[lsb-discuss] Adding dependency on "lsb" causes huge downloads

Anthony W. Youngman wol at thewolery.demon.co.uk
Thu Mar 4 13:51:12 PST 2010


In message 
<FE028D69955796489B510CE43DBBE803AA2007C6 at rrsmsx503.amr.corp.intel.com>, 
"Wichmann, Mats D" <mats.d.wichmann at intel.com> writes
>The LSB spec itself certainly has the opportunity to expose
>a lot more granularity for applications to depend on.  We
>were headed in a direction that had *some* granularity
>(where >1 = some), but that was stopped because it had the
>potential to be "too confusing".  But if we believe that in
>2010 and beyond, all installations will happen in the presence
>of the repository context, rather than the package context
>(see footnote - this may not be true), would that still be the
>case?  If there were a tool available that determined the
>necessary LSB component-level dependencies so you could put
>them into your package description, and you assume that at
>install time the distro's repository is available to resolve
>those, do we still have to stop at only one single 'lsb'
>meta dependency?  Could we have greater granularity,
>allowing only some distro packages to be pulled in on any
>given LSB-package install, and lighten the burden Dan refers
>to in the original message?

Adding my two-pennorth, as someone who has ALWAYS right from the start 
fought for granularity, this "pulls in the everything including the 
kitchen sink" has the ability to be a *real* pain.

Okay, this dates it as a *long* time ago, I once tried to install a 
minimal SuSE system. It *insisted* on installing ISDN support as part of 
the base dependencies, despite me having only network connectivity. 
Doesn't sound bad, except that that one package alone chewed up 1% of my 
hard disk. (I said it was ages ago - it was a 600Mb hard disk :-)

But bloat is bloat is bloat. I'm typing this message on my *main* pc - 
more than powerful enough for what I want. But I can't upgrade my ram - 
it's maxed out at 3x256Mb. The bios can't handle disks bigger than 
128Gb. The processor is underclocked because the mobo FSB is 100MHz and 
the processor is a 133MHz FSB.

But at the end of the day, this is my biggest frustration with the LSB - 
I *don't* *want* stuff on my system that I *don't* *need*. And one of 
the reasons I don't want it is that it is a security risk! If I don't 
want it, it's probably because I don't understand it. If I don't 
understand it, I don't know how to secure it. And if I can't secure it, 
how do I know it won't do things I don't expect and let somebody into my 
system?

Oh - maybe we can take a leaf from gentoo. I think it's pretty recent, 
but they've added an awful lot of meta-packages to do with KDE recently. 
Can't we define the lsb "packages" as a tree - if you ask for "lsb" you 
get the lot, but that includes eg "lsb-print", "lsb-mail" etc, and 
lsb-mail might include "lsb-mail-client", "lsb-mail-server" etc etc.

Cheers,
Wol
-- 
Anthony W. Youngman - anthony at thewolery.demon.co.uk



More information about the lsb-discuss mailing list