[Rpm-maint] hidden rpm ownership of links

[Panu Matilainen]

On Thu, 5 Jul 2007, David Mathog wrote:

> An issue regarding RPM came up in the Mandriva list, and somebody
> suggested I bring it to the attention of the RPM developers.  That
> thread is here:
>
> http://groups.google.com/group/alt.os.linux.mandriva/browse_thread/thread/5a45dac692db1455/ee5add1f47c1475e?lnk=st&q=mathog+rpm+link&rnum=3#ee5add1f47c1475e
>
> In case that link wraps and breaks, the main issue is this:
> rpm packages are creating links to links to files, and the first link
> and the second link are not known to the RPM system via, for instance:
>
> rpm -q --whatprovides /usr/bin/cdrecord
>
> Similarly, it has been claimed that installation scripts can create
> entire files (not links to files) which are also not known to RPM.  This
> struck me as incomplete - if the RPM package creates a file, no matter
> how it creates it, then the RPM system should be able to verify
> that fact.

Rpm doesn't create the links and files in this case, it's a script forked 
from rpm that creates them. Tracking of file creation of scripts might be 
technically possible, but you just can't record any arbitrary file 
creation into rpmdb. Think about temporary files the scripts and apps run 
by scripts can create as side-effects for example.

> I can see how the filename might in some instances not
> be known ahead of time, but couldn't rpm implement a function
> something like:
>
> rpm --pkg $PACKAGENAME --provides /usr/bin/cdrecord
>
> so that when scripts do create links or files they have a mechanism
> to enter this information?

Right, this is something entirely different, and something that's already 
been briefly discussed to support 3rd party vendor installer scripts and 
such. Permitting recording file ownership into rpmdb outside of real rpm 
packages would change the whole concept of rpms, and thus can't be done 
lightly, but it's something to look into in the future.

To permit rpm scriptlets to record something into rpmdb has the nasty 
problem of requiring concurrent write-access to the rpmdb. Not impossible 
but very nasty with the current locking system.

> As long as I'm writing to this list, I've also wondered if there
> isn't another way to find which packages B,C,D require package A
> besides doing:
>
> rpm -e --test A
>
> It seemed that this should be in the -q group, something like:
>
> rpm -q --requirespkg libjpeg
>
> (the package, not a particular file), but I've never figured out
> how to do it like that.

Yup, a long-time "favorite" of mine. Rpm has supported --whatrequires for 
ages, but that only works for manual dependencies, not automatically 
collected ones. Consider this:

[pmatilai at localhost ~]$ rpm -q --whatrequires openssl|wc -l
6
[pmatilai at localhost ~]$ rpm -e --test openssl.x86_64 2>&1 |awk '{print 
$6}'|sort -u|wc -l
43

You can get pretty close with this:
rpm -q --whatrequires `rpm -q --provides openssl`|grep -v "no package"|sort -u

But yes, there should be an easier way to do this, rpm knows perfectly 
well what packages a given package *really* requires, so there should be 
a way to query it as well without resorting to trickery like the above.

 	- Panu -