Re: [gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[James Le Cuirot]

On Mon, 12 Mar 2018 13:53:34 +
Andrey Utkin  wrote:

> On Thu, Mar 08, 2018 at 05:57:35PM +0100, Jeroen Roovers wrote:
> > On Thu, 08 Mar 2018 16:40:44 +0100
> > Michał Górny  wrote:
> >   
> > > As part of that we also shouldn't deliver static libraries  
> > 
> > OK, so you want to absolutely kill dead the only current sane way
> > for developers who use Gentoo to ship static binaries to their
> > users' target systems? Drive them away to another Linux distro that
> > does support being the build platform that they need? Or force
> > everyone to use EXTRA_ECONF"--enable-static" and hope for them that
> > it works for all packages? All just because static linking
> > *between* ebuilds is bad?  
> 
> This is close to my current case. Trying (in my own time) to build a
> (hopefully elegant) demo setup of Gentoo & crossdev with static libs
> enabled, to present as an alternative to CentOS which is currently the
> build env at my job (and static linkage is the way the product is
> built now). I run into cross-compilation problems when I enable
> USE=static-libs to any extent, despite the comment in Gentoo's fake
> /usr/lib64/*.so files saying "And yes, this works in the cross-
> compiling scenario as the sysroot-ed linker will prepend the real
> path". But it's what I'd rather have resolved than have no
> USE=static-libs at all.

libtool often screws up relinking unless --with-sysroot is passed to
configure, which is something we're adding for EAPI 7. I need to take a
closer look at those fake .so files to see whether anything more needs
to be done.

-- 
James Le Cuirot (chewi)
Gentoo Linux Developer

Re: [gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[Andrey Utkin]

On Thu, Mar 08, 2018 at 05:57:35PM +0100, Jeroen Roovers wrote:
> On Thu, 08 Mar 2018 16:40:44 +0100
> Michał Górny  wrote:
> 
> > As part of that we also shouldn't deliver static libraries
> 
> OK, so you want to absolutely kill dead the only current sane way for
> developers who use Gentoo to ship static binaries to their users'
> target systems? Drive them away to another Linux distro that does
> support being the build platform that they need? Or force everyone to
> use EXTRA_ECONF"--enable-static" and hope for them that it works for
> all packages? All just because static linking *between* ebuilds is bad?

This is close to my current case. Trying (in my own time) to build a
(hopefully elegant) demo setup of Gentoo & crossdev with static libs
enabled, to present as an alternative to CentOS which is currently the
build env at my job (and static linkage is the way the product is built
now). I run into cross-compilation problems when I enable
USE=static-libs to any extent, despite the comment in Gentoo's fake
/usr/lib64/*.so files saying "And yes, this works in the cross-
compiling scenario as the sysroot-ed linker will prepend the real path".
But it's what I'd rather have resolved than have no USE=static-libs at
all.


signature.asc
Description: Digital signature

Re: [gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[Michael Orlitzky]

On 03/08/2018 10:40 AM, Michał Górny wrote:
> 
> So, developers, please *stop adding USE=static-libs* to random libraries
> that have no reason whatever to be statically linked to. And by that I
> mean a good reason, not creeping featurism, not 'user asked for it', not
> 'this broken package hardcodes libfoo.a'.
> 
> If upstream doesn't build static libraries by default, don't add flags
> to make it do it.

I've felt the same way for a long time. Flexibility is usually good, but
we shouldn't be going out of our way to add time bombs just because
"safe OR fragile" is technically added flexibility.

Re: [gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[Francesco Riosa]

2018-03-08 16:40 GMT+01:00 Michał Górny :

> Hello, developers.
>
> I would like to bring to your attention an alarming trend in Gentoo
> ebuilds -- the proliferation of IUSE=static-libs, that is a flag
> allowing our users to build static libraries.
>
> I should like to remind you that static linking is almost always a bad
> idea. It has serious security implications, it is poorly supported on
> *nix systems (example: library dependencies are provided via hacks, we
> don't have proper rebuild capabilities) and should be basically
> considered  a great evil. Partially relevant doc: [1].
>
> This is why Gentoo does not generally support statically linking stuff,
> and we force dynamic linking whenever possible (sometimes even going too
> far with that but that's another story). We only allow static linking
> for special cases where shared linking can't be used for one reason
> or another.
>
> As part of that we also shouldn't deliver static libraries unless
> absolutely necessary to satisfy the dependencies of applications which
> we support built statically. Back in the day, Gentoo developers were
> pushing against packages that built static libraries unconditionally.
> However, it seems that at some point this front changed from 'fighting
> unconditionally built static libraries' to 'proliferating USE=static-
> libs everywhere'. Which is bad.
>
> So, developers, please *stop adding USE=static-libs* to random libraries
> that have no reason whatever to be statically linked to. And by that I
> mean a good reason, not creeping featurism, not 'user asked for it', not
> 'this broken package hardcodes libfoo.a'.
>

