According to upstream (see http://bugzilla.gnome.org/show_bug.cgi?id=352199) we can get rid of the problem not by messing around with Requires.private, but by removing the "--enable-explicit-deps=yes" from the configure flags that we give in the gtk packaging. Tom Parker