Re: [PATCH] gnu: Add mongodb.

[Roel Janssen]

Hello David,

Thanks for your feedback, and sorry for my incomplete patch.

My reasoning for keeping the third-party libraries in the tarball was
simply because upstream made that choice.  Unbundling can and probably
will introduce differences in the behavior of the output with other
distributions and their official binaries.

I will try to unbundle these libraries from the release tarball.  This
could take some time though.

Again, sorry for the noise.

Kind regards,
Roel Janssen


Thompson, David writes:

> Hi Roel,
>
> 2016-03-17 11:08 GMT-04:00 Roel Janssen <address@hidden>:
>> Dear Guix,
>>
>> This is a patch to add MongoDB (server and client) tools.  I used a
>> three-line patch to fix the build process's reliance on Git and the
>> .git/ directory.
>
> Sorry to be the bearer of bad news, but I became suspicious about this
> package recipe when I noticed that it had no inputs.  Unfortunately,
> MongoDB is one of those projects that bundles the source code for all
> of their dependencies in their release tarballs. Here's a list from
> the src/third_party directory:
>
> asio-asio-1-11-0
> boost-1.56.0
> gperftools-2.2
> IntelRDFPMathLib20U1
> libstemmer_c
> mozjs-38
> murmurhash3
> pcre-8.36
> pcre-8.37
> s2
> SConscript
> shim_allocator.cpp
> shim_asio.cpp
> shim_boost.cpp
> shim_intel_decimal128.cpp
> shim_mozjs.cpp
> shim_pcrecpp.cc
> shim_snappy.cpp
> shim_stemmer.cpp
> shim_tz.cpp
> shim_v8.cpp
> shim_wiredtiger.cpp
> shim_yaml.cpp
> shim_zlib.cpp
> snappy-1.1.2
> tz
> unicode-8.0.0
> valgrind-3.11.0
> wiredtiger
> yaml-cpp-0.5.1
> zlib-1.2.8
>
> This is a really bad practice from a security and maintenance
> perspective, so in Guix we do our best to unbundle as many things as
> possible.  I recommend deleting everything above besides the "shim_*"
> files using a snippet in the origin record (search for "snippet" in
> gnu/packages for examples) and seeing if its possible to use
> system-provided dependencies for everything.  From a quick look,
> you'll probably have to package an additional library or two.
>
> Thanks and sorry!
>
> - Dave