Re: setuid/setgid binaries contained in the Debian repository.
On Mon, Aug 11, 2003 at 10:36:35PM +0200, Emile van Bergen wrote:
> On Mon, Aug 11, 2003 at 04:16:24PM -0400, Matt Zimmerman wrote:
>
> > It would be nice indeed; it also turns out to be horrifically complex
> > when you consider dependency relationships, unless you force the user to
> > install another copy of all system software in their home dir as well.
>
> Well, dpkg should probably concatenate /var/lib/dpkg/status and
> ~/var/lib/dpkg/status internally to see if build dependencies are already
> satisfied by the global system.
>
> Most --configure scripts should be able to search ~/lib as well as /lib,
> /usr/lib and /usr/local/lib.
>
> I don't see how this would be prohibitively complex. Sure, there are some
> issues to be worked out, but basically comes down to allowing each user to
> add a user-specific part to the in-memory package database when running
> the package management tools.
Don't you think you are oversimplifying a bit?
You have glossed over a lot of very significant concerns:
- properly resolving dependencies in this scenario is a lot more complex
than concatenating two status files together. Consider Conflicts, for
instance. Then Replaces. Then Provides.
- nearly every single package would need to be modified (the source code,
not the packaging) to support relocation
- if by "--configure" you mean autoconf-generated configure scripts, most
packages don't even use autoconf, and even if they did, autoconf doesn't
search the way that you have described, and neither does ld.
--
- mdz
Reply to: