[OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

[OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

[Roshan Sivakumar]

RPM 4 generated dependencies with the external __find_requires /
__find_provides generator, which OE disabled entirely via
_use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
v6-format packages only the internal fileattr generators run.

rpm's script.attr generator therefore runs for the first time in OE
builds. For every packaged executable whose first line is a #! shebang
it emits an interpreter dependency. kernel-devsrc ships
scripts/mksysmap (#!/bin/sed -f) as an executable, so its package gains:

  Requires: /bin/sed

OE manages build and runtime dependencies explicitly through
DEPENDS / RDEPENDS and does not want these. They break real use cases:

- The interpreter path is taken verbatim from the shebang. A #!/bin/sed
  script requires /bin/sed, but under usrmerge the only provider
  (busybox) offers /usr/bin/sed. The literal paths never match and the
  package becomes uninstallable.
- In the SDK the sole interpreter providers (busybox, coreutils, bash,
  perl) are deliberately banned by target-sdk-provides-dummy, so these
  auto-generated requires make -dev/-src packages uninstallable during
  do_populate_sdk ("nothing provides /bin/sed needed by kernel-devsrc").
- The requires are non-reproducible: they are only emitted when the
  interpreter is scanned from the shebang during packaging, so the same
  recipe can produce different packages between the reproducible A and
  B builds.

This is the same class of regression already handled for the pkgconfig
generator; see "rpm: disable the RPM 6 pkgconfig dependency generator".

Suppressing the generator from the rpmbuild command line
(__requires_exclude / __script_requires set to %{nil}) is not reliable:
rpm reloads the fileattr macros during dependency generation and
clobbers the --define. Remove script.attr and its helper script.req
from rpm's install lists via a source patch. This changes
do_unpack/do_patch, so the whole rpm recipe and everything downstream
re-hash and no stale rpm-native is reused.

Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com>
---
 ...he-script-interpreter-dependency-gen.patch | 72 +++++++++++++++++++
 meta/recipes-devtools/rpm/rpm_6.0.2.bb        |  1 +
 2 files changed, 73 insertions(+)
 create mode 100644 meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch

diff --git a/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
new file mode 100644
index 0000000000..8c3d1769c8
--- /dev/null
+++ b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
@@ -0,0 +1,72 @@
+From: Roshan Sivakumar <roshs@qti.qualcomm.com>
+Date: Thu, 16 Oct 2026 00:00:00 +0000
+Subject: [PATCH] Do not install the script interpreter dependency generator
+
+RPM 4 generated dependencies with the external __find_requires /
+__find_provides generator, which OE disabled entirely via
+_use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
+v6-format packages only the internal fileattr generators run.
+
+rpm's script.attr generator therefore runs for the first time in OE
+builds. For every packaged executable whose first line is a #! shebang
+it adds an interpreter dependency, e.g. a kernel-devsrc package shipping
+scripts/mksysmap (#!/bin/sed -f) gains:
+
+  Requires: /bin/sed
+
+OpenEmbedded manages build and runtime dependencies explicitly via
+DEPENDS/RDEPENDS and does not want these. They break real use cases:
+
+- The literal interpreter path is taken verbatim from the shebang, so a
+  #!/bin/sed script requires /bin/sed while the only provider (busybox)
+  offers /usr/bin/sed under usrmerge. The paths never match and the
+  package is uninstallable.
+- In the SDK the sole interpreter providers (busybox, coreutils, bash,
+  perl) are deliberately banned by target-sdk-provides-dummy, so these
+  auto-generated requires make -dev/-src packages uninstallable during
+  do_populate_sdk ("nothing provides /bin/sed").
+- The requires are non-reproducible: they are only emitted when the
+  interpreter happens to be scanned from the shebang in the build
+  sysroot, so the same recipe can produce different packages.
+
+This is the same class of problem fixed for pkgconfig.attr; see
+"rpm: disable the RPM 6 pkgconfig dependency generator".
+
+Suppressing the generator from the rpmbuild command line is not
+reliable: rpm reloads the fileattr macros during dependency generation
+and clobbers any --define. Remove script.attr and its helper script.req
+from rpm's install lists via a source patch. This changes
+do_unpack/do_patch, so the whole rpm recipe and everything downstream
+re-hash and no stale rpm-native is reused.
+
+Upstream-Status: Inappropriate [OE policy: dependencies are managed by the build system, not generated by rpmbuild]
+
+Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com>
+---
+ fileattrs/CMakeLists.txt | 2 +-
+ scripts/CMakeLists.txt   | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fileattrs/CMakeLists.txt b/fileattrs/CMakeLists.txt
+--- a/fileattrs/CMakeLists.txt
++++ b/fileattrs/CMakeLists.txt
+@@ -1,6 +1,6 @@
+ install(FILES
+ 	debuginfo.attr desktop.attr elf.attr font.attr metainfo.attr
+ 	ocaml.attr
+-	rpm_macro.attr rpm_lua.attr script.attr sysusers.attr usergroup.attr
++	rpm_macro.attr rpm_lua.attr sysusers.attr usergroup.attr
+ 	DESTINATION ${RPM_CONFIGDIR}/fileattrs
+ )
+diff --git a/scripts/CMakeLists.txt b/scripts/CMakeLists.txt
+--- a/scripts/CMakeLists.txt
++++ b/scripts/CMakeLists.txt
+@@ -6,7 +6,7 @@ install(PROGRAMS
+ 	check-buildroot check-rpaths check-rpaths-worker
+ 	find-lang.sh find-requires find-provides
+ 	ocamldeps.sh
+-	fontconfig.prov script.req
++	fontconfig.prov
+ 	rpm_macros_provides.sh
+ 	rpmdb_dump rpmdb_load
+ 	rpm2cpio.sh tgpg
diff --git a/meta/recipes-devtools/rpm/rpm_6.0.2.bb b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
index c27f58a0e8..6c80c839ca 100644
--- a/meta/recipes-devtools/rpm/rpm_6.0.2.bb
+++ b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
@@ -40,6 +40,7 @@ SRC_URI = "git://github.com/rpm-software-management/rpm;protocol=https;branch=rp
            file://0001-tools-elfdeps.cc-Remove-format-module.patch \
            file://0001-macros.in-Set-_pkgverify_level-to-digest-as-RCPM-4.2.patch \
            file://0003-Do-not-install-the-pkgconfig-dependency-generator.patch \
+           file://0004-Do-not-install-the-script-interpreter-dependency-gen.patch \
            "
 
