[Pkg-samba-maint] Symbol files and hard dependencies of ldb, tdb, tevent and talloc2 on Samba

[Mathieu Parent]

Le mar. 17 sept. 2019 à 03:12, Matt Grant <matt at mattgrant.net.nz> a écrit :
>
> Hi!
>
> Aware that Debian policy is driving the inclusion of symbol files in these packages, but when samba.org have a hard build dependency in the samba build against these packages, allowing a samba package in sid to run against stretch or buster versions of the above libraries may results in an install that is not officially supported upstream.

Those libs have public stable API. Except ldb where samba is tightly
coupled. The only problem we hadwas with ldb, and we now stick the
built package to the ldb used during build (we don't enforce strict
version during build, but samba refuses to build with newer minor
version (in MAJOR.minor.revision)

> Based on this I would recommend NOT including symbols files in samba, talloc, tevent, tdb and ldb builds...

I'm not firmly against this, but...

> Splitting talloc, tevent, tdb, and ldb out from the main samba source itself as being 'bundled' libraries as per Debian policy does seem to not be productive here.

The policy is against bundled libraries "from other software packages"
(4.13) and more generally against code duplication. We can avoid this
code duplication.

[4.13] https://www.debian.org/doc/debian-policy/ch-source.html#convenience-copies-of-code


> Main reason for the policy is to stop having to patch multiple versions of libz or dbm when a security vulnerability turns up.  These are out of project libraries that got included in X11 and Java et al.
>
> Talloc, tdb, tevent and ldb are in project Samba originated bundled source code libraries, which the Samba project recommends you run certain versions of with each samba release - why are we separately building them, when all we need is to separately package them when building the samba source package?

Yes.

> What's being done seems unproductive.

I'm ok if you can provide a way to build all those 4 libs from
src:samba, while ensuring that other packages are not affected (i.e. :
sssd, but there are also 150 depends of talloc). Could you propose a
MR? This MR should also ensure that those libs keep the correct
versions (i.e no talloc 4.11.0).

Also note that, for 4.11, I was able to download those libs (they
probably will use the same version between 4.11rc4 and 4.11), wining
some days of NEW queue (I could have done this weeks ago, but I was
still on the 4.10/py3 migration).

> Best Regards,
>
> Matt Grant

Regards

-- 
Mathieu Parent