Gentoo Archives: gentoo-security

From: Jeremy Huddleston <eradicator@g.o>
To: Joel Osburn <tjeckleberg@××××.com>
Cc: gentoo-security@l.g.o
Subject: RE: [gentoo-security] Do I need to rebuild things afterupgradingssl?
Date: Thu, 18 Mar 2004 18:50:52
Message-Id: 1079635835.9556.2469.camel@eradicator.outersquare.org
In Reply to: RE: [gentoo-security] Do I need to rebuild things afterupgradingssl? by Joel Osburn
1 On Thu, 2004-03-18 at 10:40, Joel Osburn wrote:
2 > Thanks. I wasn't really confused by the version number differences, but
3 > maybe someone else was. I was trying to point out that revdep-rebuild
4 > claims to check for dynamically linked binaries, and the packages that
5 > own them don't actually need to be recompiled to use the newer (minor
6 > version) package.
7
8 They DO need to be recompiled if you have a newer version of the dynamic
9 lib that breaks binary compatibility but maintains API compatibility (as
10 we do here, or with libpng as another example). That is why the -soname
11 was changed. Usually, packages have the -soname match lib<lib
12 name>.so.<major version> and changing minor/tiny versions won't break
13 binary incompatibility, but openssl likes to use the tiny version to
14 denote binary compatibility.
15
16 > My question remains: how does one tell what packages are statically
17 > compiled against a given library.
18
19 You can't. That's why you should't use static libraries.
20
21 That's not entirely true... you could do a 'readelf -s <exec> | grep
22 <symbol>' on executables to see if that symbol is present in the file...

Attachments

File name MIME type
signature.asc application/pgp-signature

Replies

Subject Author
Re: [gentoo-security] Do I need to rebuild things afterupgradingssl? Piotr Kalinowski <pitkali@××.pl>
RE: [gentoo-security] Do I need to rebuild thingsafterupgradingssl? Joel Osburn <tjeckleberg@××××.com>