this would make impossible to use qemu static with binfmt alas
https://wiki.debian.org/QemuUserEmulation
Also looking for which packages are eligible for static libraries or not is
more work, not less, because it's a whole different layer of dependancies
(when doing the qemu stuff I just decided to build static for everything
rather than manage use flags per package)

Re: [gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[James Le Cuirot]

On Thu, 08 Mar 2018 16:40:44 +0100
Michał Górny  wrote:

> So, developers, please *stop adding USE=static-libs* to random libraries
> that have no reason whatever to be statically linked to.

Sorry, I like a lot of your ideas but I'm with the others on this one.
I have, on the rare occasion, used these flags for various reasons.
They don't do any harm for the majority not using them. If someone does
encounter issues through using them then they are free to deal with
those themselves. Better that than not even having them available in
the first place. They are welcome to provide fixes where necessary and
maintainers are equally welcome to drop these flags as they see fit.
Such a decision should not be forced upon maintainers.

-- 
James Le Cuirot (chewi)
Gentoo Linux Developer


pgp8q2QMSbjlX.pgp
Description: OpenPGP digital signature

Re: [gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[Jeroen Roovers]

On Thu, 08 Mar 2018 16:40:44 +0100
Michał Górny  wrote:

> As part of that we also shouldn't deliver static libraries

OK, so you want to absolutely kill dead the only current sane way for
developers who use Gentoo to ship static binaries to their users'
target systems? Drive them away to another Linux distro that does
support being the build platform that they need? Or force everyone to
use EXTRA_ECONF"--enable-static" and hope for them that it works for
all packages? All just because static linking *between* ebuilds is bad?

> So, developers, please *stop adding USE=static-libs* to random
> libraries that have no reason whatever to be statically linked to.

You could just as well work on stopping the package manager from linking
to static libraries instead and leave other developers to add
IUSE=static-libs as they please, so that no one has to worry about
static linking of packages that we do support in the package manager.

Please rethink your stated opinion thoroughly.

Also, please drop "random" from every odd sentence you post - it makes
your target audience feel like they're idiots who "didn't get it".

Also, please stop marketing your opinions as set in stone policy -
you're here to discuss things and develop policy, but your condescending
and authoritarian tone isn't helping the argument.


Kind regards,
 jer

Re: [gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[Rich Freeman]

On Thu, Mar 8, 2018 at 10:40 AM, Michał Górny  wrote:
>
> So, developers, please *stop adding USE=static-libs* to random libraries
> that have no reason whatever to be statically linked to. And by that I
> mean a good reason, not creeping featurism, not 'user asked for it', not
> 'this broken package hardcodes libfoo.a'.
>

While I agree with all the arguments against using static libs, this
seems a bit contrary to the spirit of Gentoo.  Certainly building
static libs shouldn't be the default.  However, if for some reason a
user feels they need static libs, do we really need to make them jump
through a million hoops simply because maybe we wouldn't do the same
thing in their shoes?

Why not just let maintainers add support if they wish, and neither
require them to do so nor prohibit or discourage them?

Now, if a package requires static linking that should be considered a
bug, except where it really does make sense (bootloaders, kernels,
firmware, etc).  If a package installs static libs by default this
should generally also be a bug.

IMO this is not a feature that causes harm simply by being available.
It isn't like a dialog box that has 500 boxes to hunt through.  This
is a global use flag that everybody understands, and which defaults to
off.  Keep in mind also that a lot of people use Gentoo in weird
niches, and flexibility is our main selling point.  Our users
shouldn't have to beg to have use cases supported if it is easy to
support them, just because their use cases are rare.  If we excluded
all rare use cases from Gentoo we'd probably exclude just about all of
them in practice, because if somebody just wanted Ubuntu or CentOS or
Debian they'd be using Ubuntu or CentOS or Debian.

Just my own two cents here.

