Spidermonkey? More like King Kong!

Goverp · Advocate Joined: 07 Mar 2007 Posts: 2007

I've just had the privilege of upgrading spidermonkey, mainly for polkit. As the merge fell over first time (by default I use tmpfs for work, and it ate it all), I actually read the output for once. Wow, in their desire to get a full function scripting language (other than bash, which would be too easy), the polkit devs have stuffed my system with half a gigabyte of spidermonkey. Is this someone's idea of a practical joke?

I suppose they had to use Javascript, 'cos it's not like linux has any other scripting languages. Sheesh!

micmac · l33t Joined: 28 Nov 2003 Posts: 996

My thought exactly :lol:

Zucca · Posted: Thu Jul 04, 2019 9:06 pm Post subject:

I too discovered this horror few days ago.

Now I'm considering getting rid of polkit.
_________________
..: Zucca :..
Gentoo IRC channels reside on Libera.Chat.
--

fpemud · Guru Joined: 15 Feb 2012 Posts: 349

I'm interested in this too.

Seriously, what kind of system needs sys-auth/polkit as a necessary component?
Is it only useful on enterprise scenario?
Any use case example?

I have never touched sys-auth/polkit myself.
Is it really doing any non-trivial task from time to time so that my system is silently protected?

Zucca · Posted: Fri Jul 05, 2019 11:02 am Post subject:

USE="-policykit" might do the job.
_________________
..: Zucca :..
Gentoo IRC channels reside on Libera.Chat.
--

Zucca · Posted: Fri Jul 05, 2019 11:30 am Post subject:

Chiitoo · Posted: Fri Jul 05, 2019 12:38 pm Post subject: ><)))°€

I've been running without PolKit and friends since... 2010 or thereabouts.

It can be challenging when using KDE and the likes, and may require more or/and less hackery while also losing support from upstream. The absence of USE-flags for them is usually due to that same upstream reasoning.

Without them, one will usually lose things such as automount, and the ability for a regular user to poweroff/reboot.
_________________
Kindest of regardses.

Zucca · Posted: Fri Jul 05, 2019 1:34 pm Post subject: Re: ><)))°€

Zucca · Posted: Fri Jul 05, 2019 6:56 pm Post subject:

Well... I think I changed my mind. :P polkit is needed for swayidle to work. Dang it.

I'll then try to relearn some javascript if needed. :|
_________________
..: Zucca :..
Gentoo IRC channels reside on Libera.Chat.
--

Goverp · Advocate Joined: 07 Mar 2007 Posts: 2007

KDE has polkit as a dependency of plasma-meta. There seem to be no code settings associated, and typically KDE seems to use whatever's available, so I might try just removing it and see what breaks. Presumably kde-plasma/polkit-kde-agent is the only bit that matters - perhaps it's possible to fork an epolkit-kde-agent that just applies normal Unix security.

IIUC polkit and the kde component(s) that talk to it are a way of overcomplicating access to programs that used to be controlled by group membership and setuid; have a pool of privileged processes taking commands over dbus, and polkit filtering the commands sent from the user. It sounds a bit of a recipe for security flaws, even before Javascript terminally muddied the waters.

One of my coding rules of thumb is "a object-oriented design containing a Manager object is broken". That's 'cos object should manage themselves. Similarly in this case, "kit" means a bunch of code and stuff that ought to be in other places. "Policy" wonks are just politicians, and who needs that in code. Dodgy naming usually means dodgy concepts, leading to dodgy code.
_________________
Greybeard

Zucca · Posted: Sat Jul 06, 2019 11:18 am Post subject:

IMO we'd need a polkit replacement. A completely different in almost any other way but keeping the same dbus API. That way we could have a simple configuration syntax while being a replacement which does not require any additional support from the programs.

I think good configuration file is something like toml or ini and, of course, simple shell script with variable=value pairs.

Also. @Goverp: I wonder how did your installation got that half a gigabyte? O.o

tld · Veteran Joined: 09 Dec 2003 Posts: 1816

Holy crap. Reading this makes me really glad I abandoned all that (including KDE, in favor of just using fluxbox) a long time ago. Are they actually requiring spidermonkey just for configuration parsing? If so they're clearly smoking the same stuff as Microsoft...talk about gross over-engineering.

The trend toward bloat and over-engineering gets worse daily it seems, and almost without exception it seems to be coming from either the freedesktop.org and/or the Mozilla direction. All of that gets 10000x worse in a non-binary distribution, because you need all the programming languages...and you tend to realize, much more so than users of binary distros, just how bad things have gotten. Hell...I have to stick with mail-client/thunderbird-52.9 until I can find a decent replacement, because 60.x requires fucking clang and rust in addition to countless other crap I don't want. I almost couldn't believe the size of the rust source. Assuming I even had the resources (RAM etc) to compile it on my system I think it would take a week if I were lucky.

Sorry for the semi-OT rant, but this Microsoftification of the Linux world has really gotten to me. Worse yet I just got done ranting on an article about how Wayland is the "way of the future" and how X11 has to die.

Tom

Perfect Gentleman · Veteran Joined: 18 May 2014 Posts: 1249

CaptainBlood · Advocate Joined: 24 Jan 2010 Posts: 3623

Goverp · Advocate Joined: 07 Mar 2007 Posts: 2007

Zucca · Posted: Sat Jul 06, 2019 4:22 pm Post subject:

I have

CaptainBlood · Advocate Joined: 24 Jan 2010 Posts: 3623

Zucca · Posted: Sat Jul 06, 2019 5:01 pm Post subject:

@CaptainBlood, maybe you meant to run

saellaven · l33t Joined: 23 Jul 2006 Posts: 646

I just played around with this a little...

dev-lang/spidermonkey-60.5.2_p0-r2:60::gentoo USE="jit -minimal system-icu -custom-cflags -custom-optimization -debug -test" resulted in the 500 MB install
dev-lang/spidermonkey-60.5.2_p0-r2:60::gentoo USE="jit minimal system-icu -custom-cflags -custom-optimization -debug -test" resulted in a 270 MB install

After removing nostrip from my FEATURES in make.conf,
dev-lang/spidermonkey-60.5.2_p0-r2:60::gentoo USE="jit -minimal system-icu -custom-cflags -custom-optimization -debug -test" resulted in a 21 MB install
dev-lang/spidermonkey-60.5.2_p0-r2:60::gentoo USE="jit minimal system-icu -custom-cflags -custom-optimization -debug -test" resulted in a 11 MB install

so, it all comes down to debugging symbols and whether or not you strip them. I typically have them turned on by default, but it might make sense to disable it per package in this case.

CasperVector · Apprentice Joined: 03 Apr 2012 Posts: 156

AJM · Posted: Wed Jul 10, 2019 9:57 pm Post subject:

tld · Veteran Joined: 09 Dec 2003 Posts: 1816

Zucca · Posted: Fri Jul 12, 2019 5:39 pm Post subject:

xavier10 · Posted: Thu Apr 23, 2020 10:34 am Post subject:

Just came across this issue.
The size is not a real problem, but the dependency of polkit on a JS implementation is incredible.

I just quickly tried to kill the dependency but failed (one thing depends on another that depends on another etc that depends on it). Definitely on my list of dependencies to kill, but I would rather prefer not seeing it in the first place.

AlexJGreen · Tux's lil' helper Joined: 19 Sep 2018 Posts: 149