Knowledge Base (Posts about dependencies)

Devuan updates for January 2023 and FreeIPA

bgstack15 — Thu, 12 Jan 2023 14:00:41 GMT

As of January 10, the latest monthly OS updates has introduced a problem only for new installs. Package freeipa-client depends on a package, python3-ipalib-hbac, that has a hard dependency on python3<3.11.

And of course I wanted to set up a system with Devuan Ceres at that exact day. It has since been fixed, with the release of src:sssd_2.8.1-2 today.

I had to set up an apt repo connection to snapshot.debian.org, in file /etc/apt/sources.list.d/snapshot.list.

deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20221215T151605Z/ unstable main

Then run:

sudo apt-get install python3=3.10.6-3 python3-minimal=3.10.6-3 libpython3-stdlib=3.10.6-3

The FreeIPA client install process also needs this:

sudo apt-get install python3-cryptography=3.4.8-2

To get around this error on the ipa-client-install invocation.

AttributeError: module 'cryptography.utils' has no attribute 'register_interface'. Did you mean: 'verify_interface'?

Devuan updates for November 2022 and sssd error

bgstack15 — Tue, 01 Nov 2022 13:23:34 GMT

After running OS updates on Devuan unstable, I got this failure.

(2022-10-31 10:09:50): [be[ipa.internal.com]] [dp_load_module] (0x0400): About to load module [ipa].
(2022-10-31 10:09:50): [be[ipa.internal.com]] [dp_module_open_lib] (0x1000): Loading module [ipa] with path [/usr/lib/x86_64-linux-gnu/sssd/libsss_ipa.so]
(2022-10-31 10:09:50): [be[ipa.internal.com]] [dp_module_open_lib] (0x0010): Unable to load module [ipa] with path [/usr/lib/x86_64-linux-gnu/sssd/libsss_ipa.so]: libndr.so.2: cannot open shared object file: No such file or directory
(2022-10-31 10:09:50): [be[ipa.internal.com]] [dp_load_module] (0x0020): Unable to create DP module.
(2022-10-31 10:09:50): [be[ipa.internal.com]] [dp_target_init] (0x0010): Unable to load module ipa
(2022-10-31 10:09:50): [be[ipa.internal.com]] [dp_load_targets] (0x0020): Unable to load target [id] [80]: Accessing a corrupted shared library.
(2022-10-31 10:09:50): [be[ipa.internal.com]] [dp_init_done] (0x0020): Unable to initialize DP targets [1432158209]: Internal Error

Needed to add file /etc/apt/sources.list.d/temp.list with contents.

deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20221001T092433Z/ unstable main contrib

And then downgrade samba-libs, either with aptitude which can dynamically identify other dependencies to also downgrade, or just with apt-get.

sudo apt-get install libsmbclient=2:4.16.5+dfsg-1 samba-libs=2:4.16.5+dfsg-1

Downgrading sssd to 2.7.4-1 from 2.7.4-1+b1 is not necessary.

I could have avoided this this time by running this first:

sudo apt-mark hold samba-libs

Update ipasam rpm

bgstack15 — Fri, 13 May 2022 13:02:37 GMT

Overview

Update-ipasam-rpm is a project that facilitates building a custom rpm with just the one file that samba needs to authenticate users to ipa.

Update-ipasam-rpm upstream

Gitlab is the upstream. This is original work.

Reason for existing

The proper ipa-server-trust-ad rpm has a large number of dependencies which are not necessary merely when using samba with ipa user authentication, so this project copies that file out and builds a small rpm just for the one file. This makes my samba file server need fewer packages installed.

Alternatives

Install ipa-server-trust-ad with all of its dependencies, which is way more than I want to use when I just need ipasam.so.

Dependencies

For any rpm-based system, but primarily AlmaLinux 8, the server that runs the cron job needs a few things:

Http/s access to a package mirror
Https access to copr to initiate builds
Https access to gitlab to pull ipasam.spec template
Packages: copr-cli, rpmbuild
Unprivileged user, shown in this documentation as username copruser

The copr api can be used with a copr user with a generated api key (Reference 1).

Files in the project

~copruser/.config/copr
~copruser/.config/ipasam
~copruser/bin/update-ipasam-rpm.sh
/etc/cron/70_ipasam_cron
~copruser/.cache/ipasam.spec (generated by modifying spec from this repo)
~copruser/.cache/ipa-server-trust-ad.ver (generated)
~copruser/rpmbuild/SRPMS/iapsam*.srpm (generated)

Usage

Create user copruser or other unprivileged user as desired.
Deploy the non-generated files from this repository to the above locations and inspect the config files.
Prepare a user on the copr and generate an api key and place in file ~copruser/.config/copr.
Run the command manually to see it operate.

