Bug#757891: init-system-helpers: Please do not depend on perl

[Brendan O'Dea]

On 13 August 2014 05:15, Niko Tyni <ntyni at debian.org> wrote:
> [cc'ing the rsyslog maintainers too]
>
> On Tue, Aug 12, 2014 at 09:02:59AM +0200, Michael Stapelberg wrote:
>> Samuel Thibault <sthibault at debian.org> writes:
>> > perl is separate from perl-base so that in tight environement, Debian
>> > can be installed with only perl-base. A base system installed by d-i,
>> > notably, is supposed to only install perl-base, not perl.  It happens
>> > however that d-i installs rsyslog, which depends on init-system-helpers,
>> > which depends on perl.  Is the whole perl really needed?  If some
>> > modules are needed, they could be moved to perl-base, to save having to
>> > install the whole perl on all Debian base systems.
>
>> init-system-helpers uses File::Path, File::Basename, File::Find and
>> Text::ParseWords — none of them is in perl-base.
>
> (FWIW Text::ParseWords is.)
>
>> Please report back once you’ve made perl-base contain all of them.
>
> I wasn't around when the perl/perl-base split was designed, but my
> understanding is that perl-base exists to offer a usable perl interpreter
> for maintainer scripts even during upgrades, and for d-i to work.

Splitting the perl binary and a small subset of modules into a -base
package goes back a *long* time, and appears from the changelog to
have been initially done by my predecessor Darren to provide a subset
of perl 5.003 for base-floppies, apparently for the "bo" distribution
in 1996 (although archive.debian.org doesn't show it as a package
until "hamm").  Some time later in 2001 when I wrote the revised Perl
Policy (specifically §2.2 _Base Package_), the requirement for the
package to be essential in order to be usable from maintainer scripts
was added.

As noted in the thread linked earlier[0], the initial selection of
packages for perl-base when I built the 5.6 packages was done by a
combination of grepping the archive for maintainer scripts which used
perl, and working with the debian-installer team to meet their
requirements.

> The perl-base package is Essential:yes, so inclusion there is pretty
> close to a promise of supporting that interface forever inside the
> Essential set.  So care must be taken when adding functionality there.
> IMO Perl reimplementations of /usr/bin/find, /usr/bin/basename,
> /bin/mkdir -p, and /bin/rm -r don't seem very good candidates.

Actually, if anything is to be included, then filesystem recursion
handling probably should be, as that tends to be screwed up when
people implement that[1,2,3].  The same could be said for safe
tempfile creation.

I'm not sure that File::Basename buys a great deal over s#^.*/##
myself, but it is interesting to see that Darren's earlier base
package did include both File::Basename and File::Find[4].  Given that
mine didn't, I presume that nothing was using them at the time, or
subsequently.

I don't think that it would be terrible to include some of these
packages in perl-base, but Niko is correct: extending the interface
should be done carefully and I don't see that this is the only
possible solution.

For the record, massaging the output of:

  strace -etrace=file perl -MFile::Find -MFile::Temp -MFile::Path -e 1

and identifying the new requirements which would need to move from
perl-modules to perl base, gives a delta of ~150Kib on my work
machine:

  ~% wc -c /usr/share/perl/5.18.2/File/Find.pm \
        /usr/share/perl/5.18.2/File/Basename.pm \
        /usr/share/perl/5.18.2/File/Temp.pm \
        /usr/share/perl/5.18.2/File/Path.pm
   33181 /usr/share/perl/5.18.2/File/Find.pm
   11250 /usr/share/perl/5.18.2/File/Basename.pm
   77730 /usr/share/perl/5.18.2/File/Temp.pm
   33187 /usr/share/perl/5.18.2/File/Path.pm
  155348 total

Looking at deb-systemd-helper, it also uses Data::Dumper for some
debug messages, which is not part of perl-base either.  This could
potentially be worked around with something along the lines of:

  eval { require Data::Dumper; } or *Data::Dumper::Dumper = sub { "no
Data::Dumper" }

It does occur to me however that if rsyslog (or any other packages
controlled by init for that matter) are going to be installed as part
of the initial base system by d-i, then is it is worth simplifying the
run-time dependencies of init-system-helpers by rewriting it in C?

--bod

[0] https://lists.debian.org/debian-perl/2010/11/msg00039.html
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0435
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0452
[3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0448
[4] http://archive.debian.net/hamm/i386/perl-base/filelist