From mboxrd@z Thu Jan 1 00:00:00 1970 From: Roel Janssen Subject: Re: [PATCH] gnu: Add mongodb. Date: Sat, 19 Mar 2016 10:19:33 +0100 Message-ID: <87pouqx1sq.fsf@gnu.org> References: <877fh1rvkn.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:50243) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ahD2h-0001Sd-SZ for guix-devel@gnu.org; Sat, 19 Mar 2016 05:19:32 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ahD2c-0006JT-TA for guix-devel@gnu.org; Sat, 19 Mar 2016 05:19:31 -0400 In-reply-to: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: "Thompson, David" Cc: guix-devel Hello David, Thanks for your feedback, and sorry for my incomplete patch. My reasoning for keeping the third-party libraries in the tarball was simply because upstream made that choice. Unbundling can and probably will introduce differences in the behavior of the output with other distributions and their official binaries. I will try to unbundle these libraries from the release tarball. This could take some time though. Again, sorry for the noise. Kind regards, Roel Janssen Thompson, David writes: > Hi Roel, > > 2016-03-17 11:08 GMT-04:00 Roel Janssen : >> Dear Guix, >> >> This is a patch to add MongoDB (server and client) tools. I used a >> three-line patch to fix the build process's reliance on Git and the >> .git/ directory. > > Sorry to be the bearer of bad news, but I became suspicious about this > package recipe when I noticed that it had no inputs. Unfortunately, > MongoDB is one of those projects that bundles the source code for all > of their dependencies in their release tarballs. Here's a list from > the src/third_party directory: > > asio-asio-1-11-0 > boost-1.56.0 > gperftools-2.2 > IntelRDFPMathLib20U1 > libstemmer_c > mozjs-38 > murmurhash3 > pcre-8.36 > pcre-8.37 > s2 > SConscript > shim_allocator.cpp > shim_asio.cpp > shim_boost.cpp > shim_intel_decimal128.cpp > shim_mozjs.cpp > shim_pcrecpp.cc > shim_snappy.cpp > shim_stemmer.cpp > shim_tz.cpp > shim_v8.cpp > shim_wiredtiger.cpp > shim_yaml.cpp > shim_zlib.cpp > snappy-1.1.2 > tz > unicode-8.0.0 > valgrind-3.11.0 > wiredtiger > yaml-cpp-0.5.1 > zlib-1.2.8 > > This is a really bad practice from a security and maintenance > perspective, so in Guix we do our best to unbundle as many things as > possible. I recommend deleting everything above besides the "shim_*" > files using a snippet in the origin record (search for "snippet" in > gnu/packages for examples) and seeing if its possible to use > system-provided dependencies for everything. From a quick look, > you'll probably have to package an additional library or two. > > Thanks and sorry! > > - Dave