Re: Standardizing NO_NETWORK and USE_SYSTEM_DEPS environment variables

--=-e4XbZ5AURm8Ffm43ay/O
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, 2025-01-23 at 15:04 +0100, Bernhard M. Wiedemann wrote:
> On 1/23/25 2:14 PM, Micha=C5=82 G=C3=B3rny wrote:
> > Hello,
> >=20
> > As a packager, I often find it necessary to ensure two important aspect=
s
> > of the build process:
> >=20
> > 1) that the build process itself doesn't access the Internet,
> > in particular that it doesn't download any files on its own,
> >=20
> > 2) that the build process uses system shared libraries and other
> > dependencies whenever possible, rather than vendored (or downloaded)
> > copies.
>=20
> For openSUSE, we build in Open-Build-Service (OBS) that runs the build=
=20
> in KVM without Internet-access. It is the only way to be sure.

I think all major distributions use some kind of Internet sandboxing
now.  Still, I think the more correct solution is for packages not to
attempt accessing Internet in the first place, rather than us to rely
that we will be able to actually successfully sandbox them.

> We try to un-bundle libraries to use our system versions instead, but=20
> what if there are too many incompatible versions required?

As I've said in the other reply, then the decision should up
to the packager.  Yes, there will be cases when we will decide that
unvendoring is impossible or "not worth the drawbacks".  Still,
disabling vendoring by default and enabling it when necessary is better
than having to disable it every time separately.

> What is the problem with
> configure --use-system-libfoo

I've already explained that in the reply to Bruno Haible [1].

[1] https://lore.kernel.org/distributions/aad2b06f-df80-4751-a667-8fc4c4e10=
[email protected]/T/#me20568c9c4267a16b1e096fa12224e980042f77a

--=20
Best regards,
Micha=C5=82 G=C3=B3rny


--=-e4XbZ5AURm8Ffm43ay/O
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQFGBAABCgAwFiEEx2qEUJQJjSjMiybFY5ra4jKeJA4FAmeSVX4SHG1nb3JueUBn
ZW50b28ub3JnAAoJEGOa2uIyniQO9qkIALS3O3am8vbTlZrNCTW39EHJZKJIAOE3
3rBhovv1lVaEQ3v3Lyvt7NRfpfztu3smbmBMyqH3fJSO1Mmwp06yT2HyrNrRk2g3
qa54VU/hxZk2t0b9ze9Q7WDpUu+SgSvc/lBduEMbuEBO7ToLo6Ppo5yjmKO+l/QA
Q3hytgIMr1jh1XylxkyTzbWQJhQg6x3E9ZCLNwaPc3/Kwt3cQiRkXXpezkqRw6gP
DoHLe6rmMWdYB55MUttHfYnJqvA92jNRLDb7GGtrttYBzHy/zTUu5DgPfv0wMbTQ
1hF9SO1ZewICYFqRE5wK/uGvJK3pkY4JfH6gDgTI5XEpKxf3v6UQCdA=
=OYqQ
-----END PGP SIGNATURE-----

--=-e4XbZ5AURm8Ffm43ay/O--