packaging-committee

#1519 Fedora should adopt the position that versioned symbols are strongly encouraged, and actively work to add them upstream
Opened by gordonmessmer. Modified

Open
Close Issue

https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/37JJ2HCTGF3E5WQUHZ55LK3VZUJ3YPBN/

In a recent thread on devel@, Neal suggested that I bring this issue to the packaging committee.

Most shared libraries in Fedora do not provide versioned symbols. RPM will generate a dependency expression for those libraries that effectively only includes the soname. e.g.: "Requires: libcairo.so.2()(64bit)" Without further detail, this implies that "libcairo.so version 2.0.0" is sufficient.

Without at least a minor version in the dependency expression, operations like "dnf install ", "dnf update " or "dnf update --security" could result the installed software being non-functional. If shared libraries are made non-functional, then the applications that use them will also fail to start, so these failures could break gdm or dnf and make it difficult to resolve the problem.

It is likely that one of the reasons that these problems are not more frequent is that hundreds of package maintainers are aware of the problem and work around RPM's deficiency by manually creating more specific dependencies, and those packages may have the effect of forcing some of the problematic libraries to update.

[gordon@... rpm-specs]$ grep -r -E '^Requires:\s*lib.*>=' .| grep -v '{version}' | cut -f1 -d: | uniq | wc -l
267

While I think that RPM should implement a better dependency generator for those libraries, the binutils documention encourages developers to use versioned symbols, stating: "symbol versioning is in effect a much more sophisticated way of doing minor version checking"

I've written a short document describing how versioned symbols can be added to a project:

https://codeberg.org/gordonmessmer/dev-blog/src/branch/main/using-versioned-symbols.md

...and a simple project that demonstrates their use:

https://codeberg.org/gordonmessmer/libfoo-versioned

We would want to provide additional examples of how build scripts can be modified to add the -Wl,--version-script=libFoo.map argument, but the entire process should be simple enough for any maintainer to suggest to upstream projects along with a PR.

This sounds great. +1

Do you have a particular proposal for the packaging guidelines? A pull request to the guidelines to integrate this would be appreciated.

I have a draft here, but it needs examples for more types of build systems.

https://pagure.io/packaging-committee/pull-request/1520

The guidelines should probably also explain how packagers verify if the packaged library uses versioned symbols.

I'll drop in to the meeting tomorrow again in case there are any questions or requests for me.

It would be great if we could agree that Fedora recommends versioned symbols for the purpose of dependency generation, and recommends that packagers ask upstream projects to provide them. (Fedora already recommends versioned symbols, but rationalizes this as a way to allow otherwise breaking changes in a stable SONAME, which most projects do not require.)

Some of the specifics can be improved in follow-up PRs:

The build system examples might be too large for the existing page, and maybe those should have a page of their own.

It is likely that a FAQ for the topic would be helpful. That doc would probably undergo a lot of edits, especially for the first projects that we approach.

A demo project is available at https://github.com/gordonmessmer/libFoo, but this should be hosted by Fedora and not by me.

First PR is merged, we talked a lot about it and a bunch of people seem to want improvements ... so maybe many more PRs, and leaving this issue open for the moment.
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.