Broken implicit DEPENDS?

[Jonathan Perkin <jperkin%mnx.io@localhost>]

I was alerted to a problem by a user who was installing nodejs, and then 
running into:

  ld.so.1: node: fatal: libintl.so.8: open failed: No such file or directory

This immediately struck me as odd, given our strict check-shlibs 
infrastructure that should catch problems like this and ensure we don't 
ship broken packages.

However, I was able to reproduce it.  Looking closer at check-shlibs I 
found the problem, where if the dependency wasn't explicit but instead 
implicit via other dependencies, it isn't listed in rrdepends and so the 
test passes even though the library is left unresolved.

I "fixed" check-shlibs with the following change:

  https://gist.github.com/jperkin/a9b7cb963a9649cc8b7371700b2692db

but when running with it in a limited bulk build, there is a huge amount 
of fallout!

  https://us-central.manta.mnx.io/pkgsrc/public/reports/trunk/tools/20231116.1528/meta/report.html

I fear that this isn't going to be a simple one to solve.  Adding 
implicit dependencies to the full dependency list is going to increase 
them significantly, and not all of them will be necessary.  Adding 
explicit dependencies to packages isn't ideal either, as we are then 
effectively duplicating dependency logic, and makes maintenance 
significantly harder.

I have a feeling, based on the "Not yet" comments in check-shlibs, that 
others have already been along this path, and so I wanted to get some 
input here first before delving too far into the rabbit hole.  However, 
it's pretty scary that we are currently shipping so many effectively 
broken packages right now, that are only working due to the user 
happening to have the dependencies installed via some other path.

Thanks,

--
Jonathan Perkin   -   mnx.io   -   pkgsrc.smartos.org
Open Source Complete Cloud   www.tritondatacenter.com