pkg/54110: textproc/xindy hidden dependencies

[jdbaker%consolidated.net@localhost]

>Number:         54110
>Category:       pkg
>Synopsis:       textproc/xindy hidden dependencies
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          support
>Submitter-Id:   net
>Arrival-Date:   Tue Apr 09 15:00:00 +0000 2019
>Originator:     John D. Baker
>Release:        NetBSD/amd64-8.0_STABLE, pkgsrc-2019Q1
>Organization:
>Environment:
NetBSD plex760.technoskunk.fur 8.0_STABLE NetBSD 8.0_STABLE (PLEX760) #88: Fri Apr  5 17:22:11 CDT 2019  sysop%plex760.technoskunk.fur@localhost:/r0/build/netbsd-8/obj/amd64/sys/arch/amd64/compile/PLEX760 amd64
>Description:
As first mentioned here:

  http://mail-index.netbsd.org/tech-pkg/2019/04/06/msg021089.html

"textproc/xindy" has dependencie on the following libraries:

  /usr/pkg/lib/libavcall.so.1
  /usr/pkg/lib/libcallback.so.1
  /usr/pkg/lib/libreadline.so.8
  /usr/pkg/lib/libsigsegv.so.2

which correspond to the following packages:


  devel/readline
  devel/libffcall
  devel/libsigsegv

yet "textproc/xindy" does not register a dependency on these packages.
As such, it is possible to uninstall/pkg_delete these packages out
from under "textproc/xindy", or fail to install them when using
binary packages on another host.

(Well, as so many things require "readline" this is unlikely, but
"libffcall" and "libsigsegv" were only installed as a dependency of
"lang/clisp", which is needed to build "xindy" so they would not
be installed on any host using binary packages that did not explicitly
install "clisp".)

The unrecorded dependency on "readline" was found because it wanted
an obsolete version (readline.so.7) after packages were updated to
pkgsrc-2019Q1 (readline.so.8).

>How-To-Repeat:
Build "textproc/xindy".
Recursively delete "lang/clisp" (pkg_delete -R clisp).
Examine "/usr/pkg/bin/xindy.run" with 'ldd' and note unresolved
linkages ("-lfoo* not found")
>Fix:
Explicit DEPENDS+= in the Makefile?
Include bl3 of readline, libffcall, libsigsegv?
Which?