~/bin/update-ipasam-rpm.sh
Visit your copr project to see the ipasam rpm that you built!

Differences from upstream

N/A

References

COPR API introduction

Deplist improved, with suggested and recommended entries

bgstack15 — Mon, 27 Apr 2020 12:53:10 GMT

STUB make sure to document how to use make DEPLIST DEPTYPE=sug DISTRO=devuan and default of make DEPLIST DEPTYPE=dep DISTRO=devuan and make DEPLIST DEPTYPE=rec DISTRO=devuan Here is my improved method for using target deplist. In the Makefile:

deplist:
   @# deplist 2020-04-18 input must be comma separated
   @# DEPTYPE( dep , rec , sug ) for depends, recommends, or suggests
   @if test -z "${DISTRO}" ; then ${echobin} "Please run \`make deplist\` with DISTRO= one of: `make deplist_opts 2>&1 1>/dev/null | ${xargsbin}`. Aborted." 1>&2 ; exit 1 ; fi
   @if ! ${echobin} "${DEPTYPE}" | grep -qE "^(dep|rec|sug)$$" ; then ${echobin} "Please run \`make deplist\` with DEPTYPE= one of: dep, rec, sug. Undefined will use \`dep\`. Aborted." 1>&2 ; exit 1; fi
   @${grepbin} -h --exclude-dir='doc' -riIE "\<${DEPTYPE}-" ${SRCDIR} | ${awkbin} -v "domain=${DISTRO}" -v "deptype=${DEPTYPE}" 'tolower($$2) ~ deptype"-"domain {$$1="";$$2="";print}' | tr ',' '\n' | ${sortbin} | ${uniqbin} | ${sedbin} -r -e 's/^\s*//' -e "s/\s*\$$/${SEPARATOR}/" | ${xargsbin}

deplist_opts:
   @# deplist_opts 2020-04-18 find all available dependency domains
   @${grepbin} -h -o -riIE '\<(dep|rec|sug)-[^\ :]+:' ${SRCDIR} | ${sedbin} -r -e 's/(dep|rec|sug)-//;' -e 's/:$$//;' | ${sortbin} | ${uniqbin} 1>&2

Observe how these all depend on variables being defined earlier:

awkbin     :=$(shell which awk)
chmodbin   :=$(shell which chmod)
cpbin      :=$(shell which cp)
echobin    :=$(shell which echo)
falsebin   :=$(shell which false)
findbin    :=$(shell which find)
grepbin    :=$(shell which grep)
gzipbin    :=$(shell which gzip)
installbin :=$(shell which install)
rmbin      :=$(shell which rm)
rmdirbin   :=$(shell which rmdir)
sedbin     :=$(shell which sed)
sortbin    :=$(shell which sort)
truebin    :=$(shell which true)
uniqbin    :=$(shell which uniq)
xargsbin   :=$(shell which xargs)

In the source files in the project, you can use entries like these:

# dep-devuan: mawk | gawk, lightdm, upower
# dep-raw: awk, grep, sed, lightdm
# rec-devuan: lightdm-gtk-greeter
# sug-devuan: logout-manager
# dep-centos: lightdm, upower

Obviously this is a poor substitute for the make_shlibs from debhelper (which probably just wraps around ldd). But for my shell-driven packages, it's pretty nice if you add the dependencies to each individual file.

Makefile trick: deplist

bgstack15 — Wed, 18 Mar 2020 13:12:51 GMT

I whipped together a snippet for a Makefile I plan on using more in the future. This target, deplist, searches the entire source tree for my "# Dependencies:" tags, by distribution name, and lists them on standard out.

deplist:
    @if test -z "$(DISTRO)" ; then echo "Please run \`make deplist\` with DISTRO= one of: `make deplist_opts 2>&1 1>/dev/null | xargs`. Aborted." ; exit 1 ; fi
    @grep -h --exclude='Makefile' --exclude-dir='doc' -A5 -riIE dependencies $(SRCDIR) | \
       awk -v 'distro=$(DISTRO)' 'tolower($$0) ~ distro {$$1="";$$2="";print}' | \
       awk 'BEGIN{cmd="xargs -n1"} $$0 !~ /\(/{print $$0 | cmd ; close(cmd);} $$0 ~ /\(/{print;}' | \
       sort | uniq | sed -r -e 's/$$/$(SEPARATOR)/' | xargs

deplist_opts:
    @echo "el7" 1>&2
    @echo "devuan" 1>&2

And, of course, probably place these in your .PHONY list because these are not real files to be built.

