1 |
On 10/11/2011 10:59 PM, Graham Murray wrote: |
2 |
> Zac Medico <zmedico@g.o> writes: |
3 |
> |
4 |
>> On 10/11/2011 10:28 PM, Mike Gilbert wrote: |
5 |
>>> Francisco raised a possibly valid point in his original message: though |
6 |
>>> packages may not be currently used for anything, but they could contain |
7 |
>>> un-patched security flaws. |
8 |
>> |
9 |
>> If they contain something that's accessed at runtime, then they should |
10 |
>> be in RDEPEND or PDEPEND, no exceptions. |
11 |
> |
12 |
> But is it not possible that the flaw in the build-time dependency causes |
13 |
> an insecurity to be built into the dependent package and that both have |
14 |
> to be rebuilt as part of the security fix? |
15 |
|
16 |
For statically linked libraries, yes. However, --with-bdeps=y alone |
17 |
won't help you with that. You'll also have to enable |
18 |
--rebuild-if-new-rev=y in order to automatically rebuild the reverse |
19 |
dependencies of the statically-linked library. |
20 |
-- |
21 |
Thanks, |
22 |
Zac |