Bug#650138: Bug#639565:
hi, On Fri, Sep 21, 2012 at 3:35 AM, gregor herrmann gre...@debian.org wrote: Just to be sure: you have rebuilt both liboauth and goldencheetah, right? Yes, that was right. Does goldencheetah still work if only liboauth is rebuilt and goldencheetah is unchanged (i.e. the version in the archive now)? So, I've tested this also, and it works fine :-) - goldencheetah can build if liboauth gets update - goldencheetah can run with updated liboauth, without rebuilding for it regards, -- KURASHIKI Satoru -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#639565: liboauth: diff for NMU version 0.9.4-3.1
tags 639565 + pending
tags 650138 + pending
thanks
Dear maintainer,
I've prepared an NMU for liboauth (versioned as 0.9.4-3.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.
Regards.
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: Sophie Hunger: Breaking the Waves
diff -Nru liboauth-0.9.4/debian/changelog liboauth-0.9.4/debian/changelog
--- liboauth-0.9.4/debian/changelog 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/changelog 2012-09-21 14:24:52.0 +0200
@@ -1,3 +1,19 @@
+liboauth (0.9.4-3.1) unstable; urgency=low
+
+ * Non-maintainer upload.
+ * Fix please make loose libcurl dependency:
+change liboauth-dev's Depends to libcurl4-gnutls-dev | libcurl4-dev,
+libnss3-dev (instead of libcurl4-nss-dev)
+(Closes: #639565)
+ * Fix liboauth0: doesn't work with NSS libcurl flavour:
+build-depend on libcurl4-gnutls-dev | libcurl4-dev (instead of
+libcurl4-nss-dev)
+(Closes: #650138)
+ * Thanks to HAMANO Tsukasa and Alessandro Ghedini for accompanying me
+through this maze, and to Satoru KURASHIKI for additional tests.
+
+ -- gregor herrmann gre...@debian.org Fri, 21 Sep 2012 14:19:45 +0200
+
liboauth (0.9.4-3) unstable; urgency=low
* Sync from Ubuntu:
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/control 2012-09-17 19:31:21.0 +0200
@@ -2,7 +2,7 @@
Priority: optional
Maintainer: Bilal Akhtar bilalakh...@ubuntu.com
Build-Depends: debhelper (= 8.1.3),
- libcurl4-nss-dev,
+ libcurl4-gnutls-dev | libcurl4-dev,
libnss3-dev,
libtool,
locales-all | language-pack-en,
@@ -16,7 +16,7 @@
Package: liboauth-dev
Section: libdevel
Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}
Description: C library for implementing OAuth 1.0 (development files)
liboauth is a collection of C functions implementing the
OAuth Core 1.0 standard API. liboauth provides basic functions to escape
signature.asc
Description: Digital signature
Bug#639565:
On Fri, 21 Sep 2012 20:28:03 +0900, Satoru KURASHIKI wrote: Does goldencheetah still work if only liboauth is rebuilt and goldencheetah is unchanged (i.e. the version in the archive now)? So, I've tested this also, and it works fine :-) - goldencheetah can build if liboauth gets update - goldencheetah can run with updated liboauth, without rebuilding for it Thank you very much for these tests! I've now uploaded liboauth to DELAYED/2 with this changes. Cheers, gregor -- .''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06 : :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/ `. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe `- NP: Supertramp: And The Light signature.asc Description: Digital signature
Bug#639565:
On Thu, 20 Sep 2012 08:58:17 +0900, Satoru KURASHIKI wrote:
Acked, I will check whether changes above affects gondencheetah('s
twitter submit feature).
I've tried to build liboauth and goldencheetah locally with that changes.
Its twitter posting works fine, so new liboauth might not affect.
Thanks a lot!
Just to be sure: you have rebuilt both liboauth and goldencheetah,
right?
Does goldencheetah still work if only liboauth is rebuilt and
goldencheetah is unchanged (i.e. the version in the archive now)?
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: Ludwig Hirsch: Der Wolf
signature.asc
Description: Digital signature
Bug#639565:
hi,
On Wed, Sep 19, 2012 at 12:43 AM, gregor herrmann gre...@debian.org wrote:
So this should fix both bugs:
#v+
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/control 2012-09-17 19:31:21.0 +0200
@@ -2,7 +2,7 @@
Priority: optional
Maintainer: Bilal Akhtar bilalakh...@ubuntu.com
Build-Depends: debhelper (= 8.1.3),
- libcurl4-nss-dev,
+ libcurl4-gnutls-dev | libcurl4-dev,
libnss3-dev,
libtool,
locales-all | language-pack-en,
@@ -16,7 +16,7 @@
Package: liboauth-dev
Section: libdevel
Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev |
libcurl4-dev, libnss3-dev, ${misc:Depends}
Description: C library for implementing OAuth 1.0 (development files)
liboauth is a collection of C functions implementing the
OAuth Core 1.0 standard API. liboauth provides basic functions to escape
#v-
Acked, I will check whether changes above affects gondencheetah('s
twitter submit feature).
Please wait for a few days.
goldencheetah has:
Build-Depends: .. liboauth-dev, libcurl4-nss-dev ..
