I've had a couple bugs recently, including 999699, where upstream
Makefile.am content has resulted in binaries delivered in a .deb having
a run-time dependency on the symlinks provided in the library -dev
package instead of the ".0" version of those files provided in the
actual library packages.

It would be nice if lintian were to notice and warn about these cases,
particularly if the -dev package isn't explicitly specified as a binary
package dependency (as it probably shouldn't be in most cases?).

Bdale

Hi Bdale,

Do you have the output of 'readelf --all --wide' [1] for one of those binaries?

I am especially interested in the NEEDED field from the "Dynamic
Section." [2][3] The tag 'undeclared-elf-prerequisites' [4] can
probably be expanded to cover your condition of insufficient
prerequisites (instead of none at all).

Your condition involves sonames that I believe are customarily
provided by links in '-dev' installables instead of regular shared
library packages.

I would adjust that logic there. [5] In particular, I would refine the
conditional:

    if @{$item->elf->{NEEDED} // [] }
    && $depends->is_empty;

What do you think, please? Thanks!

Kind regards
Felix Lechner

[1] https://salsa.debian.org/lintian/lintian/-/blob/master/lib/Lintian/Index/Elf.pm#L85
[2] https://salsa.debian.org/lintian/lintian/-/blob/master/lib/Lintian/Index/Elf.pm#L215
[3] https://salsa.debian.org/lintian/lintian/-/blob/master/lib/Lintian/Index/Elf.pm#L445
[4] https://salsa.debian.org/lintian/lintian/-/blob/master/tags/u/undeclared-elf-prerequisites.tag
[5] https://salsa.debian.org/lintian/lintian/-/blob/master/lib/Lintian/Check/Binaries/Prerequisites.pm#L108-113

Felix Lechner <felix.lechner@lease-up.com> writes:

The elf library binaries delivered by the package actually look fine.

Digging further, it appears the problem cases are all in guile code,
where the function dynamic-link is handed a token like 'libglib-2.0':

    (define libglib (dynamic-link "libglib-2.0"))

This guile code gets "compiled" on the first invocation of the
application and cached in ~/.cache/guile.  The problem is that at
runtime, that function call results in an attempt to load
'libglib-2.0.so' which fails if the -dev package isn't installed.

I'm fixing those with Makefile.am changes like:

  -LIBGLIB=libglib-2.0
  +LIBGLIB := $(shell /sbin/ldconfig -p | awk '/libglib-2.0.so\./ { print $$1 }')

That changes the guile code to look like:

    (define libglib (dynamic-link "libglib-2.0.so.0"))

which works as desired at runtime, since that symlink is provided by the
binary library package.

So .. I'm not sure how good the return on investment of trying to add a
test for this in lintian would be.  Talking to upstream about it, the
approach I'm using in Makefile.am seems credible and they make just take
that in.  There's no indication the dynamic-link function in guile is
going to get any "smarter", so Makefile.am is probably the right place
to fix the problem.

Exactly.

I don't know if lintian already tries to parse any scheme source.  If
not, just close this as I don't think it's worth chasing.  If it does,
we could perhaps add a test for the dynamic-link function being handed a
token without '.so.0' in it, or something?

Bdale

Hi Bdale,

We do not, currently.

For now, I would like to offer you this research tag. [1] The output
will not appear on our website or be shown to any users, but you could
(relatively soon) access archive-wide results via our JSON interface.
[2] We would then try to refine the tag for public consumption
together.

What do you think, please?

Kind regards
Felix Lechner

[1] https://salsa.debian.org/lintian/lintian/-/merge_requests/382
[2] https://lintian.debian.org/query

diff --git a/lib/Lintian/Check/Languages/Guile/DynamicLink.pm
b/lib/Lintian/Check/Languages/Guile/DynamicLink.pm
new file mode 100644
index 0000000000..dcbd250139
--- /dev/null
+++ b/lib/Lintian/Check/Languages/Guile/DynamicLink.pm
@@ -0,0 +1,68 @@
+# languages/guile/dynamic-link -- lintian check script -*- perl -*-
+
+# Copyright © 2021 Felix Lechner
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, you can find it on the World Wide
+# Web at http://www.gnu.org/copyleft/gpl.html, or write to the Free
+# Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
+# MA 02110-1301, USA.
+
+package Lintian::Check::Languages::Guile::DynamicLink;
+
+use v5.20;
+use warnings;
+use utf8;
+
+use Const::Fast;
+usa List::SomeUtils qw(uniq);
+
+use Moo;
+use namespace::clean;
+
+with 'Lintian::Check';
+
+const my $LEFT_SQUARE_BRACKET => q{[};
+const my $RIGHT_SQUARE_BRACKET => q{]};
+
+sub visit_installed_files {
+    my ($self, $item) = @_;
+
+    return
+      unless $item->name =~ m{ [.] scm $}x
+      || $item->interpreter eq 'guile';
+
+    # slurping contents for now
+    my $contents = $item->decoded_utf8;
+    return
+      unless length $contents;
+
+    my @libraries
+      = ($contents
+          =~ m{ [(] define \s+ \S+ \s+ [(] dynamic-link \s+ "([^"]+)"
[)] [)] }gx
+      );
+
+    $self->hint('guile-dynamic-link', $_,
+        $LEFT_SQUARE_BRACKET . $item->name . $RIGHT_SQUARE_BRACKET)
+      for uniq @libraries;
+
+    return;
+}
+
+1;
+
+# Local Variables:
+# indent-tabs-mode: nil
+# cperl-indent-level: 4
+# End:
+# vim: syntax=perl sw=4 sts=4 sr et

diff --git a/tags/g/guile-dynamic-link.tag b/tags/g/guile-dynamic-link.tag
new file mode 100644
index 0000000000..d1faa0b92d
--- /dev/null
+++ b/tags/g/guile-dynamic-link.tag
@@ -0,0 +1,7 @@
+Tag: guile-dynamic-link
+Severity: classification
+Check: languages/guile/dynamic-link
+Explanation: Guile tries to load this shared library via a Scheme
expression like
+ <code>(define libglib (dynamic-link "libglib-2.0"))</code>.
+See-Also:
+ Bug#999738