[php-maint] On php dependencies and lintian errors

[Antonio Ospite]

On Thu, 17 Mar 2016 21:09:34 +0100
Ondřej Surý <ondrej at sury.org> wrote:

> > > Every package with multiple extensions (with a grain of salt) now also
> > > have correct "Provides" for every extension inside, so you can even use
> > > that to finetune the dependencies.
> > >
> > 
> > Does that mean that lintian should allow both the php-* deps, which are
> > the recommended ones, and the phpX-* ones, which can be used for version
> > specific tuning?
> 
> I can't really think of package that would really need that, so I would
> suggest doing something like this:
>

Just to clarify, when I asked if lintian should allow _both_ forms,
I was still assuming that packages would use _either_ one _or_ the
other.

> E: php5-<foo>
> W: phpX.Y-<foo>
> 

Makes sense, but maybe we are going ahead of ourselves.

Here's an first draft of a possible bug report for lintian.

----------------------------------------------------------------------

Subject: fix the php-script-but-no-phpX-cli-dep error

Dear [lintian] Maintainer,

currently lintian fails with this error when a package specifies PHP
dependencies (in particular php-cli) without a version number:

E: tweeper: php-script-but-no-phpX-cli-dep usr/share/php/tweeper/tweeper
N: 
N:    Packages with PHP scripts must depend on a phpX-cli package such as
N:    php5-cli. Note that a dependency on a php-cgi package (such as php5-cgi)
N:    is needlessly strict and forces the user to install a package that isn't
N:    needed.
N:    
N:    In some cases a weaker relationship, such as Suggests or Recommends,
N:    will be more appropriate.
N:    
N:    Lintian can only recognize phpX-cli dependencies for values of X that it
N:    knows are available in the archive. You will get this warning if you
N:    allow, as alternatives, versions of PHP that are so old they're not
N:    available in stable. The correct fix in those cases is probably to drop
N:    the old alternative. If this package depends on a newer php-cli package
N:    that Lintian doesn't know about, please file a bug against Lintian so
N:    that it can be updated.
N:    
N:    Severity: important, Certainty: certain
N:    
N:    Check: scripts, Type: binary


However the PHP package maintainers recommend[1] just the opposite: to
have PHP dependencies without specifying the PHP version explicitly,
i.e.:

  Depends: php-cli, php-curl, php-xsl

instead of:

  Depends: php5-cli, php5-curl, php5-xsl

This is a safe thing to do considering that each Debian stable version
is going to ship with only one version of PHP.

So the lintian error should only trigger when the php-cli dependency is
missing, regardless of the PHP version number, the error could read like
this:

E: tweeper: php-script-but-no-php-cli-dep usr/share/php/tweeper/tweeper
N: 
N:    Packages with PHP scripts must depend on a php-cli package.
N:    Note that a dependency on a php-cgi package (such as php5-cgi) is
N:    needlessly strict and forces the user to install a package that isn't
N:    needed.
N:    
N:    In some cases a weaker relationship, such as Suggests or Recommends,
N:    will be more appropriate.
N:    
N:    Severity: important, Certainty: certain
N:    
N:    Check: scripts, Type: binary


[1] http://lists.alioth.debian.org/pipermail/pkg-php-maint/2016-March/015201.html

----------------------------------------------------------------------

This just tackles the particular issue I was facing, which I think is
quite important; adding errors for older versions and warnings for
dependencies with version numbers is a lot less urgent.

BTW I think that you PHP maintainers should file the bug report
yourselves because you can react more quickly to questions from the
lintian maintainers.

Thanks,
   Antonio

-- 
Antonio Ospite
http://ao2.it

A: Because it messes up the order in which people normally read text.
   See http://en.wikipedia.org/wiki/Posting_style
Q: Why is top-posting such a bad thing?