Depends: .. libcurl3-nss (= 7.23.1), liboauth0 (= 0.9.1)
(So the same as bti, and the maintainer is the original reporter for
#639565 :))
Cc'ing KURASHIKI Satoru lur...@gmail.com to check if the change in
liboauth might affect goldencheetah.
regards,
--
KURASHIKI Satoru
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#639565:
On Thu, 20 Sep 2012 00:17:53 +0900, Satoru KURASHIKI wrote:
#v+
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/control 2012-09-17 19:31:21.0 +0200
@@ -2,7 +2,7 @@
Priority: optional
Maintainer: Bilal Akhtar bilalakh...@ubuntu.com
Build-Depends: debhelper (= 8.1.3),
- libcurl4-nss-dev,
+ libcurl4-gnutls-dev | libcurl4-dev,
libnss3-dev,
libtool,
locales-all | language-pack-en,
@@ -16,7 +16,7 @@
Package: liboauth-dev
Section: libdevel
Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev,
${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev |
libcurl4-dev, libnss3-dev, ${misc:Depends}
Description: C library for implementing OAuth 1.0 (development files)
liboauth is a collection of C functions implementing the
OAuth Core 1.0 standard API. liboauth provides basic functions to escape
#v-
Acked, I will check whether changes above affects gondencheetah('s
twitter submit feature).
Please wait for a few days.
Sure, thanks in advance!
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: Bob Dylan: I Shall Be Free
signature.asc
Description: Digital signature
Bug#639565:
hi,
On Thu, Sep 20, 2012 at 12:25 AM, gregor herrmann gre...@debian.org wrote:
Acked, I will check whether changes above affects gondencheetah('s
twitter submit feature).
I've tried to build liboauth and goldencheetah locally with that changes.
Its twitter posting works fine, so new liboauth might not affect.
regards,
--
KURASHIKI Satoru
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#639565:
On Mon, 17 Sep 2012 19:49:43 +0200, gregor herrmann wrote:
So, to recap, IMO liboauth and bti (well, I'm not really sure about bti...
but
that doesn't hurt) should build-depend on libcurl4-gnutls-dev, which would
fix
#650138, and liboauth-dev should depend on libcurl4-gnutls-dev |
libcurl4-dev,
which would fix #639565 (as exposed in the submission email).
Perfect!
(And since bti works as-is with a rebuilt liboauth0, I guess I leave
the change in the build-dep for after-wheezy.)
libcurl3* runtime independence is not possible unless leaving libcurl's
symbols
unresolved (as explained a few emails ago). But I don't quite see why one
would
want the independence in the first place. To quote Tsukasa Hamano: The
depends
is force developper to link with gnutls, I'm not quite sure what he meant,
but
the developer (using liboauth) is not forced to link againt anything,
liboauth
is, but it doesn't affect the developer using it. And when using a static
liboauth
(i.e. what the Requires.private in oauth.pc and the liboauth-dev Depends are
for) one can choose any libcurl. If really needed, one can rebuild liboauth
from
source, in which case libcurl4-gnutls-dev | libcurl4-dev in its
build-depend
would help.
Makes sense, and fits my experiments :)
So this should fix both bugs:
#v+
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/control 2012-09-17 19:31:21.0 +0200
@@ -2,7 +2,7 @@
Priority: optional
Maintainer: Bilal Akhtar bilalakh...@ubuntu.com
Build-Depends: debhelper (= 8.1.3),
- libcurl4-nss-dev,
+ libcurl4-gnutls-dev | libcurl4-dev,
libnss3-dev,
libtool,
locales-all | language-pack-en,
@@ -16,7 +16,7 @@
Package: liboauth-dev
Section: libdevel
Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev |
libcurl4-dev, libnss3-dev, ${misc:Depends}
Description: C library for implementing OAuth 1.0 (development files)
liboauth is a collection of C functions implementing the
OAuth Core 1.0 standard API. liboauth provides basic functions to escape
#v-
And then we have some reverse (build) deps:
% reverse-depends liboauth0
Reverse-Depends
===
* bti
* evolution-data-server
* gnome-documents
* goldencheetah [amd64 armel armhf i386 ia64 kfreebsd-amd64 kfreebsd-i386 mips
mipsel powerpc s390x sparc]
* libgdata13
* liboauth-dev
% reverse-depends -b liboauth-dev
Reverse-Build-Depends
=
* bti
* evolution-data-server
* gnome-documents
* goldencheetah
* libgdata
Luckily goldencheetah is the only one with a build and runtime
dependency on both libaouth* and libcurl*, so the others should be
unaffected.
goldencheetah has:
Build-Depends: .. liboauth-dev, libcurl4-nss-dev ..
Depends: .. libcurl3-nss (= 7.23.1), liboauth0 (= 0.9.1)
(So the same as bti, and the maintainer is the original reporter for
#639565 :))
Cc'ing KURASHIKI Satoru lur...@gmail.com to check if the change in
liboauth might affect goldencheetah.
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: Trenquillo feat. Raiz DJ: Fuerza
signature.asc
Description: Digital signature
Bug#639565:
On Sun, 16 Sep 2012 20:19:56 +0200, Alessandro Ghedini wrote:
Ciao Alessandro,
thanks alot for taking the time to shed some light here!
So not linking to any curl lib doesn't look right ...
That could be done, as long as all the applications linking directly or
indirectly to liboauth link to a suitable libcurl too (i.e. leaving all the
libcurl symbols unresolved in liboauth). AFAICT this is currently not
enforced
since e.g. oauth.pc only lists libcurl as Requires.private.
Ok.
Directly depending on libcurl3* packages is of no use: either the
application
links to a libcurl flavour, in which case it would already Depends on a
suitable
libcurl3 package, or it doesn't and it wouldn't pick up the library even if
installed
Makes sense ... But liboauth does link (and therefore depend on) one
of the curl libs, unless forced to do otherwise.
Also note that libcurl3* libraries are not interchangeable, since they have
different SONAMEs and symbols versioning (i.e. once you link against one of
them at compile time, you have to use the same to resolve libcurl symbols at
load time).
Ack.
To wrap this up: having Depends: ..., libcurl4-gnutls-dev | libcurl4-dev,
...
in liboauth-dev IMO is the simplest and most effective solution to the problem
exposed (libcurl4*-dev conflicts).
