| 1 |
2018-03-08 16:40 GMT+01:00 Michał Górny <mgorny@g.o>: |
| 2 |
|
| 3 |
> Hello, developers. |
| 4 |
> |
| 5 |
> I would like to bring to your attention an alarming trend in Gentoo |
| 6 |
> ebuilds -- the proliferation of IUSE=static-libs, that is a flag |
| 7 |
> allowing our users to build static libraries. |
| 8 |
> |
| 9 |
> I should like to remind you that static linking is almost always a bad |
| 10 |
> idea. It has serious security implications, it is poorly supported on |
| 11 |
> *nix systems (example: library dependencies are provided via hacks, we |
| 12 |
> don't have proper rebuild capabilities) and should be basically |
| 13 |
> considered a great evil. Partially relevant doc: [1]. |
| 14 |
> |
| 15 |
> This is why Gentoo does not generally support statically linking stuff, |
| 16 |
> and we force dynamic linking whenever possible (sometimes even going too |
| 17 |
> far with that but that's another story). We only allow static linking |
| 18 |
> for special cases where shared linking can't be used for one reason |
| 19 |
> or another. |
| 20 |
> |
| 21 |
> As part of that we also shouldn't deliver static libraries unless |
| 22 |
> absolutely necessary to satisfy the dependencies of applications which |
| 23 |
> we support built statically. Back in the day, Gentoo developers were |
| 24 |
> pushing against packages that built static libraries unconditionally. |
| 25 |
> However, it seems that at some point this front changed from 'fighting |
| 26 |
> unconditionally built static libraries' to 'proliferating USE=static- |
| 27 |
> libs everywhere'. Which is bad. |
| 28 |
> |
| 29 |
> So, developers, please *stop adding USE=static-libs* to random libraries |
| 30 |
> that have no reason whatever to be statically linked to. And by that I |
| 31 |
> mean a good reason, not creeping featurism, not 'user asked for it', not |
| 32 |
> 'this broken package hardcodes libfoo.a'. |
| 33 |
> |
| 34 |
|
| 35 |
this would make impossible to use qemu static with binfmt alas |
| 36 |
https://wiki.debian.org/QemuUserEmulation |
| 37 |
Also looking for which packages are eligible for static libraries or not is |
| 38 |
more work, not less, because it's a whole different layer of dependancies |
| 39 |
(when doing the qemu stuff I just decided to build static for everything |
| 40 |
rather than manage use flags per package) |
Archives