 PE = "1"
-- 
2.34.1

RE: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

[Peter Kjellerstedt]

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Roshan Sivakumar via lists.openembedded.org
> Sent: den 22 oktober 2026 10:47
> To: openembedded-core@lists.openembedded.org
> Cc: Sumanth Gavini <sumanth.gavini@windriver.com>; Roshan Sivakumar <roshs@qti.qualcomm.com>
> Subject: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator
> 
> RPM 4 generated dependencies with the external __find_requires /
> __find_provides generator, which OE disabled entirely via
> _use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
> v6-format packages only the internal fileattr generators run.
> 
> rpm's script.attr generator therefore runs for the first time in OE
> builds. For every packaged executable whose first line is a #! shebang
> it emits an interpreter dependency. kernel-devsrc ships
> scripts/mksysmap (#!/bin/sed -f) as an executable, so its package gains:
> 
>   Requires: /bin/sed
> 
> OE manages build and runtime dependencies explicitly through
> DEPENDS / RDEPENDS and does not want these. They break real use cases:

I am not sure about the explicitly part. AFAIK, installed scripts with a 
#!/bin/bash shebang leads to an automatic dependency on bash. Whether it 
is RPM and/or bitbake doing that, I don't know.

> 
> - The interpreter path is taken verbatim from the shebang. A #!/bin/sed
>   script requires /bin/sed, but under usrmerge the only provider
>   (busybox) offers /usr/bin/sed. The literal paths never match and the
>   package becomes uninstallable.
> - In the SDK the sole interpreter providers (busybox, coreutils, bash,
>   perl) are deliberately banned by target-sdk-provides-dummy, so these
>   auto-generated requires make -dev/-src packages uninstallable during
>   do_populate_sdk ("nothing provides /bin/sed needed by kernel-devsrc").
> - The requires are non-reproducible: they are only emitted when the
>   interpreter is scanned from the shebang during packaging, so the same
>   recipe can produce different packages between the reproducible A and
>   B builds.
> 
> This is the same class of regression already handled for the pkgconfig
> generator; see "rpm: disable the RPM 6 pkgconfig dependency generator".
> 
> Suppressing the generator from the rpmbuild command line
> (__requires_exclude / __script_requires set to %{nil}) is not reliable:
> rpm reloads the fileattr macros during dependency generation and
> clobbers the --define. Remove script.attr and its helper script.req
> from rpm's install lists via a source patch. This changes
> do_unpack/do_patch, so the whole rpm recipe and everything downstream
> re-hash and no stale rpm-native is reused.
> 
> Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com>
> ---
>  ...he-script-interpreter-dependency-gen.patch | 72 +++++++++++++++++++
>  meta/recipes-devtools/rpm/rpm_6.0.2.bb        |  1 +
>  2 files changed, 73 insertions(+)
>  create mode 100644 meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
> 
> diff --git a/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
> new file mode 100644
> index 0000000000..8c3d1769c8
> --- /dev/null
> +++ b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-
> interpreter-dependency-gen.patch
> @@ -0,0 +1,72 @@
> +From: Roshan Sivakumar <roshs@qti.qualcomm.com>
> +Date: Thu, 16 Oct 2026 00:00:00 +0000
> +Subject: [PATCH] Do not install the script interpreter dependency generator
> +
> +RPM 4 generated dependencies with the external __find_requires /
> +__find_provides generator, which OE disabled entirely via
> +_use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
> +v6-format packages only the internal fileattr generators run.
> +
> +rpm's script.attr generator therefore runs for the first time in OE
> +builds. For every packaged executable whose first line is a #! shebang
> +it adds an interpreter dependency, e.g. a kernel-devsrc package shipping
> +scripts/mksysmap (#!/bin/sed -f) gains:
> +
> +  Requires: /bin/sed
> +
> +OpenEmbedded manages build and runtime dependencies explicitly via
> +DEPENDS/RDEPENDS and does not want these. They break real use cases:
> +
> +- The literal interpreter path is taken verbatim from the shebang, so a
> +  #!/bin/sed script requires /bin/sed while the only provider (busybox)
> +  offers /usr/bin/sed under usrmerge. The paths never match and the
> +  package is uninstallable.
> +- In the SDK the sole interpreter providers (busybox, coreutils, bash,
> +  perl) are deliberately banned by target-sdk-provides-dummy, so these
> +  auto-generated requires make -dev/-src packages uninstallable during
> +  do_populate_sdk ("nothing provides /bin/sed").
> +- The requires are non-reproducible: they are only emitted when the
> +  interpreter happens to be scanned from the shebang in the build
> +  sysroot, so the same recipe can produce different packages.
> +
> +This is the same class of problem fixed for pkgconfig.attr; see
> +"rpm: disable the RPM 6 pkgconfig dependency generator".
> +
> +Suppressing the generator from the rpmbuild command line is not
> +reliable: rpm reloads the fileattr macros during dependency generation
> +and clobbers any --define. Remove script.attr and its helper script.req
> +from rpm's install lists via a source patch. This changes
> +do_unpack/do_patch, so the whole rpm recipe and everything downstream
> +re-hash and no stale rpm-native is reused.
> +
> +Upstream-Status: Inappropriate [OE policy: dependencies are managed by
> the build system, not generated by rpmbuild]
> +
> +Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com>
> +---
> + fileattrs/CMakeLists.txt | 2 +-
> + scripts/CMakeLists.txt   | 2 +-
> + 2 files changed, 2 insertions(+), 2 deletions(-)
> +
> +diff --git a/fileattrs/CMakeLists.txt b/fileattrs/CMakeLists.txt
> +--- a/fileattrs/CMakeLists.txt
> ++++ b/fileattrs/CMakeLists.txt
> +@@ -1,6 +1,6 @@
> + install(FILES
> +       debuginfo.attr desktop.attr elf.attr font.attr metainfo.attr
> +       ocaml.attr
> +-      rpm_macro.attr rpm_lua.attr script.attr sysusers.attr usergroup.attr
> ++      rpm_macro.attr rpm_lua.attr sysusers.attr usergroup.attr
> +       DESTINATION ${RPM_CONFIGDIR}/fileattrs
> + )
> +diff --git a/scripts/CMakeLists.txt b/scripts/CMakeLists.txt
> +--- a/scripts/CMakeLists.txt
> ++++ b/scripts/CMakeLists.txt
> +@@ -6,7 +6,7 @@ install(PROGRAMS
> +       check-buildroot check-rpaths check-rpaths-worker
> +       find-lang.sh find-requires find-provides
> +       ocamldeps.sh
> +-      fontconfig.prov script.req
> ++      fontconfig.prov
> +       rpm_macros_provides.sh
> +       rpmdb_dump rpmdb_load
> +       rpm2cpio.sh tgpg
> diff --git a/meta/recipes-devtools/rpm/rpm_6.0.2.bb b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> index c27f58a0e8..6c80c839ca 100644
> --- a/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> +++ b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> @@ -40,6 +40,7 @@ SRC_URI = "git://github.com/rpm-software-management/rpm;protocol=https;branch=rp
>             file://0001-tools-elfdeps.cc-Remove-format-module.patch \
>             file://0001-macros.in-Set-_pkgverify_level-to-digest-as-RCPM-4.2.patch \
>             file://0003-Do-not-install-the-pkgconfig-dependency-generator.patch \
> +           file://0004-Do-not-install-the-script-interpreter-dependency-gen.patch \
>             "
> 
>  PE = "1"
> --
> 2.34.1

//Peter

Re: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

[Roshan Sivakumar]

[-- Attachment #1: Type: text/plain, Size: 8799 bytes --]

>>Replying here again since the previous reply was sent in a separate thread.

I believe this dependency belongs here: openembedded-core/meta/recipes-kernel/linux/kernel-devsrc.bb at master · openembedded/openembedded-core<https://github.com/openembedded/openembedded-core/blob/master/meta/recipes-kernel/linux/kernel-devsrc.bb#L460>

RDEPENDS:${PN} += "sed" in the above recipe is the right way to do it?

There should probably be a separate patch to satisfy that dependency.



Thanks,

Roshan.



________________________________
From: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Sent: Thursday, October 22, 2026 05:19
To: Roshan Sivakumar <roshs@qti.qualcomm.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: Sumanth Gavini <sumanth.gavini@windriver.com>
Subject: RE: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Roshan Sivakumar via lists.openembedded.org
> Sent: den 22 oktober 2026 10:47
> To: openembedded-core@lists.openembedded.org
> Cc: Sumanth Gavini <sumanth.gavini@windriver.com>; Roshan Sivakumar <roshs@qti.qualcomm.com>
> Subject: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator
>
> RPM 4 generated dependencies with the external __find_requires /
> __find_provides generator, which OE disabled entirely via
> _use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
> v6-format packages only the internal fileattr generators run.
>
> rpm's script.attr generator therefore runs for the first time in OE
> builds. For every packaged executable whose first line is a #! shebang
> it emits an interpreter dependency. kernel-devsrc ships
> scripts/mksysmap (#!/bin/sed -f) as an executable, so its package gains:
>
>   Requires: /bin/sed
>
> OE manages build and runtime dependencies explicitly through
> DEPENDS / RDEPENDS and does not want these. They break real use cases:

I am not sure about the explicitly part. AFAIK, installed scripts with a
#!/bin/bash shebang leads to an automatic dependency on bash. Whether it
is RPM and/or bitbake doing that, I don't know.