If I'm understanding KURASHIKI Satoru and HAMANO Tsukasa correctly,
they are also not happy about the dependency of liboauth0 on one of
the curl libs. - Not sure about the background here.
What I've done now, since I'm more interested in #650138 actually :)
- Rebuild libouth whith only this change:
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/control 2012-09-17 17:00:50.0 +0200
@@ -16,7 +16,7 @@
Package: liboauth-dev
Section: libdevel
Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev | libcurl4-dev,
libnss3-dev, ${misc:Depends}
Description: C library for implementing OAuth 1.0 (development files)
liboauth is a collection of C functions implementing the
This leads to:
liboauth-dev_0.9.4-3.1_amd64.deb
Depends: liboauth0 (= 0.9.4-3.1), libcurl4-nss-dev | libcurl4-dev, libnss3-dev
liboauth0_0.9.4-3.1_amd64.deb
Depends: libc6 (= 2.4), libcurl3-nss (= 7.23.1), libnss3 (= 2:3.13.4-2~) |
libnss3-1d (= 3.12.0~1.9b1)
and
% ldd /usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 | grep curl
libcurl-nss.so.4 = /usr/lib/x86_64-linux-gnu/libcurl-nss.so.4
(0x7f9e8d2e8000)
- Install liboauth0. Result: bti still fails as in #650138.
- Rebuild bti (with libcurl4-gnutls-dev insted of libcurl4-nss-dev.
Results:
bti_032-2_amd64.deb
Depends: libc6 (= 2.3), libcurl3-gnutls (= 7.16.2), liboauth0 (= 0.9.1),
libpcre3 (= 8.10), libxml2 (= 2.7.4)
% ldd /usr/bin/bti | grep curl
libcurl-gnutls.so.4 = /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4
(0x7f8a757df000)
libcurl-nss.so.4 = /usr/lib/x86_64-linux-gnu/libcurl-nss.so.4
(0x7f8a729ed000)
- Install rebuilt bti. Sill fails.
My experiment from late July still works:
Rebuilding liboauth with libcurl4-gnutls-dev instead of -nss- works
with the old bti (and also with a rebuilt one).
No sure what to make of this -- I'm confused :)
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: Cat Stevens: Sweet Jamaica
signature.asc
Description: Digital signature
Bug#650138: Bug#639565:
On Mon, Sep 17, 2012 at 05:30:44PM +0200, gregor herrmann wrote:
On Sun, 16 Sep 2012 20:19:56 +0200, Alessandro Ghedini wrote:
Ciao Alessandro,
thanks alot for taking the time to shed some light here!
No problem
Directly depending on libcurl3* packages is of no use: either the
application
links to a libcurl flavour, in which case it would already Depends on a
suitable
libcurl3 package, or it doesn't and it wouldn't pick up the library even
if
installed
Makes sense ... But liboauth does link (and therefore depend on) one
of the curl libs, unless forced to do otherwise.
My comment was about the do not build-depends on libcurl4*-dev and manually
depend on a libcurl3* solution exposed above, which wouldn't work.
What I've done now, since I'm more interested in #650138 actually :)
I think I see the problem: the NSS libcurl flavour needs a proper NSS
certificate database (just like any other application using NSS, e.g. chromium
and firefox generate their own databases), otherwise the SSL/TLS support is
mostly broken (i.e. the certificate checks always fail, see #655628).
Now I'm not really into OAuth nor Twitter-like things, but I guess that Twitter
and Identi.ca provide an HTTPS end-point for their OAuth APIs... HTTPS requires
SSL/TLS certificate checking by default... I guess you see where this is going.
I think liboauth use of NSS does not involve certificate checking but libcurl's,
unless otherwise told, does. But they are independent.
From liboauth 0.9.4-3 changelog:
* Sync from Ubuntu:
[ Mathieu Trudel-Lapierre ]
* debian/control: liboauth-dev really needs libcurl4-nss-dev, not
libcurl4-gnutls-dev (nss is required in the .pc file)
(closes: #646485, #639565)
[ Sjoerd Simons ]
* collab-main team update
* debian/control: Swith build-depend to libcurl4-nss-dev from
libcurl4-gnutls-dev. oauth itself uses nss for SSL
That probably explains why liboauth and in turn bti stopped working from that
version.
So, to recap, IMO liboauth and bti (well, I'm not really sure about bti... but
that doesn't hurt) should build-depend on libcurl4-gnutls-dev, which would fix
#650138, and liboauth-dev should depend on libcurl4-gnutls-dev | libcurl4-dev,
which would fix #639565 (as exposed in the submission email).
libcurl3* runtime independence is not possible unless leaving libcurl's symbols
unresolved (as explained a few emails ago). But I don't quite see why one would
want the independence in the first place. To quote Tsukasa Hamano: The depends
is force developper to link with gnutls, I'm not quite sure what he meant, but
the developer (using liboauth) is not forced to link againt anything, liboauth
is, but it doesn't affect the developer using it. And when using a static
liboauth
(i.e. what the Requires.private in oauth.pc and the liboauth-dev Depends are
for) one can choose any libcurl. If really needed, one can rebuild liboauth from
source, in which case libcurl4-gnutls-dev | libcurl4-dev in its build-depend
would help.
Cheers
--
perl -E '$_=q;$/= @{[@_]};and s;\S+;inidehG ordnasselA;eg;say~~reverse'
signature.asc
Description: Digital signature
Bug#639565:
Control: severity 650138 serious
Control: retitle 650138 liboauth0: doesn't work with NSS libcurl flavour
Control: tag 650138 + patch
Control: tag 639565 + patch
On Mon, 17 Sep 2012 19:19:57 +0200, Alessandro Ghedini wrote:
thanks alot for taking the time to shed some light here!
No problem
Thanks again :)
Makes sense ... But liboauth does link (and therefore depend on) one
of the curl libs, unless forced to do otherwise.
