Re: security/clamav: Makefile patch (dependencies for archivers/xz, converters/libiconv, textproc/libxml2)

[Matthias Ferdinand <mf+ml.pkgsrc-users%netzwerkagentursaarland.de@localhost>]

On Wed, May 07, 2014 at 05:25:18PM +0100, Jonathan Perkin wrote:
> * On 2014-05-07 at 17:20 BST, Matthias Ferdinand wrote:
> 
> > the Makefile for security/clamav is missing some buildlink-includes for
> > dependencies. This can lead to failure on systems with no native
> > libxml2, when e.g. pkgin does not pull in libxml2 from pkgsrc.
> 
> Could you show the failures please?  I do not see this on SmartOS,
> where we do not provide any native implementations of these libraries,
> so I'd like to know if there is some functionality we are missing out
> on.

Then you probably have a current libxml2 from pkgsrc (or maybe clamav
does only use libxml2 if it can find it on the build host?).

If you install the clamav binary package on a host with neither native
nor pkgsrc version of libxml2, the binaries just don't start:

    # /opt/pkgsrc/bin/freshclam --verbose
    /opt/pkgsrc/bin/freshclam: error while loading shared libraries: 
libxml2.so.2: cannot open shared object file: No such file or directory

On another system with a very old native libxml2, the linker complained
about missing version numbers in the .so files, and ldd showed that it
was using the native version (on a Linux system >7 years old, not
getting any updates anymore besides pkgsrc).

Without the dependency noted in the binary package, pkgin does not pull
in libxml2 from the archive. In theory this might even result in a
security problem (it's probably not, depends on how and where exactly
clamav uses libxml2).

Regards
Matthias