>
> - The interpreter path is taken verbatim from the shebang. A #!/bin/sed
>   script requires /bin/sed, but under usrmerge the only provider
>   (busybox) offers /usr/bin/sed. The literal paths never match and the
>   package becomes uninstallable.
> - In the SDK the sole interpreter providers (busybox, coreutils, bash,
>   perl) are deliberately banned by target-sdk-provides-dummy, so these
>   auto-generated requires make -dev/-src packages uninstallable during
>   do_populate_sdk ("nothing provides /bin/sed needed by kernel-devsrc").
> - The requires are non-reproducible: they are only emitted when the
>   interpreter is scanned from the shebang during packaging, so the same
>   recipe can produce different packages between the reproducible A and
>   B builds.
>
> This is the same class of regression already handled for the pkgconfig
> generator; see "rpm: disable the RPM 6 pkgconfig dependency generator".
>
> Suppressing the generator from the rpmbuild command line
> (__requires_exclude / __script_requires set to %{nil}) is not reliable:
> rpm reloads the fileattr macros during dependency generation and
> clobbers the --define. Remove script.attr and its helper script.req
> from rpm's install lists via a source patch. This changes
> do_unpack/do_patch, so the whole rpm recipe and everything downstream
> re-hash and no stale rpm-native is reused.
>
> Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com>
> ---
>  ...he-script-interpreter-dependency-gen.patch | 72 +++++++++++++++++++
>  meta/recipes-devtools/rpm/rpm_6.0.2.bb        |  1 +
>  2 files changed, 73 insertions(+)
>  create mode 100644 meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
>
> diff --git a/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
> new file mode 100644
> index 0000000000..8c3d1769c8
> --- /dev/null
> +++ b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-
> interpreter-dependency-gen.patch
> @@ -0,0 +1,72 @@
> +From: Roshan Sivakumar <roshs@qti.qualcomm.com>
> +Date: Thu, 16 Oct 2026 00:00:00 +0000
> +Subject: [PATCH] Do not install the script interpreter dependency generator
> +
> +RPM 4 generated dependencies with the external __find_requires /
> +__find_provides generator, which OE disabled entirely via
> +_use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
> +v6-format packages only the internal fileattr generators run.
> +
> +rpm's script.attr generator therefore runs for the first time in OE
> +builds. For every packaged executable whose first line is a #! shebang
> +it adds an interpreter dependency, e.g. a kernel-devsrc package shipping
> +scripts/mksysmap (#!/bin/sed -f) gains:
> +
> +  Requires: /bin/sed
> +
> +OpenEmbedded manages build and runtime dependencies explicitly via
> +DEPENDS/RDEPENDS and does not want these. They break real use cases:
> +
> +- The literal interpreter path is taken verbatim from the shebang, so a
> +  #!/bin/sed script requires /bin/sed while the only provider (busybox)
> +  offers /usr/bin/sed under usrmerge. The paths never match and the
> +  package is uninstallable.
> +- In the SDK the sole interpreter providers (busybox, coreutils, bash,
> +  perl) are deliberately banned by target-sdk-provides-dummy, so these
> +  auto-generated requires make -dev/-src packages uninstallable during
> +  do_populate_sdk ("nothing provides /bin/sed").
> +- The requires are non-reproducible: they are only emitted when the
> +  interpreter happens to be scanned from the shebang in the build
> +  sysroot, so the same recipe can produce different packages.
> +
> +This is the same class of problem fixed for pkgconfig.attr; see
> +"rpm: disable the RPM 6 pkgconfig dependency generator".
> +
> +Suppressing the generator from the rpmbuild command line is not
> +reliable: rpm reloads the fileattr macros during dependency generation
> +and clobbers any --define. Remove script.attr and its helper script.req
> +from rpm's install lists via a source patch. This changes
> +do_unpack/do_patch, so the whole rpm recipe and everything downstream
> +re-hash and no stale rpm-native is reused.
> +
> +Upstream-Status: Inappropriate [OE policy: dependencies are managed by
> the build system, not generated by rpmbuild]
> +
> +Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com>
> +---
> + fileattrs/CMakeLists.txt | 2 +-
> + scripts/CMakeLists.txt   | 2 +-
> + 2 files changed, 2 insertions(+), 2 deletions(-)
> +
> +diff --git a/fileattrs/CMakeLists.txt b/fileattrs/CMakeLists.txt
> +--- a/fileattrs/CMakeLists.txt
> ++++ b/fileattrs/CMakeLists.txt
> +@@ -1,6 +1,6 @@
> + install(FILES
> +       debuginfo.attr desktop.attr elf.attr font.attr metainfo.attr
> +       ocaml.attr
> +-      rpm_macro.attr rpm_lua.attr script.attr sysusers.attr usergroup.attr
> ++      rpm_macro.attr rpm_lua.attr sysusers.attr usergroup.attr
> +       DESTINATION ${RPM_CONFIGDIR}/fileattrs
> + )
> +diff --git a/scripts/CMakeLists.txt b/scripts/CMakeLists.txt
> +--- a/scripts/CMakeLists.txt
> ++++ b/scripts/CMakeLists.txt
> +@@ -6,7 +6,7 @@ install(PROGRAMS
> +       check-buildroot check-rpaths check-rpaths-worker
> +       find-lang.sh find-requires find-provides
> +       ocamldeps.sh
> +-      fontconfig.prov script.req
> ++      fontconfig.prov
> +       rpm_macros_provides.sh
> +       rpmdb_dump rpmdb_load
> +       rpm2cpio.sh tgpg
> diff --git a/meta/recipes-devtools/rpm/rpm_6.0.2.bb b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> index c27f58a0e8..6c80c839ca 100644
> --- a/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> +++ b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> @@ -40,6 +40,7 @@ SRC_URI = "git://github.com/rpm-software-management/rpm;protocol=https;branch=rp
>             file://0001-tools-elfdeps.cc-Remove-format-module.patch \
>             file://0001-macros.in-Set-_pkgverify_level-to-digest-as-RCPM-4.2.patch \
>             file://0003-Do-not-install-the-pkgconfig-dependency-generator.patch \
> +           file://0004-Do-not-install-the-script-interpreter-dependency-gen.patch \
>             "
>
>  PE = "1"
> --
> 2.34.1

//Peter


[-- Attachment #2: Type: text/html, Size: 13353 bytes --]

Re: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

[Roshan Sivakumar]

[-- Attachment #1: Type: text/plain, Size: 9712 bytes --]

Hi @Peter<mailto:peter.kjellerstedt@axis.com>,

Can we merge this fix and handle the dependencies using RDEPENDS in the individual recipes that need them like mentioned above?

Get Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Roshan Sivakumar via lists.openembedded.org <roshs=qti.qualcomm.com@lists.openembedded.org>
Sent: Friday, 23 October 2026 13:11:38
To: Peter Kjellerstedt <peter.kjellerstedt@axis.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: Sumanth Gavini <sumanth.gavini@windriver.com>
Subject: Re: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator


WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.