My comment was about the do not build-depends on libcurl4*-dev and manually
depend on a libcurl3* solution exposed above, which wouldn't work.
Right.
What I've done now, since I'm more interested in #650138 actually :)
I think I see the problem: the NSS libcurl flavour needs a proper NSS
certificate database (just like any other application using NSS, e.g. chromium
and firefox generate their own databases), otherwise the SSL/TLS support is
mostly broken (i.e. the certificate checks always fail, see #655628).
Ah!
Now I'm not really into OAuth nor Twitter-like things, but I guess that
Twitter
and Identi.ca provide an HTTPS end-point for their OAuth APIs... HTTPS
requires
SSL/TLS certificate checking by default... I guess you see where this is
going.
Yup, currently an strace shows something about a missing end-point
before the error message.
I think liboauth use of NSS does not involve certificate checking but
libcurl's,
unless otherwise told, does. But they are independent.
Ack, that was also my interpretation, and fits with Tsukasa Hamano's
message (#34) in this (#639565) bug report log.
From liboauth 0.9.4-3 changelog:
* Sync from Ubuntu:
[ Mathieu Trudel-Lapierre ]
* debian/control: liboauth-dev really needs libcurl4-nss-dev, not
libcurl4-gnutls-dev (nss is required in the .pc file)
(closes: #646485, #639565)
[ Sjoerd Simons ]
* collab-main team update
* debian/control: Swith build-depend to libcurl4-nss-dev from
libcurl4-gnutls-dev. oauth itself uses nss for SSL
That probably explains why liboauth and in turn bti stopped working from that
version.
So this should be libcurl4-*-dev (and not -nss-) for the HTTPS
communication, and libnss3-dev for the OAuth hash things, right? (And
the fix for #646485 would have been to just add libnss3-dev, and not
to switch the curl flavour.)
So, to recap, IMO liboauth and bti (well, I'm not really sure about bti... but
that doesn't hurt) should build-depend on libcurl4-gnutls-dev, which would fix
#650138, and liboauth-dev should depend on libcurl4-gnutls-dev | libcurl4-dev,
which would fix #639565 (as exposed in the submission email).
Perfect!
(And since bti works as-is with a rebuilt liboauth0, I guess I leave
the change in the build-dep for after-wheezy.)
libcurl3* runtime independence is not possible unless leaving libcurl's
symbols
unresolved (as explained a few emails ago). But I don't quite see why one
would
want the independence in the first place. To quote Tsukasa Hamano: The
depends
is force developper to link with gnutls, I'm not quite sure what he meant,
but
the developer (using liboauth) is not forced to link againt anything, liboauth
is, but it doesn't affect the developer using it. And when using a static
liboauth
(i.e. what the Requires.private in oauth.pc and the liboauth-dev Depends are
for) one can choose any libcurl. If really needed, one can rebuild liboauth
from
source, in which case libcurl4-gnutls-dev | libcurl4-dev in its build-depend
would help.
Makes sense, and fits my experiments :)
So this should fix both bugs:
#v+
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/control 2012-09-17 19:31:21.0 +0200
@@ -2,7 +2,7 @@
Priority: optional
Maintainer: Bilal Akhtar bilalakh...@ubuntu.com
Build-Depends: debhelper (= 8.1.3),
- libcurl4-nss-dev,
+ libcurl4-gnutls-dev | libcurl4-dev,
libnss3-dev,
libtool,
locales-all | language-pack-en,
@@ -16,7 +16,7 @@
Package: liboauth-dev
Section: libdevel
Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev,
libnss3-dev, ${misc:Depends}
Description: C library for implementing OAuth 1.0 (development files)
liboauth is a collection of C functions implementing the
OAuth Core 1.0 standard API. liboauth provides basic functions to escape
#v-
Thanks again,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: Dire Straits: Single Handed Sailor
signature.asc
Description: Digital signature
Bug#639565:
On Mon, Sep 17, 2012 at 07:49:43PM +0200, gregor herrmann wrote:
From liboauth 0.9.4-3 changelog:
* Sync from Ubuntu:
[ Mathieu Trudel-Lapierre ]
* debian/control: liboauth-dev really needs libcurl4-nss-dev, not
libcurl4-gnutls-dev (nss is required in the .pc file)
(closes: #646485, #639565)
[ Sjoerd Simons ]
* collab-main team update
* debian/control: Swith build-depend to libcurl4-nss-dev from
libcurl4-gnutls-dev. oauth itself uses nss for SSL
That probably explains why liboauth and in turn bti stopped working from
that
version.
So this should be libcurl4-*-dev (and not -nss-) for the HTTPS
communication, and libnss3-dev for the OAuth hash things, right? (And
the fix for #646485 would have been to just add libnss3-dev, and not
to switch the curl flavour.)
Yep. Note that -openssl- is not really a good choice either because of the
possible OpenSSL licensing issues, which makes -gnutls- pretty much the only
choice.
Cheers
--
perl -E '$_=q;$/= @{[@_]};and s;\S+;inidehG ordnasselA;eg;say~~reverse'
signature.asc
Description: Digital signature
Bug#639565:
On Mon, 17 Sep 2012 22:27:24 +0200, Alessandro Ghedini wrote: So this should be libcurl4-*-dev (and not -nss-) for the HTTPS communication, and libnss3-dev for the OAuth hash things, right? (And the fix for #646485 would have been to just add libnss3-dev, and not to switch the curl flavour.) Yep. Note that -openssl- is not really a good choice either because of the possible OpenSSL licensing issues, which makes -gnutls- pretty much the only choice. Right, that's why I've choosen, as you proposed, libcurl4-gnutls-dev | libcurl4-dev, i.e. the only sane default and the option for users to do something else :) Cheers, gregor -- .''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06 : :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/ `. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe `- NP: Hans Theessink/Peter Ratzenbeck: If I Only Knew Her signature.asc Description: Digital signature
Bug#639565:
On Sun, 19 Aug 2012 05:04:21 +0900, HAMANO Tsukasa wrote:
I think, This is best solution.
