriva-related due to personal reasons and has left Mandriva. The package is essentially orphaned right now. You can get the source RPM package from here: http://distrib-coffee.ipsl.jussieu.fr/pub/linux/MandrivaLinux/devel/cooker/SRPMS/contrib/release/OpenSceneGraph-1.0.0-1mdk.src.rpm (btw, the 64bit Madriva package installs itself to /usr/lib64 ...) That includes at least the spec file which could be used as a start to build a newer package. You could also post a packaging request to the Cooker mailing list (http://wiki.mandriva.com/en/Development/Mailinglists), it is possible that someone will pick it up and make a package. > This is a good point, if you are going to compile from source you > should at least should know about library paths etc. If you have > trouble with the add to your LD_LIBRARY_PATH or patching > /etc/ld.so.conf then you are going to have many other things to learn > as well. Exactly. And for packaged versions it is a non-issue, because then the package will install to /usr/lib* which is in the path already. > > Perhaps another solution would be to have CMake check where the > installed library is on the search path or not, and if not to produce > a suggestion of how to add it to the path. Isn't this the case already? I recall that the build used to produce a message at the end that you should do so. Did this change after introducing CMake build? To be honest, I didn't actually notice it disappearing, but I am rebuilding OSG using a set of scripts and didn't really look for this any more :) Regards, Jan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mandriva - http://enigmail.mozdev.org iD8DBQFJfdapn11XseNj94gRAg2QAJ9g/ox47p9znh+4CnXEHkm2fCs09gCg4nal JS8kd3+6CoKmobVCv6SthuA= =lmrJ -----END PGP SIGNATURE----- _______________________________________________ osg-users mailing list osg-users@lists.openscenegraph.org http://lists.openscenegraph.org/listinfo.cgi/osg-users-openscenegraph.org