>>Replying here again since the previous reply was sent in a separate thread.

I believe this dependency belongs here: openembedded-core/meta/recipes-kernel/linux/kernel-devsrc.bb at master · openembedded/openembedded-core<https://github.com/openembedded/openembedded-core/blob/master/meta/recipes-kernel/linux/kernel-devsrc.bb#L460>

RDEPENDS:${PN} += "sed" in the above recipe is the right way to do it?

There should probably be a separate patch to satisfy that dependency.



Thanks,

Roshan.



________________________________
From: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Sent: Thursday, October 22, 2026 05:19
To: Roshan Sivakumar <roshs@qti.qualcomm.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: Sumanth Gavini <sumanth.gavini@windriver.com>
Subject: RE: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Roshan Sivakumar via lists.openembedded.org
> Sent: den 22 oktober 2026 10:47
> To: openembedded-core@lists.openembedded.org
> Cc: Sumanth Gavini <sumanth.gavini@windriver.com>; Roshan Sivakumar <roshs@qti.qualcomm.com>
> Subject: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator
>
> RPM 4 generated dependencies with the external __find_requires /
> __find_provides generator, which OE disabled entirely via
> _use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
> v6-format packages only the internal fileattr generators run.
>
> rpm's script.attr generator therefore runs for the first time in OE
> builds. For every packaged executable whose first line is a #! shebang
> it emits an interpreter dependency. kernel-devsrc ships
> scripts/mksysmap (#!/bin/sed -f) as an executable, so its package gains:
>
>   Requires: /bin/sed
>
> OE manages build and runtime dependencies explicitly through
> DEPENDS / RDEPENDS and does not want these. They break real use cases:

I am not sure about the explicitly part. AFAIK, installed scripts with a
#!/bin/bash shebang leads to an automatic dependency on bash. Whether it
is RPM and/or bitbake doing that, I don't know.

>
> - The interpreter path is taken verbatim from the shebang. A #!/bin/sed
>   script requires /bin/sed, but under usrmerge the only provider
>   (busybox) offers /usr/bin/sed. The literal paths never match and the
>   package becomes uninstallable.
> - In the SDK the sole interpreter providers (busybox, coreutils, bash,
>   perl) are deliberately banned by target-sdk-provides-dummy, so these
>   auto-generated requires make -dev/-src packages uninstallable during
>   do_populate_sdk ("nothing provides /bin/sed needed by kernel-devsrc").
> - The requires are non-reproducible: they are only emitted when the
>   interpreter is scanned from the shebang during packaging, so the same
>   recipe can produce different packages between the reproducible A and
>   B builds.
>
> This is the same class of regression already handled for the pkgconfig
> generator; see "rpm: disable the RPM 6 pkgconfig dependency generator".
>
> Suppressing the generator from the rpmbuild command line
> (__requires_exclude / __script_requires set to %{nil}) is not reliable:
> rpm reloads the fileattr macros during dependency generation and
> clobbers the --define. Remove script.attr and its helper script.req
> from rpm's install lists via a source patch. This changes
> do_unpack/do_patch, so the whole rpm recipe and everything downstream
> re-hash and no stale rpm-native is reused.
>
> Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com>
> ---
>  ...he-script-interpreter-dependency-gen.patch | 72 +++++++++++++++++++
>  meta/recipes-devtools/rpm/rpm_6.0.2.bb        |  1 +
>  2 files changed, 73 insertions(+)
>  create mode 100644 meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
>
> diff --git a/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
> new file mode 100644
> index 0000000000..8c3d1769c8
> --- /dev/null
> +++ b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-
> interpreter-dependency-gen.patch
> @@ -0,0 +1,72 @@
> +From: Roshan Sivakumar <roshs@qti.qualcomm.com>
> +Date: Thu, 16 Oct 2026 00:00:00 +0000
> +Subject: [PATCH] Do not install the script interpreter dependency generator
> +
> +RPM 4 generated dependencies with the external __find_requires /
> +__find_provides generator, which OE disabled entirely via
> +_use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
> +v6-format packages only the internal fileattr generators run.
> +
> +rpm's script.attr generator therefore runs for the first time in OE
> +builds. For every packaged executable whose first line is a #! shebang
> +it adds an interpreter dependency, e.g. a kernel-devsrc package shipping
> +scripts/mksysmap (#!/bin/sed -f) gains:
> +
> +  Requires: /bin/sed
> +
> +OpenEmbedded manages build and runtime dependencies explicitly via
> +DEPENDS/RDEPENDS and does not want these. They break real use cases:
> +
> +- The literal interpreter path is taken verbatim from the shebang, so a
> +  #!/bin/sed script requires /bin/sed while the only provider (busybox)
> +  offers /usr/bin/sed under usrmerge. The paths never match and the
> +  package is uninstallable.
> +- In the SDK the sole interpreter providers (busybox, coreutils, bash,
> +  perl) are deliberately banned by target-sdk-provides-dummy, so these
> +  auto-generated requires make -dev/-src packages uninstallable during
> +  do_populate_sdk ("nothing provides /bin/sed").
> +- The requires are non-reproducible: they are only emitted when the
> +  interpreter happens to be scanned from the shebang in the build
> +  sysroot, so the same recipe can produce different packages.
> +
> +This is the same class of problem fixed for pkgconfig.attr; see
> +"rpm: disable the RPM 6 pkgconfig dependency generator".
> +
> +Suppressing the generator from the rpmbuild command line is not
> +reliable: rpm reloads the fileattr macros during dependency generation
> +and clobbers any --define. Remove script.attr and its helper script.req
> +from rpm's install lists via a source patch. This changes
> +do_unpack/do_patch, so the whole rpm recipe and everything downstream
> +re-hash and no stale rpm-native is reused.
> +
> +Upstream-Status: Inappropriate [OE policy: dependencies are managed by
> the build system, not generated by rpmbuild]
> +
> +Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com>
> +---
> + fileattrs/CMakeLists.txt | 2 +-
> + scripts/CMakeLists.txt   | 2 +-
> + 2 files changed, 2 insertions(+), 2 deletions(-)
> +
> +diff --git a/fileattrs/CMakeLists.txt b/fileattrs/CMakeLists.txt
> +--- a/fileattrs/CMakeLists.txt
> ++++ b/fileattrs/CMakeLists.txt
> +@@ -1,6 +1,6 @@
> + install(FILES
> +       debuginfo.attr desktop.attr elf.attr font.attr metainfo.attr
> +       ocaml.attr
> +-      rpm_macro.attr rpm_lua.attr script.attr sysusers.attr usergroup.attr
> ++      rpm_macro.attr rpm_lua.attr sysusers.attr usergroup.attr
> +       DESTINATION ${RPM_CONFIGDIR}/fileattrs
> + )
> +diff --git a/scripts/CMakeLists.txt b/scripts/CMakeLists.txt
> +--- a/scripts/CMakeLists.txt
> ++++ b/scripts/CMakeLists.txt
> +@@ -6,7 +6,7 @@ install(PROGRAMS
> +       check-buildroot check-rpaths check-rpaths-worker
> +       find-lang.sh find-requires find-provides
> +       ocamldeps.sh
> +-      fontconfig.prov script.req
> ++      fontconfig.prov
> +       rpm_macros_provides.sh
> +       rpmdb_dump rpmdb_load
> +       rpm2cpio.sh tgpg
> diff --git a/meta/recipes-devtools/rpm/rpm_6.0.2.bb b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> index c27f58a0e8..6c80c839ca 100644
> --- a/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> +++ b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> @@ -40,6 +40,7 @@ SRC_URI = "git://github.com/rpm-software-management/rpm;protocol=https;branch=rp
>             file://0001-tools-elfdeps.cc-Remove-format-module.patch \
>             file://0001-macros.in-Set-_pkgverify_level-to-digest-as-RCPM-4.2.patch \
>             file://0003-Do-not-install-the-pkgconfig-dependency-generator.patch \
> +           file://0004-Do-not-install-the-script-interpreter-dependency-gen.patch \
>             "
>
>  PE = "1"
> --
> 2.34.1