Build-Depends: libcurl4-gnutls-dev
(It can be a any real package.)
Or leave it as-is.
liboauth-dev's Depends: liboauth0 (= ${binary:Version}), ${misc:Depends},
libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev
liboauth0's Depends: ${misc:Depends}, ${shlibs:Depends}, libcurl3 |
libcurl3-gnutls | libcurl3-nss
As we know, This isn't enough due to ${shlibs:Depends} is include
libcurl3-gnutls then remove another libcurl 'or' conditions.
Please apply the patch:
--- liboauth-0.9.4.orig/src/Makefile.am
+++ liboauth-0.9.4/src/Makefile.am
@@ -4,5 +4,5 @@ include_HEADERS = oauth.h
liboauth_la_SOURCES=oauth.c config.h hash.c xmalloc.c xmalloc.h oauth_http.c
liboauth_la_LDFLAGS=@LIBOAUTH_LDFLAGS@ -version-info @VERSION_INFO@
-liboauth_la_LIBADD=@HASH_LIBS@ @CURL_LIBS@
+liboauth_la_LIBADD=@HASH_LIBS@
liboauth_la_CFLAGS=@LIBOAUTH_CFLAGS@ @HASH_CFLAGS@ @CURL_CFLAGS@
Actually, we do not need to link shared library to shared library.
We'll get liboauth0 package that Depends: libcurl3 | libcurl3-gnutls |
libcurl3-nss
This is not enough, we either need to re-run automake or apply the
same patch to src/Makefile.in.
When I extend the patch I indeed get the expected Depends for
liboauth0 [0]. But also:
dpkg-shlibdeps: warning: symbol curl_slist_free_all used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_slist_append used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_easy_cleanup used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_easy_init used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_easy_setopt used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_easy_perform used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
So not linking to any curl lib doesn't look right ...
Cheers,
gregor, attaching the current patch and cc'ing the curl maintainer
[0]
Depends: libc6 (= 2.4), libnss3 (= 2:3.13.4-2~) | libnss3-1d (=
3.12.0~1.9b1), libcurl3-gnutls | libcurl3-nss | libcurl3
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: Spider Murphy Gang: Ich Schau' Dich An (Peep Peep)
diff -Nru liboauth-0.9.4/debian/changelog liboauth-0.9.4/debian/changelog
--- liboauth-0.9.4/debian/changelog 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/changelog 2012-07-28 19:09:48.0 +0200
@@ -1,3 +1,11 @@
+liboauth (0.9.4-3.1) UNRELEASED; urgency=low
+
+ * Non-maintainer upload.
+ * Fix please make loose libcurl dependency
+(Closes: #639565)
+
+ -- gregor herrmann gre...@debian.org Sat, 28 Jul 2012 19:09:40 +0200
+
liboauth (0.9.4-3) unstable; urgency=low
* Sync from Ubuntu:
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/control 2012-09-16 15:58:14.0 +0200
@@ -2,7 +2,7 @@
Priority: optional
Maintainer: Bilal Akhtar bilalakh...@ubuntu.com
Build-Depends: debhelper (= 8.1.3),
- libcurl4-nss-dev,
+ libcurl4-gnutls-dev | libcurl4-dev,
libnss3-dev,
libtool,
locales-all | language-pack-en,
@@ -16,7 +16,7 @@
Package: liboauth-dev
Section: libdevel
Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ${misc:Depends}
Description: C library for implementing OAuth 1.0 (development files)
liboauth is a collection of C functions implementing the
OAuth Core 1.0 standard API. liboauth provides basic functions to escape
@@ -28,7 +28,7 @@
Package: liboauth0
Architecture: any
Pre-Depends: ${misc:Pre-Depends}
-Depends: ${misc:Depends}, ${shlibs:Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends}, libcurl3-gnutls | libcurl3-nss | libcurl3
Multi-Arch: same
Description: C library for implementing OAuth 1.0
liboauth is a collection of C functions implementing the
diff -Nru liboauth-0.9.4/debian/patches/03_curl.patch liboauth-0.9.4/debian/patches/03_curl.patch
--- liboauth-0.9.4/debian/patches/03_curl.patch 1970-01-01 01:00:00.0 +0100
+++ liboauth-0.9.4/debian/patches/03_curl.patch 2012-09-16 16:08:45.0 +0200
@@ -0,0 +1,20 @@
+--- a/src/Makefile.am
b/src/Makefile.am
Bug#639565:
On Sun, Sep 16, 2012 at 04:17:36PM +0200, gregor herrmann wrote:
When I extend the patch I indeed get the expected Depends for
liboauth0 [0]. But also:
dpkg-shlibdeps: warning: symbol curl_slist_free_all used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_slist_append used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_easy_cleanup used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_easy_init used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_easy_setopt used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
dpkg-shlibdeps: warning: symbol curl_easy_perform used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none of
the libraries
So not linking to any curl lib doesn't look right ...
That could be done, as long as all the applications linking directly or
indirectly to liboauth link to a suitable libcurl too (i.e. leaving all the
libcurl symbols unresolved in liboauth). AFAICT this is currently not enforced
since e.g. oauth.pc only lists libcurl as Requires.private.
Directly depending on libcurl3* packages is of no use: either the application
links to a libcurl flavour, in which case it would already Depends on a suitable
libcurl3 package, or it doesn't and it wouldn't pick up the library even if
installed (unless forcibly loaded e.g. via LD_LOAD_LIBRARY, but that's not a
real solution).
