4 ms·

Author here, and I am also a Gentoo user on my daily driver. I read that article when it came out, and it felt disingenuous. mgorny helps maintain Gentoo, whi

Author here, and I am also a Gentoo user on my daily driver. I read that article when it came out, and it felt disingenuous. mgorny helps maintain Gentoo, which of all distributions, does rebuild software as necessary. It would be a simple change to portage to rebuild all dependencies of a library when that library is updated, regardless of if the user uses static linking or not. In fact, there is a project to have a statically-linked musl-based Gentoo. So it's possible and (I would argue) would be an easy change. mgorny would not have to worry about much because he could, in essence, treat all libraries as dynamic libraries. The only pain to be felt would be by users who would see their build times increase (to rebuild dependents). As a user, I would happily take that tradeoff. I already build my browser, which takes 5-8 hours; I'll happily rebuild dependents of updated libraries.

stefantalpalaru 5y ago
> It would be a simple change to portage to rebuild all dependencies of a library when that library is updated No change needed. It can already be done with the special ":=" dependency slot: https://devmanual.gentoo.org/general-concepts/dependencies/#slot-operators https://devmanual.gentoo.org/general-concepts/dependencies/#...
AshamedCaptain 5y ago
> I already build my browser, which takes 5-8 hours; I'll happily rebuild dependents of updated libraries This is ridiculous. I most definitely do NOT want to rebuild literally EVERY SINGLE PACKAGE on my system the moment they fix a typo in libz. With static linking literally every other Gentoo upgrade becomes a world rebuild. See Nix. It is just insane and the main reason I don't use NixOS (without a 3rd party binary cache/host) for anything other than very small systems.
- ghoward 5y ago
  > This is ridiculous. I most definitely do NOT want to rebuild literally EVERY SINGLE PACKAGE on my system the moment they fix a typo in libz. I understand. You don't. I do. What my post is arguing for is not one or the other, but giving the user the choice. I think you would be okay with making the choice of not rebuilding everything, and I would make the opposite choice. I want to live in a world where we can both choose.
  - AshamedCaptain 5y ago
    But you can already rebuild the entire world on every package change if you want (for sadomasochistic reasons? it basically makes gentoo with say KDE _unusable_); and I fail to see if there would be any practical difference on whether you statically link, you dynamically link to a hash-based soname a la nix, or you dynamically link -- you are just rebuilding everything on every library change, and you are already assuming ASLR is useless.
mst 5y ago
> It would be a simple change to portage to rebuild all dependencies of a library when that library is updated I believe e.g. freebsd's portmaster takes a -r switch to mean "rebuild this and all its dependents" (I presume you meant revdeps here), which gets you quite a long way.

stefantalpalaru 5y ago

> It would be a simple change to portage to rebuild all dependencies of a library when that library is updated No change needed. It can already be done with the special ":=" dependency slot: https://devmanual.gentoo.org/general-concepts/dependencies/#slot-operators https://devmanual.gentoo.org/general-concepts/dependencies/#...

AshamedCaptain 5y ago

> I already build my browser, which takes 5-8 hours; I'll happily rebuild dependents of updated libraries This is ridiculous. I most definitely do NOT want to rebuild literally EVERY SINGLE PACKAGE on my system the moment they fix a typo in libz. With static linking literally every other Gentoo upgrade becomes a world rebuild. See Nix. It is just insane and the main reason I don't use NixOS (without a 3rd party binary cache/host) for anything other than very small systems.

ghoward 5y ago
> This is ridiculous. I most definitely do NOT want to rebuild literally EVERY SINGLE PACKAGE on my system the moment they fix a typo in libz. I understand. You don't. I do. What my post is arguing for is not one or the other, but giving the user the choice. I think you would be okay with making the choice of not rebuilding everything, and I would make the opposite choice. I want to live in a world where we can both choose.
- AshamedCaptain 5y ago
  But you can already rebuild the entire world on every package change if you want (for sadomasochistic reasons? it basically makes gentoo with say KDE _unusable_); and I fail to see if there would be any practical difference on whether you statically link, you dynamically link to a hash-based soname a la nix, or you dynamically link -- you are just rebuilding everything on every library change, and you are already assuming ASLR is useless.

mst 5y ago

> It would be a simple change to portage to rebuild all dependencies of a library when that library is updated I believe e.g. freebsd's portmaster takes a -r switch to mean "rebuild this and all its dependents" (I presume you meant revdeps here), which gets you quite a long way.