//Peter


[-- Attachment #2: Type: text/html, Size: 16054 bytes --]

RE: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

[Peter Kjellerstedt]

[-- Attachment #1: Type: text/plain, Size: 11576 bytes --]

Well, I just feel that we are removing an existing feature if we do. It may be that it is only present when using DNF and RPM to generate the images (which we do), as I do not know whether the other packaging formats support dependencies on files. On the other hand, these kind of dependencies are often missed when adding them manually so if we are removing them from DNF/RPM, I think it would be more appropriate if bitbake detected them automatically, just like it automatically detects runtime dependencies for dynamic libraries.

//Peter

From: Roshan Sivakumar <roshs@qti.qualcomm.com>
Sent: den 25 oktober 2026 14:49
To: Peter Kjellerstedt <peter.kjellerstedt@axis.com>; openembedded-core@lists.openembedded.org
Cc: Sumanth Gavini <sumanth.gavini@windriver.com>
Subject: Re: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

You don't often get email from roshs@qti.qualcomm.com<mailto:roshs@qti.qualcomm.com>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
Hi @Peter<mailto:peter.kjellerstedt@axis.com>,

Can we merge this fix and handle the dependencies using RDEPENDS in the individual recipes that need them like mentioned above?

Get Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org> <openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org>> on behalf of Roshan Sivakumar via lists.openembedded.org <roshs=qti.qualcomm.com@lists.openembedded.org<mailto:roshs=qti.qualcomm.com@lists.openembedded.org>>
Sent: Friday, 23 October 2026 13:11:38
To: Peter Kjellerstedt <peter.kjellerstedt@axis.com<mailto:peter.kjellerstedt@axis.com>>; openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org> <openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org>>
Cc: Sumanth Gavini <sumanth.gavini@windriver.com<mailto:sumanth.gavini@windriver.com>>
Subject: Re: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator


WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.
>>Replying here again since the previous reply was sent in a separate thread.

I believe this dependency belongs here: openembedded-core/meta/recipes-kernel/linux/kernel-devsrc.bb at master * openembedded/openembedded-core<https://github.com/openembedded/openembedded-core/blob/master/meta/recipes-kernel/linux/kernel-devsrc.bb#L460>

RDEPENDS:${PN} += "sed" in the above recipe is the right way to do it?

There should probably be a separate patch to satisfy that dependency.



Thanks,

Roshan.



