On Sun, 2024-04-07 at 14:35 +0200, Andreas K. Huettel wrote: > > Uhh, I dont really remember, I think some Chinese-sounding guy asked > me for it... (j/k)
It is remarkably bad timing. How it looks: Gentoo's response to the xz incident is to have me rebuild my entire system with everything that could possibly be linked to liblzma, linked to liblzma. Even on the hardened profiles, and with no easy way to prevent it. > Jokes aside, we did have bz2 in the default useflags for ages, and > at the time this made a lot of sense since xz/lzma and zstd were > steadily becoming the most prevalent compression algorithms. The flags that predate IUSE defaults can of course be forgiven. What is improved by having these flags in every profile, vs only (say) the desktop profiles, or in IUSE defaults? Here's what is made worse: I can't undo it. To maintain the status quo (I was quite happy to not have 100 packages pointlessly linked to liblzma last week), what I want to do is set USE="-lzma -zstd". But if I do that, then it overrides the IUSE defaults for the few packages whose maintainers are doing the right thing, and setting IUSE="+lzma +zstd" where it is important. For example, sys-apps/kmod, where the defaults ensure that your system isn't made unbootable by accident. The other option is for me to perpetually maintain a list of everything that uses lzma/zstd inside my package.use. And to avoid the problem above, I now have to read the ebuilds to see which ones have defaults and which ones don't. This is also not a great way to spend my time. tl;dr can we turn them back off in the profile? In any scenario where they are beneficial, there's a better place to put them.