.PHONY: clean install uninstall list deplist deplist_opts

Every file in the project that has an external dependency should have some comments in this format:

# Dependencies:
#    devuan: python3-tk python3-pil
#    el7: python36 python36-pil

To use this target in a debuild recipe, so that it will dynamically build the dpkg dependency list, use:

override_dh_gencontrol:
    printf "misc:Depends=" > debian/${APPNAME}.substvars
    make -C src deplist DISTRO=devuan SEPARATOR=',' | grep -vE 'make\[[0-9]' >> debian/${APPNAME}.substvars
    dh_gencontrol

References

Inspiration from rpm's Dynamic Build Dependency feature. Original research.

Depending on third-party packages or repos

bgstack15 — Sun, 22 Dec 2019 14:12:56 GMT

A recent incident has caught my attention, where a Ubuntu PPA owner decided to restrict access to his PPAs after some bad feelings he got from an interaction with a stingy company. As many in the reddit thread commented, it is unwise to pull in dependencies from third-parties. You cannot always expect them to remain available, or always trust them. In fact, you probably shouldn't trust them. Obviously, there is a wide spectrum of opinions on the topic. This isn't a moral issue, but it is an important possibly business-continuity one.

Disclosures for my public repositories

I package some programs myself, for Fedora/CentOS and Devuan ceres. Of course they have dependencies, and a few even have some third-party dependencies. For some of my projects, I have actually taken the effort to package up their dependencies as well so my repositories are sufficient (with main distro repos of course) for the actual package I care about. I made the decision on CentOS 6, because I don't actually have any extant systems myself, that I will rely on third-party repositories for some key dependencies. I am uncertain this information is publicly viewable on the copr, and I do not wish to hide it. The copr front page shows that the various repos are "[Modified]" but they do not provide links to what additional repositories they depend on. And the EPEL8 dependencies are because there were no official repos hosting certain packages yet, but that should rectified over time.

copr://bgstack15/stackrpms/epel-6-i386
- copr://ewdurbin/pythons-el6
- copr://mlampe/devtoolset-7
copr://bgstack15/stackrpms/epel-8-x86_64
- https://download.fedoraproject.org/pub/epel/playground/$releasever/Everything/$basearch/os
- My own repo for a few things that couldn't be built on copr because of weird dependency issues at the time: http://example.no-ip.biz/repo/rpm/ (redacted). Of course I trust this one, but should you?
- copr://nikitines/XFCE

Holiday greetings

Also, happy holidays or Merry Christmas or whatever holiday greetings you want. This post was originally published on December 22, 2019 so it's the last one before Christmas.

Fedora and scanners

bgstack15 — Sun, 13 Jan 2019 14:12:04 GMT

If you are running Fedora and you want to use a scanner, you probably already have sane (backends at least) and simple-scan installed. What is incredibly frustrating is when scanimage -L shows you the scanner, but simple-scan does not list it. What you are missing is

sudo dnf install libnsl

This package is different from libnsl2, which is probably already installed. But some applications must depend on libnsl, including simple-scan. Thanks to suspiciousmilk of Ask Fedora.

References

Weblinks

Brother scanner driver don't work [ask.fedoraproject.org]

dnf install build deps

bgstack15 — Thu, 29 Nov 2018 13:42:53 GMT

If you want to build a package, but need all of its buildrequires packages, use this command:

sudo dnf builddep wxGTK3

I leave my source repositories off, so be sure to do any --enablerepo=fedora-source,updates-source as necessary.

For debian family

Try a cool tool named "mk-build-deps" as documented over at https://www.guyrutenberg.com/2017/09/23/use-mk-build-deps-instead-of-apt-get- build-dep/

References

Weblinks

Automatically install build dependencies prior to building an RPM package [stackoverflow.com]

Dnf ignore weak dependencies

bgstack15 — Sat, 13 May 2017 12:57:23 GMT

tl;dr

dnf --setopt=install_weak_deps=False --best install newpackage

dnf do not install weak dependencies

In the new paradigm for rpm package management (rpmpm?), we use dnf. I am fine with using the latest and greatest, but sometimes yum looks nicer in hindsight than dnf. One of the more recent features added to rpms is weak dependencies. Debian has had weak dependencies for a longer time, so it's nice to see rpm adding such a feature. I recently went through a spell where I wanted to install my own package but exclude the recommended options. After a lot of research and man dnf dnf.conf, I derived the command I needed.

dnf --setopt=install_weak_deps=False --best install newpackage

History

I tried an ugly hack, which technically worked.

dnf --disablerepo=* install ./bgscripts*

But all it does is disable all repos. I was using a local file, so it could get to the rpm I required, but any hard dependencies would be not found. I then tried another option, which technically worked.

dnf install ./bgscripts* -x freerdp

But I had to run a dnf command to see what packages would be installed, and then manually named the packages in the exclude list.

References

Weblinks

Man pages

dnf dnf.conf