[cap-talk] Application dependencies (was More Heresy: ACLs not inherently bad)

[David-Sarah Hopwood]

Jonathan S. Shapiro wrote:
> On Fri, 2008-09-12 at 09:40 +0100, Toby Murray wrote:
>> The way to start is to just install the software and all of its stated
>> dependencies into the same namespace.
> 
> This assumes that the dependency set is fixed

The description given to the installer would only include the app's static
dependency set; dynamic dependencies are granted via powerboxes.

> and that application
> authors know their dependencies and will state them. Once gravity is
> suspended, FTL travel becomes straightforward. Anybody who packages
> things with RPM can tell you from experience that app authors generally
> have no freaking clue what their dependencies are.

That's because an RPM-packaged app will still work even if its dependencies
are declared incorrectly, provided that the actual dependencies are
installed on the machines on which it is tested.

If only the declared dependencies are actually accessible in the app's
namespace, then there's no way to make this mistake: the app will break
immediately if a required dependency is not declared, even if it is
installed on the developer's machine. That means developers are forced
to add each dependency as soon as they start relying on it.

(It is still possible to declare unnecessary dependencies. But there is
an incentive not to since that will cause the app to fail to install on
more machines. Also, it is easy for an automated tool to detect
declared dependencies that are not used on a test run.)

-- 
David-Sarah Hopwood