Re: [gentoo-user] binary packages: how to ...

[Andreas Fink]

On Wed, 15 Jul 2020 00:46:58 +0100
Ashley Dixon <ash@××××××××××.uk> wrote:

> On Tue, Jul 14, 2020 at 11:24:31PM +0200, n952162 wrote:
> > binary packages: how to:
> >
> > 1. find out if a package is binary before you install it (e.g. where on
> >    app-arch/rar does it say it's a binary package)
>
> RAR is an unusual case, with both the "mirror" and "bindist" flags  set  in  the
> RESTRICT variable (i.e., Gentoo cannot legally mirror the  package,  and  you're
> not allowed to redistribute binaries either).  I couldn't find anything  in  the
> ebuild which suggests it is a binary package; perhaps  this  is  something  that
> should be reviewed by the Gentoo  developers,  as  most  packages  supporting  a
> binary distribution provide a separate package with the `-bin` suffix, although
> I suppose this doesn't make much sense when there is no source package.
>
> The entire RAR business model of free decompression  and  paid  compression  has
> caused confusion for many people over many decades.  I'd always stick to 7zip or
> one of the classic UNIX compression utilities, if I had a choice.
>
> > 2. inhibit their installation
>
> Don't install them. ;-)
>
> More seriously: there's not that many of them, so it's probably  not  a  process
> worth automating, unless you're on a  multi-user  machine,  in  which  untrusted
> users can install packages -  although  I  think  you'd  have  more  significant
> problems at that point.  As you've unfortunately discovered, there isn't much of
> a concrete framework in place to automatically  detect  binary  packages,  which
> also makes Point (3) difficult.
>
> > 3. get a list of the ones installed on a system
>
> `EIX_LIMIT=0 eix --only-names -I *-bin`, perhaps ?   Unfortunately,  this  won't
> catch the unusual cases, as seen with `app-arch/rar`.
>
> > Any ideas about that are appreciated.
>
> [1] might be worth a read; it's quite comprehensive, and  gives  you  a  glimpse
> into the inner-workings of Portage, allowing you to fix these  issues  yourself.
>
> Something to note: "bindist", as the USE-flag and RESTRICT option, does not mean
> "use a binary distribution", but rather "compile the package in such a way  that
> I can redistribute my build without putting myself in a legal problem  with  the
> package authors" (this commonly is synonymous with disabling official branding):
>
> $ ash-euses -sk bindist
>
> dev-libs/openssl:bindist - Disable/Restrict EC algorithms (as they seem to be patented) -- note: changes the ABI
> dev-libs/openssl-compat:bindist - Disable/Restrict EC algorithms (as they seem to be patented) -- note: changes the ABI
> dev-qt/qtnetwork:bindist - Disable EC support via dev-libs/openssl
> mail-client/thunderbird:bindist - Disable official Firefox/Thunderbird branding (icons, name) which are not binary-redistributable according to upstream.
> media-libs/freetype:bindist - Disable ClearType support (see http://freetype.org/patents.html)
> net-libs/liboauth:bindist - Alias for the nss USE flag, since there are license compliancy trouble when using OpenSSL.
> net-misc/openssh:bindist - Disable EC/RC5 algorithms in OpenSSL for patent reasons.
> sys-apps/ucspi-ssl:bindist - Disable EC/RC5 algorithms in OpenSSL for patent reasons.
> www-client/firefox:bindist - Disable official Firefox branding (icons, name) which are not binary-redistributable according to upstream.
>
>         Hope this helps,
>         Ashley.
>
> [1] https://wiki.gentoo.org/wiki/Binary_package_guide
>
Searching for -bin does not help to find binary only packages. Two more
examples, which are binary only:
zoom, skypeforlinux

Searching for -bin mostly (if not always) implies that there would be a
possibility to compile it from source.

In my experience so far, every binary-only package does not have an open
source license. So mostly you'll hit a license issue and you have to
accept the license (/etc/portage/package.license) before you will be
able to merge the package. Any license issue should start make you
thinking what is going on, since it is a potential binary-only package.
Installation of these packages is inhibited by emerge, because you have
to accept the license first ;)
When I look into my /etc/portage/package.license file I get a good idea
of which packages are binary only. Not all of them are pure binary
packages, but it is a superset as far as I can tell.

To conclude: You cannot find out if a package is binary only with
emerge. You have to do the research yourself, but
/etc/portage/package.license is a good starting point to find potential
candidates.

Cheers
Andreas