Also note that libcurl3* libraries are not interchangeable, since they have
different SONAMEs and symbols versioning (i.e. once you link against one of
them at compile time, you have to use the same to resolve libcurl symbols at
load time).
Cheers
--
perl -E '$_=q;$/= @{[@_]};and s;\S+;inidehG ordnasselA;eg;say~~reverse'
signature.asc
Description: Digital signature
Bug#639565:
On Sun, Sep 16, 2012 at 07:41:57PM +0200, Alessandro Ghedini wrote:
On Sun, Sep 16, 2012 at 04:17:36PM +0200, gregor herrmann wrote:
When I extend the patch I indeed get the expected Depends for
liboauth0 [0]. But also:
dpkg-shlibdeps: warning: symbol curl_slist_free_all used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none
of the libraries
dpkg-shlibdeps: warning: symbol curl_slist_append used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none
of the libraries
dpkg-shlibdeps: warning: symbol curl_easy_cleanup used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none
of the libraries
dpkg-shlibdeps: warning: symbol curl_easy_init used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none
of the libraries
dpkg-shlibdeps: warning: symbol curl_easy_setopt used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none
of the libraries
dpkg-shlibdeps: warning: symbol curl_easy_perform used by
debian/liboauth0/usr/lib/x86_64-linux-gnu/liboauth.so.0.8.1 found in none
of the libraries
So not linking to any curl lib doesn't look right ...
That could be done, as long as all the applications linking directly or
indirectly to liboauth link to a suitable libcurl too (i.e. leaving all the
libcurl symbols unresolved in liboauth). AFAICT this is currently not enforced
since e.g. oauth.pc only lists libcurl as Requires.private.
Directly depending on libcurl3* packages is of no use: either the application
links to a libcurl flavour, in which case it would already Depends on a
suitable
libcurl3 package, or it doesn't and it wouldn't pick up the library even if
installed (unless forcibly loaded e.g. via LD_LOAD_LIBRARY, but that's not a
real solution).
Also note that libcurl3* libraries are not interchangeable, since they have
different SONAMEs and symbols versioning (i.e. once you link against one of
them at compile time, you have to use the same to resolve libcurl symbols at
load time).
To wrap this up: having Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, ...
in liboauth-dev IMO is the simplest and most effective solution to the problem
exposed (libcurl4*-dev conflicts).
Cheers
--
perl -E '$_=q;$/= @{[@_]};and s;\S+;inidehG ordnasselA;eg;say~~reverse'
signature.asc
Description: Digital signature
Bug#639565:
Hi,
I think, This is best solution.
Build-Depends: libcurl4-gnutls-dev
(It can be a any real package.)
liboauth-dev's Depends: liboauth0 (= ${binary:Version}), ${misc:Depends},
libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev
liboauth0's Depends: ${misc:Depends}, ${shlibs:Depends}, libcurl3 |
libcurl3-gnutls | libcurl3-nss
As we know, This isn't enough due to ${shlibs:Depends} is include
libcurl3-gnutls then remove another libcurl 'or' conditions.
Please apply the patch:
--- liboauth-0.9.4.orig/src/Makefile.am
+++ liboauth-0.9.4/src/Makefile.am
@@ -4,5 +4,5 @@ include_HEADERS = oauth.h
liboauth_la_SOURCES=oauth.c config.h hash.c xmalloc.c xmalloc.h oauth_http.c
liboauth_la_LDFLAGS=@LIBOAUTH_LDFLAGS@ -version-info @VERSION_INFO@
-liboauth_la_LIBADD=@HASH_LIBS@ @CURL_LIBS@
+liboauth_la_LIBADD=@HASH_LIBS@
liboauth_la_CFLAGS=@LIBOAUTH_CFLAGS@ @HASH_CFLAGS@ @CURL_CFLAGS@
Actually, we do not need to link shared library to shared library.
We'll get liboauth0 package that Depends: libcurl3 | libcurl3-gnutls |
libcurl3-nss
Thank you.
At Thu, 2 Aug 2012 08:12:21 +0200,
gregor herrmann gre...@debian.org wrote:
On Thu, 02 Aug 2012 12:03:34 +0900, HAMANO Tsukasa wrote:
2) I'm not sure if bilding against on one and then depending on a
different version works?
No problem, liboauth is not use directly SSL interface. We can switch
them when linking application with liboauth.
Ok.
For liboauth-dev, my patch specifies
Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ...
which should be enough to solve the issue you were raising here,
right?
Yes, liboauth-dev's issue was solved. liboauth0 dependency is a little
strange, but I'm ok to closing the bug.
Thanks very much!
Well, it's not solved yet, since the fixed package only existed in
some temporary directory on my laptop :)
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- Rome wasn't burned in a day.
--
HAMANO Tsukasa ham...@cuspy.org
pgpHRVKqTBmd9.pgp
Description: OpenPGP Digital Signature
Bug#650138: Bug#639565:
On Thu, 02 Aug 2012 12:03:34 +0900, HAMANO Tsukasa wrote: 2) I'm not sure if bilding against on one and then depending on a different version works? No problem, liboauth is not use directly SSL interface. We can switch them when linking application with liboauth. Ok. For liboauth-dev, my patch specifies Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ... which should be enough to solve the issue you were raising here, right? Yes, liboauth-dev's issue was solved. liboauth0 dependency is a little strange, but I'm ok to closing the bug. Thanks very much! Well, it's not solved yet, since the fixed package only existed in some temporary directory on my laptop :) Cheers, gregor -- .''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06 : :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/ `. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe `- Rome wasn't burned in a day. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#639565:
Hi,
Thanks for your response.
2012/7/29 gregor herrmann gre...@debian.org:
On Sat, 21 Jul 2012 03:38:22 +0900, Tsukasa Hamano wrote:
libcurl4-dev is a virtual package, so we need a real one too.
