Re: [gentoo-dev] Proliferation of IUSE=static-libs in Gentoo

[Francesco Riosa <vivo75@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2069 bytes --]

2018-03-08 16:40 GMT+01:00 Michał Górny <mgorny@gentoo.org>:

> Hello, developers.
>
> I would like to bring to your attention an alarming trend in Gentoo
> ebuilds -- the proliferation of IUSE=static-libs, that is a flag
> allowing our users to build static libraries.
>
> I should like to remind you that static linking is almost always a bad
> idea. It has serious security implications, it is poorly supported on
> *nix systems (example: library dependencies are provided via hacks, we
> don't have proper rebuild capabilities) and should be basically
> considered  a great evil. Partially relevant doc: [1].
>
> This is why Gentoo does not generally support statically linking stuff,
> and we force dynamic linking whenever possible (sometimes even going too
> far with that but that's another story). We only allow static linking
> for special cases where shared linking can't be used for one reason
> or another.
>
> As part of that we also shouldn't deliver static libraries unless
> absolutely necessary to satisfy the dependencies of applications which
> we support built statically. Back in the day, Gentoo developers were
> pushing against packages that built static libraries unconditionally.
> However, it seems that at some point this front changed from 'fighting
> unconditionally built static libraries' to 'proliferating USE=static-
> libs everywhere'. Which is bad.
>
> So, developers, please *stop adding USE=static-libs* to random libraries
> that have no reason whatever to be statically linked to. And by that I
> mean a good reason, not creeping featurism, not 'user asked for it', not
> 'this broken package hardcodes libfoo.a'.
>

this would make impossible to use qemu static with binfmt alas
https://wiki.debian.org/QemuUserEmulation
Also looking for which packages are eligible for static libraries or not is
more work, not less, because it's a whole different layer of dependancies
(when doing the qemu stuff I just decided to build static for everything
rather than manage use flags per package)

[-- Attachment #2: Type: text/html, Size: 2581 bytes --]