________________________________
From: Peter Kjellerstedt <peter.kjellerstedt@axis.com<mailto:peter.kjellerstedt@axis.com>>
Sent: Thursday, October 22, 2026 05:19
To: Roshan Sivakumar <roshs@qti.qualcomm.com<mailto:roshs@qti.qualcomm.com>>; openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org> <openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org>>
Cc: Sumanth Gavini <sumanth.gavini@windriver.com<mailto:sumanth.gavini@windriver.com>>
Subject: RE: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org> <openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org>> On Behalf Of Roshan Sivakumar via lists.openembedded.org
> Sent: den 22 oktober 2026 10:47
> To: openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org>
> Cc: Sumanth Gavini <sumanth.gavini@windriver.com<mailto:sumanth.gavini@windriver.com>>; Roshan Sivakumar <roshs@qti.qualcomm.com<mailto:roshs@qti.qualcomm.com>>
> Subject: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator
>
> RPM 4 generated dependencies with the external __find_requires /
> __find_provides generator, which OE disabled entirely via
> _use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
> v6-format packages only the internal fileattr generators run.
>
> rpm's script.attr generator therefore runs for the first time in OE
> builds. For every packaged executable whose first line is a #! shebang
> it emits an interpreter dependency. kernel-devsrc ships
> scripts/mksysmap (#!/bin/sed -f) as an executable, so its package gains:
>
>   Requires: /bin/sed
>
> OE manages build and runtime dependencies explicitly through
> DEPENDS / RDEPENDS and does not want these. They break real use cases:

I am not sure about the explicitly part. AFAIK, installed scripts with a
#!/bin/bash shebang leads to an automatic dependency on bash. Whether it
is RPM and/or bitbake doing that, I don't know.

>
> - The interpreter path is taken verbatim from the shebang. A #!/bin/sed
>   script requires /bin/sed, but under usrmerge the only provider
>   (busybox) offers /usr/bin/sed. The literal paths never match and the
>   package becomes uninstallable.
> - In the SDK the sole interpreter providers (busybox, coreutils, bash,
>   perl) are deliberately banned by target-sdk-provides-dummy, so these
>   auto-generated requires make -dev/-src packages uninstallable during
>   do_populate_sdk ("nothing provides /bin/sed needed by kernel-devsrc").
> - The requires are non-reproducible: they are only emitted when the
>   interpreter is scanned from the shebang during packaging, so the same
>   recipe can produce different packages between the reproducible A and
>   B builds.
>
> This is the same class of regression already handled for the pkgconfig
> generator; see "rpm: disable the RPM 6 pkgconfig dependency generator".
>
> Suppressing the generator from the rpmbuild command line
> (__requires_exclude / __script_requires set to %{nil}) is not reliable:
> rpm reloads the fileattr macros during dependency generation and
> clobbers the --define. Remove script.attr and its helper script.req
> from rpm's install lists via a source patch. This changes
> do_unpack/do_patch, so the whole rpm recipe and everything downstream
> re-hash and no stale rpm-native is reused.
>
> Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com<mailto:roshs@qti.qualcomm.com>>
> ---
>  ...he-script-interpreter-dependency-gen.patch | 72 +++++++++++++++++++
>  meta/recipes-devtools/rpm/rpm_6.0.2.bb        |  1 +
>  2 files changed, 73 insertions(+)
>  create mode 100644 meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
>
> diff --git a/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-interpreter-dependency-gen.patch
> new file mode 100644
> index 0000000000..8c3d1769c8
> --- /dev/null
> +++ b/meta/recipes-devtools/rpm/files/0004-Do-not-install-the-script-
> interpreter-dependency-gen.patch
> @@ -0,0 +1,72 @@
> +From: Roshan Sivakumar <roshs@qti.qualcomm.com<mailto:roshs@qti.qualcomm.com>>
> +Date: Thu, 16 Oct 2026 00:00:00 +0000
> +Subject: [PATCH] Do not install the script interpreter dependency generator
> +
> +RPM 4 generated dependencies with the external __find_requires /
> +__find_provides generator, which OE disabled entirely via
> +_use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
> +v6-format packages only the internal fileattr generators run.
> +
> +rpm's script.attr generator therefore runs for the first time in OE
> +builds. For every packaged executable whose first line is a #! shebang
> +it adds an interpreter dependency, e.g. a kernel-devsrc package shipping
> +scripts/mksysmap (#!/bin/sed -f) gains:
> +
> +  Requires: /bin/sed
> +
> +OpenEmbedded manages build and runtime dependencies explicitly via
> +DEPENDS/RDEPENDS and does not want these. They break real use cases:
> +
> +- The literal interpreter path is taken verbatim from the shebang, so a
> +  #!/bin/sed script requires /bin/sed while the only provider (busybox)
> +  offers /usr/bin/sed under usrmerge. The paths never match and the
> +  package is uninstallable.
> +- In the SDK the sole interpreter providers (busybox, coreutils, bash,
> +  perl) are deliberately banned by target-sdk-provides-dummy, so these
> +  auto-generated requires make -dev/-src packages uninstallable during
> +  do_populate_sdk ("nothing provides /bin/sed").
> +- The requires are non-reproducible: they are only emitted when the
> +  interpreter happens to be scanned from the shebang in the build
> +  sysroot, so the same recipe can produce different packages.
> +
> +This is the same class of problem fixed for pkgconfig.attr; see
> +"rpm: disable the RPM 6 pkgconfig dependency generator".
> +
> +Suppressing the generator from the rpmbuild command line is not
> +reliable: rpm reloads the fileattr macros during dependency generation
> +and clobbers any --define. Remove script.attr and its helper script.req
> +from rpm's install lists via a source patch. This changes
> +do_unpack/do_patch, so the whole rpm recipe and everything downstream
> +re-hash and no stale rpm-native is reused.
> +
> +Upstream-Status: Inappropriate [OE policy: dependencies are managed by
> the build system, not generated by rpmbuild]
> +
> +Signed-off-by: Roshan Sivakumar <roshs@qti.qualcomm.com<mailto:roshs@qti.qualcomm.com>>
> +---
> + fileattrs/CMakeLists.txt | 2 +-
> + scripts/CMakeLists.txt   | 2 +-
> + 2 files changed, 2 insertions(+), 2 deletions(-)
> +
> +diff --git a/fileattrs/CMakeLists.txt b/fileattrs/CMakeLists.txt
> +--- a/fileattrs/CMakeLists.txt
> ++++ b/fileattrs/CMakeLists.txt
> +@@ -1,6 +1,6 @@
> + install(FILES
> +       debuginfo.attr desktop.attr elf.attr font.attr metainfo.attr
> +       ocaml.attr
> +-      rpm_macro.attr rpm_lua.attr script.attr sysusers.attr usergroup.attr
> ++      rpm_macro.attr rpm_lua.attr sysusers.attr usergroup.attr
> +       DESTINATION ${RPM_CONFIGDIR}/fileattrs
> + )
> +diff --git a/scripts/CMakeLists.txt b/scripts/CMakeLists.txt
> +--- a/scripts/CMakeLists.txt
> ++++ b/scripts/CMakeLists.txt
> +@@ -6,7 +6,7 @@ install(PROGRAMS
> +       check-buildroot check-rpaths check-rpaths-worker
> +       find-lang.sh find-requires find-provides
> +       ocamldeps.sh
> +-      fontconfig.prov script.req
> ++      fontconfig.prov
> +       rpm_macros_provides.sh
> +       rpmdb_dump rpmdb_load
> +       rpm2cpio.sh tgpg
> diff --git a/meta/recipes-devtools/rpm/rpm_6.0.2.bb b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> index c27f58a0e8..6c80c839ca 100644
> --- a/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> +++ b/meta/recipes-devtools/rpm/rpm_6.0.2.bb
> @@ -40,6 +40,7 @@ SRC_URI = "git://github.com/rpm-software-management/rpm;protocol=https;branch=rp
>             file://0001-tools-elfdeps.cc-Remove-format-module.patch \
>             file://0001-macros.in-Set-_pkgverify_level-to-digest-as-RCPM-4.2.patch \
>             file://0003-Do-not-install-the-pkgconfig-dependency-generator.patch \
> +           file://0004-Do-not-install-the-script-interpreter-dependency-gen.patch \
>             "
>
>  PE = "1"
> --
> 2.34.1