Why do we need to specify a real package?
Please tell me why we can't specify virtual package.
What I've tried now is:
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev |
libcurl4-dev, libnss3-dev, ${misc:Depends}
(snip)
which has a very interesting effect:
The runtime dependencies for liboauth0 change from
Depends: libc6 (= 2.4), libcurl3-nss (= 7.16.2-1), libnss3-1d (=
3.12.0~1.9b1)
to
Depends: libc6 (= 2.4), libcurl3-gnutls (= 7.16.2), libnss3 (=
2:3.13.4-2~) | libnss3-1d (= 3.12.0~1.9b1)
This issue is not resolved.
The depends is force developper to link with gnutls.
I think that we don't need to specify a ssl library package.
Thank you.
and with the rebuilt library installed, the bug in #650138 is gone!
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: David Bowie: Ground Control to Major Tom
--
Tsukasa Hamano
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#639565:
On Wed, 01 Aug 2012 14:56:29 +0900, Tsukasa Hamano wrote: libcurl4-dev is a virtual package, so we need a real one too. Why do we need to specify a real package? Please tell me why we can't specify virtual package. Cf. the description of the lintian warning: http://lintian.debian.org/tags/virtual-package-depends-without-real-package-depends.html which has a very interesting effect: The runtime dependencies for liboauth0 change from Depends: libc6 (= 2.4), libcurl3-nss (= 7.16.2-1), libnss3-1d (= 3.12.0~1.9b1) to Depends: libc6 (= 2.4), libcurl3-gnutls (= 7.16.2), libnss3 (= 2:3.13.4-2~) | libnss3-1d (= 3.12.0~1.9b1) This issue is not resolved. The depends is force developper to link with gnutls. I think that we don't need to specify a ssl library package. I _guess_ (haven't tried yet) that whatever of the curl-ssl libraries is used at build time will show up in Depends ... and with the rebuilt library installed, the bug in #650138 is gone! And that's _my_ main concern :) Cheers, gregor -- .''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06 : :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/ `. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe `- Kirk to Enterprise -- beam down yeoman Rand and a six-pack. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#639565:
Hi, At Wed, 1 Aug 2012 08:31:37 +0200, gregor herrmann gre...@debian.org wrote: Cf. the description of the lintian warning: http://lintian.debian.org/tags/virtual-package-depends-without-real-package-depends.html Ok, I understood your change(libcurl4-gnutls-dev | libcurl4-dev) is proper. But I think strange runtime depends. which has a very interesting effect: The runtime dependencies for liboauth0 change from Depends: libc6 (= 2.4), libcurl3-nss (= 7.16.2-1), libnss3-1d (= 3.12.0~1.9b1) to Depends: libc6 (= 2.4), libcurl3-gnutls (= 7.16.2), libnss3 (= 2:3.13.4-2~) | libnss3-1d (= 3.12.0~1.9b1) Probably, It would be better the runtime dependency is libcurl3 | libcurl3-nss | libcurl3-gnutls. Well, It would not be such a critical issue, due to they are able to exist together. Thank you. -- HAMANO Tsukasa ham...@cuspy.org pgprbd37cNzCj.pgp Description: OpenPGP Digital Signature
Bug#650138: Bug#639565:
On Wed, 01 Aug 2012 18:13:25 +0900, HAMANO Tsukasa wrote:
which has a very interesting effect:
The runtime dependencies for liboauth0 change from
Depends: libc6 (= 2.4), libcurl3-nss (= 7.16.2-1), libnss3-1d (=
3.12.0~1.9b1)
to
Depends: libc6 (= 2.4), libcurl3-gnutls (= 7.16.2), libnss3 (=
2:3.13.4-2~) | libnss3-1d (= 3.12.0~1.9b1)
Probably, It would be better the runtime dependency is libcurl3 |
libcurl3-nss | libcurl3-gnutls.
I see your point but
1) this dependency is calculated automatically from
${shlibs:Depends}, to add the alternatives would prbably need some
ugly hack
2) I'm not sure if bilding against on one and then depending on a
different version works?
3) the dependency on libcurl3-gnutls actually fixes #650138
Well, It would not be such a critical issue, due to they are able to
exist together.
And that's for liboauth0.
For liboauth-dev, my patch specifies
Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ...
which should be enough to solve the issue you were raising here,
right?
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- Warp 7 -- It's a law we can live with.
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#639565:
At Wed, 1 Aug 2012 11:30:45 +0200,
gregor herrmann gre...@debian.org wrote:
On Wed, 01 Aug 2012 18:13:25 +0900, HAMANO Tsukasa wrote:
which has a very interesting effect:
The runtime dependencies for liboauth0 change from
Depends: libc6 (= 2.4), libcurl3-nss (= 7.16.2-1), libnss3-1d
(= 3.12.0~1.9b1)
to
Depends: libc6 (= 2.4), libcurl3-gnutls (= 7.16.2), libnss3 (=
2:3.13.4-2~) | libnss3-1d (= 3.12.0~1.9b1)
Probably, It would be better the runtime dependency is libcurl3 |
libcurl3-nss | libcurl3-gnutls.
I see your point but
1) this dependency is calculated automatically from
${shlibs:Depends}, to add the alternatives would prbably need some
ugly hack
hmm,
2) I'm not sure if bilding against on one and then depending on a
different version works?
No problem, liboauth is not use directly SSL interface. We can switch
them when linking application with liboauth.
3) the dependency on libcurl3-gnutls actually fixes #650138
Well, It would not be such a critical issue, due to they are able to
exist together.
And that's for liboauth0.
For liboauth-dev, my patch specifies
Depends: ..., libcurl4-gnutls-dev | libcurl4-dev, libnss3-dev, ...
which should be enough to solve the issue you were raising here,
right?