-- 
Rich

Re: [gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[Alec Warner]

On Thu, Mar 8, 2018 at 10:40 AM, Michał Górny  wrote:

> Hello, developers.
>
> I would like to bring to your attention an alarming trend in Gentoo
> ebuilds -- the proliferation of IUSE=static-libs, that is a flag
> allowing our users to build static libraries.
>
> I should like to remind you that static linking is almost always a bad
> idea. It has serious security implications, it is poorly supported on
> *nix systems (example: library dependencies are provided via hacks, we
> don't have proper rebuild capabilities) and should be basically
> considered  a great evil. Partially relevant doc: [1].
>
> This is why Gentoo does not generally support statically linking stuff,
> and we force dynamic linking whenever possible (sometimes even going too
> far with that but that's another story). We only allow static linking
> for special cases where shared linking can't be used for one reason
> or another.
>

> As part of that we also shouldn't deliver static libraries unless
> absolutely necessary to satisfy the dependencies of applications which
> we support built statically. Back in the day, Gentoo developers were
> pushing against packages that built static libraries unconditionally.
> However, it seems that at some point this front changed from 'fighting
> unconditionally built static libraries' to 'proliferating USE=static-
> libs everywhere'. Which is bad.
>
>
So to me this is a murky metadistribution / distribution problem.

Like if upstream ships "--enable-static-libs" we should probably support a
USE flag to enable it; this is the metadistribution use case.[1]

For people actually running Gentoo, Gentoo strongly advises not building
static libs (and we can disable the static-libs USE flag in a profile or
otherwise
encourage users not to use it because of all the reasons stated.)

So, developers, please *stop adding USE=static-libs* to random libraries
> that have no reason whatever to be statically linked to. And by that I
> mean a good reason, not creeping featurism, not 'user asked for it', not
> 'this broken package hardcodes libfoo.a'.
>
> If upstream doesn't build static libraries by default, don't add flags
> to make it do it. If upstream builds static libraries by default, just
> pass '--disable-static' instead of adding a flag for it. If upstream
> uses CMake and supports building only one type of libraries, there's no
> need to write patches to make it behave like automake/libtool.
>
> Also, if your package has unnecessary IUSE=static-libs that is not
> correctly needed by any other package, please drop it.
>
> Please remember that not installing static libraries is the first step
> towards preventing broken build systems from unnecessary linking to them
> (think of upstreams who pass -Wl,-Bstatic unconditionally).
>

[1] I am somewhat empathetic to the argument that when we support something
in the metadistribution but no distributions are using it; it can become
stale / broken / untested
and I'd consider not adding the flags on those grounds though.


>
> Thanks.
>
> [1]:https://wiki.gentoo.org/wiki/Why_not_bundle_dependencies
>
> --
> Best regards,
> Michał Górny
>
>
>

[gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[Michał Górny]

Hello, developers.

I would like to bring to your attention an alarming trend in Gentoo
ebuilds -- the proliferation of IUSE=static-libs, that is a flag
allowing our users to build static libraries.

I should like to remind you that static linking is almost always a bad
idea. It has serious security implications, it is poorly supported on
*nix systems (example: library dependencies are provided via hacks, we
don't have proper rebuild capabilities) and should be basically
considered  a great evil. Partially relevant doc: [1].

This is why Gentoo does not generally support statically linking stuff,
and we force dynamic linking whenever possible (sometimes even going too
far with that but that's another story). We only allow static linking
for special cases where shared linking can't be used for one reason
or another.

As part of that we also shouldn't deliver static libraries unless
absolutely necessary to satisfy the dependencies of applications which
we support built statically. Back in the day, Gentoo developers were
pushing against packages that built static libraries unconditionally.
However, it seems that at some point this front changed from 'fighting
unconditionally built static libraries' to 'proliferating USE=static-
libs everywhere'. Which is bad.

So, developers, please *stop adding USE=static-libs* to random libraries
that have no reason whatever to be statically linked to. And by that I
mean a good reason, not creeping featurism, not 'user asked for it', not
'this broken package hardcodes libfoo.a'.

If upstream doesn't build static libraries by default, don't add flags
to make it do it. If upstream builds static libraries by default, just
pass '--disable-static' instead of adding a flag for it. If upstream
uses CMake and supports building only one type of libraries, there's no
need to write patches to make it behave like automake/libtool.

Also, if your package has unnecessary IUSE=static-libs that is not
correctly needed by any other package, please drop it.

Please remember that not installing static libraries is the first step
towards preventing broken build systems from unnecessary linking to them
(think of upstreams who pass -Wl,-Bstatic unconditionally).

Thanks.

[1]:https://wiki.gentoo.org/wiki/Why_not_bundle_dependencies

-- 
Best regards,
Michał Górny