//Peter

[-- Attachment #2: Type: text/html, Size: 23845 bytes --]

Re: [PATCH] rpm: disable the RPM 6 script interpreter dependency generator

[Roshan Sivakumar]

[-- Attachment #1: Type: text/plain, Size: 407 bytes --]

I believe this dependency belongs here: openembedded-core/meta/recipes-kernel/linux/kernel-devsrc.bb at master · openembedded/openembedded-core ( https://github.com/openembedded/openembedded-core/blob/master/meta/recipes-kernel/linux/kernel-devsrc.bb#L460 )

RDEPENDS:${PN} += "sed" in the above recipe is the right way to do it?

There should probably be a separate patch to satisfy that dependency.

[-- Attachment #2: Type: text/html, Size: 5699 bytes --]

Re: [OE-core][PATCH] rpm: disable the RPM 6 script interpreter dependency generator

[Alexander Kanavin]

[-- Attachment #1: Type: text/plain, Size: 3193 bytes --]

On Thu, 22 Oct 2026 at 12:12, Roshan Sivakumar via lists.openembedded.org
<roshs=qti.qualcomm.com@lists.openembedded.org> wrote:

> RPM 4 generated dependencies with the external __find_requires /
> __find_provides generator, which OE disabled entirely via
> _use_internal_dependency_generator 0. RPM 6 removed that mechanism; for
> v6-format packages only the internal fileattr generators run.
>

I don't understand. What was enabled in rpm 4 and what was not? What ran
and what didn't? The above seems to say that rpm 4 used external generator,
which was disabled by oe, but then the disabling statement refers to
internal generator.


> rpm's script.attr generator therefore runs for the first time in OE
> builds. For every packaged executable whose first line is a #! shebang
> it emits an interpreter dependency. kernel-devsrc ships
> scripts/mksysmap (#!/bin/sed -f) as an executable, so its package gains:
>
>   Requires: /bin/sed
>
> OE manages build and runtime dependencies explicitly through
> DEPENDS / RDEPENDS and does not want these. They break real use cases:
>
> - The interpreter path is taken verbatim from the shebang. A #!/bin/sed
>   script requires /bin/sed, but under usrmerge the only provider
>   (busybox) offers /usr/bin/sed. The literal paths never match and the
>   package becomes uninstallable.
>

But if the script in a target package refers to /bin/sed, and the target
root filesystem is not providing that, then the problem is not with the
dependency checker, it's with the script and/or filesystem layout.
Disabling the check does not address that problem, it just sweeps it under
the carpet. Am I missing something? How does this work on Fedora for
example, which also uses usrmerge?


> - In the SDK the sole interpreter providers (busybox, coreutils, bash,
>   perl) are deliberately banned by target-sdk-provides-dummy, so these
>   auto-generated requires make -dev/-src packages uninstallable during
>   do_populate_sdk ("nothing provides /bin/sed needed by kernel-devsrc").
>

This probably needs steps to reproduce, so we can better understand the
issue.


> - The requires are non-reproducible: they are only emitted when the
>   interpreter is scanned from the shebang during packaging, so the same
>   recipe can produce different packages between the reproducible A and
>   B builds.
>

I also don't understand this. How does the non-reproducibility happen
exactly? Why would it produce different requires?


> This is the same class of regression already handled for the pkgconfig
> generator; see "rpm: disable the RPM 6 pkgconfig dependency generator".
>

There was also a concern during patch review that the checks that the
generator does are useful to catch missing runtime dependencies in recipes,
and disabling this would regress the packaging quality. Something like this
checker should be made generic (e.g. run in do_package, regardless of
specific packaging backend). How does this check work exactly, and where is
it implemented? Do we have an equivalent in do_package (I vaguely remember
that we do)? If there's an equivalent, then why it doesn't complain but the
rpm-specific check does?

This needs further investigation.

Alex

[-- Attachment #2: Type: text/html, Size: 4414 bytes --]