Yes, liboauth-dev's issue was solved. liboauth0 dependency is a little
strange, but I'm ok to closing the bug.
Thanks very much!
--
HAMANO Tsukasa haman...@gmail.com
pgp7yATMJxAV4.pgp
Description: OpenPGP Digital Signature
Bug#639565:
Hi,
Thanks for your response.
At Sat, 28 Jul 2012 19:28:40 +0200,
gregor herrmann gre...@debian.org wrote:
libcurl4-dev is a virtual package, so we need a real one too.
Why do we need to specify a real package?
Please tell me why we can't specify virtual package.
What I've tried now is:
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev |
libcurl4-dev, libnss3-dev, ${misc:Depends}
(snip)
which has a very interesting effect:
The runtime dependencies for liboauth0 change from
Depends: libc6 (= 2.4), libcurl3-nss (= 7.16.2-1), libnss3-1d (=
3.12.0~1.9b1)
to
Depends: libc6 (= 2.4), libcurl3-gnutls (= 7.16.2), libnss3 (=
2:3.13.4-2~) | libnss3-1d (= 3.12.0~1.9b1)
This issue is not resolved.
The depends is force developper to link with gnutls.
I think that we don't need to specify a ssl library package.
Thank you.
and with the rebuilt library installed, the bug in #650138 is gone!
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: David Bowie: Ground Control to Major Tom
--
HAMANO Tsukasa ham...@cuspy.org
pgpZecFlB9zQQ.pgp
Description: OpenPGP Digital Signature
Bug#639565:
On Sat, 21 Jul 2012 03:38:22 +0900, Tsukasa Hamano wrote:
The SSL library is used two usage in liboauth.
* for HTTPS communication by libcurl
* for OAuth hash/signature
They are fully independent usage.
Now, The package is using NSS for hash/signature due to --enable-nss
was specified. However we do not need to specifiy libcurl ssl backend.
Therefore, We should specify to liboauth-dev:
Depends: libcurl4-dev libnss3-dev
libcurl4-dev is a virtual package, so we need a real one too.
What I've tried now is:
#v+
diff -Nru liboauth-0.9.4/debian/control liboauth-0.9.4/debian/control
--- liboauth-0.9.4/debian/control 2011-11-05 12:41:07.0 +0100
+++ liboauth-0.9.4/debian/control 2012-07-28 19:14:03.0 +0200
@@ -2,7 +2,7 @@
Priority: optional
Maintainer: Bilal Akhtar bilalakh...@ubuntu.com
Build-Depends: debhelper (= 8.1.3),
- libcurl4-nss-dev,
+ libcurl4-gnutls-dev | libcurl4-dev,
libnss3-dev,
libtool,
locales-all | language-pack-en,
@@ -16,7 +16,7 @@
Package: liboauth-dev
Section: libdevel
Architecture: any
-Depends: liboauth0 (= ${binary:Version}), libcurl4-nss-dev, ${misc:Depends}
+Depends: liboauth0 (= ${binary:Version}), libcurl4-gnutls-dev | libcurl4-dev,
libnss3-dev, ${misc:Depends}
Description: C library for implementing OAuth 1.0 (development files)
liboauth is a collection of C functions implementing the
OAuth Core 1.0 standard API. liboauth provides basic functions to escape
#v-
which has a very interesting effect:
The runtime dependencies for liboauth0 change from
Depends: libc6 (= 2.4), libcurl3-nss (= 7.16.2-1), libnss3-1d (=
3.12.0~1.9b1)
to
Depends: libc6 (= 2.4), libcurl3-gnutls (= 7.16.2), libnss3 (=
2:3.13.4-2~) | libnss3-1d (= 3.12.0~1.9b1)
and with the rebuilt library installed, the bug in #650138 is gone!
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/
`. `' Member of VIBE!AT SPI, fellow of the Free Software Foundation Europe
`- NP: David Bowie: Ground Control to Major Tom
signature.asc
Description: Digital signature
Bug#639565:
Hi, The SSL library is used two usage in liboauth. * for HTTPS communication by libcurl * for OAuth hash/signature They are fully independent usage. Now, The package is using NSS for hash/signature due to --enable-nss was specified. However we do not need to specifiy libcurl ssl backend. Therefore, We should specify to liboauth-dev: Depends: libcurl4-dev libnss3-dev -- Tsukasa Hamano -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#639565: liboauth-dev: please make loose libcurl dependency
hi, On Sun, Aug 28, 2011 at 5:59 PM, KURASHIKI Satoru lur...@gmail.com wrote: Package: liboauth-dev Version: 0.9.4-2 Severity: normal Because of Depends: libcurl4-gnutls-dev, liboauth-dev conflicts with libcurl4-nss-dev. This bug was already fixed in ubuntu as follows: http://launchpadlibrarian.net/77039053/liboauth_0.9.4-2_0.9.4-2ubuntu1.diff.gz Please update also in debian. regards, -- KURASHIKI Satoru -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#639565: liboauth-dev: please make loose libcurl dependency
Package: liboauth-dev Version: 0.9.4-2 Severity: normal hi, Because of Depends: libcurl4-gnutls-dev, liboauth-dev conflicts with libcurl4-nss-dev. How about Depends: libcurl4-dev (or libcurl-dev) instead? regards, -- System Information: Debian Release: wheezy/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 3.0.0-1-amd64 (SMP w/2 CPU cores) Locale: LANG=ja_JP.UTF-8, LC_CTYPE=ja_JP.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages liboauth-dev depends on: ii libcurl4-gnutls-dev 7.21.7-1 Development files and documentatio ii liboauth0 0.9.4-2C library for implementing OAuth 1 liboauth-dev recommends no packages. liboauth-dev suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
