Bug#804047: Build-Depends on gengetopt needed?

[Simon Josefsson]

Sebastien Bacher <address@hidden> writes:

> Package: libidn
> Version: 1.32-3
>
> Hey,
>
> Is the Build-Depends on gengetopt needed? The package seems to build
> fine without it
> https://launchpad.net/ubuntu/+source/libidn/1.32-3ubuntu1

Gengetopt is required to rebuild idn_cmd.h/idn_cmd.c from the idn.ggo
source.

I believe the Debian best established practice is to always rebuild as
much as possible from source code so that we don't end up in situations
where it is no longer possible to rebuild from source.

If there is ever a security vulnerability in gengetopt, so that it
generates insecure programs, it would be nice for the Debian security
people to be able to patch gengetopt and then simply rebuild libidn,
instead of having to ALSO patch libidn and then rebuild it.

However, in this case, the files won't be rebuilt anyway, since the
idn.ggo file modification timestamp is before the idn_cmd.h/idn_cmd.c
files.  So the attempt to do the right thing is not achieving anything.

All this said, I would prefer a patch that instead of dropping gengetopt
as build dependency, would make sure that the files are rebuilt
properly.  Maybe it is as easy as "touch src/idn.ggo", but I know that
modifying the source tree sometimes leads to other problems.  I'll
experiment a bit.

/Simon

signature.asc
Description: PGP signature