Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
openssl and bindist conflicts [SOLVED]
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Portage & Programming
View previous topic :: View next topic  
Author Message
hunky
l33t
l33t


Joined: 19 Nov 2003
Posts: 821
Location: Alaska

PostPosted: Tue Feb 03, 2015 5:27 pm    Post subject: openssl and bindist conflicts [SOLVED] Reply with quote

Possibly related to this bug: https://bugs.gentoo.org/show_bug.cgi?id=531540, I've got a conflict when trying to emerge update world.
Code:
dev-libs/openssl:0

  (dev-libs/openssl-1.0.2-r1:0/0::gentoo, ebuild scheduled for merge) pulled in by
    dev-libs/openssl:0[-bindist] required by (dev-qt/qtnetwork-5.4.0:5/5::gentoo, ebuild scheduled for merge)
                       ^^^^^^^^                                                                                                                 

  (dev-libs/openssl-1.0.2-r1:0/0::gentoo, installed) pulled in by
    >=dev-libs/openssl-0.9.6d:0[bindist=] required by (net-misc/openssh-6.7_p1-r3:0/0::gentoo, installed)
                                ^^^^^^^^                                                                             


Developers usually sort these kinds of things out fairly quick so I could just wait and see. No big hurry. But thought I would throw this out there in case I'm missing something obvious or easy to fix myself. I don't have the older version of openssl installed.. it is the currently the latest, which wants to re-emerge now with the -bindist flag.

advice? thx, JD


Last edited by hunky on Tue Feb 03, 2015 10:45 pm; edited 1 time in total
Back to top
View user's profile Send private message
Ant P.
Watchman
Watchman


Joined: 18 Apr 2009
Posts: 5854

PostPosted: Tue Feb 03, 2015 8:03 pm    Post subject: Reply with quote

If you want dev-qt/qtnetwork with SSL support, you need USE="-bindist" on openssl.
If you want net-misc/openssh, you need the same ±bindist on both packages.

This error is happening because you have USE="bindist" set somewhere. Why you'd want to reduce functionality by setting it is only something you can answer.
Back to top
View user's profile Send private message
hunky
l33t
l33t


Joined: 19 Nov 2003
Posts: 821
Location: Alaska

PostPosted: Tue Feb 03, 2015 10:45 pm    Post subject: Reply with quote

See, there ya go, Ant P. Something obvious I had overlooked. Had it in my USE flags - make.conf.

So appreciate the response - fixed it.
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Sun Oct 30, 2016 2:31 pm    Post subject: Reply with quote

Ant P. wrote:
If you want dev-qt/qtnetwork with SSL support, you need USE="-bindist" on openssl.
If you want net-misc/openssh, you need the same ±bindist on both packages.

This error is happening because you have USE="bindist" set somewhere. Why you'd want to reduce functionality by setting it is only something you can answer.


I found this thread trying to resolve a package conflict with the bindist flag.

Code:

  (dev-libs/openssl-1.0.2j:0/0::gentoo, ebuild scheduled for merge) pulled in by
    dev-libs/openssl:0[-bindist] required by (net-dns/bind-9.10.4_p3:0/0::gentoo, ebuild scheduled for merge)
                       ^^^^^^^^
    >=dev-libs/openssl-1.0.0:0[-bindist] required by (net-dns/bind-9.10.4_p3:0/0::gentoo, ebuild scheduled for merge)
                               ^^^^^^^^

  (dev-libs/openssl-1.0.2j:0/0::gentoo, installed) pulled in by
    dev-libs/openssl:0[bindist=] required by (dev-qt/qtnetwork-5.6.1:5/5.6::gentoo, installed)
                       ^^^^^^^^


It seems that dev-qt/qtnetwork requires the openssl bindist flag. Where as the bind package will absolutely not accept the bindist flag.

Code:

grep bindist /usr/portage/profiles/use.desc
bindist - Flag to enable or disable options for prebuilt (GRP) packages (eg. due to licensing issues)


My read on this conflict is that you can never have a system that runs both.

Would this be an accurate?
Why? Why not?
Why are these packages configured to be dependent on the bindist flag in this manner?
Is there a way to resolve this apparent permanent conflict?
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 13975

PostPosted: Sun Oct 30, 2016 4:44 pm    Post subject: Reply with quote

You misunderstood the output from Portage. Yes, bind requires that openssl have USE=-bindist. However, qtnetwork does not require bindist to be enabled. It requires bindist to match. That is, dev-qt/qtnetwork[-bindist] dev-libs/openssl[-bindist] is legal and dev-qt/qtnetwork[bindist] dev-libs/openssl[bindist] is legal, but dev-qt/qtnetwork[bindist] dev-libs/openssl[-bindist] is disallowed and dev-qt/qtnetwork[-bindist] dev-libs/openssl[bindist] is disallowed. You have bindist enabled on one package and disabled on the other, which is a disallowed state, so you get an error. Since bind wants USE=-bindist, you need dev-libs/openssl[-bindist] for that. Therefore, the only solution to use both bind and qtnetwork is to set USE=-bindist on both openssl and qtnetwork.
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Tue Nov 01, 2016 12:29 am    Post subject: Reply with quote

Hu wrote:
You misunderstood the output from Portage. Yes, bind requires that openssl have USE=-bindist. However, qtnetwork does not require bindist to be enabled. It requires bindist to match. That is, dev-qt/qtnetwork[-bindist] dev-libs/openssl[-bindist] is legal and dev-qt/qtnetwork[bindist] dev-libs/openssl[bindist] is legal, but dev-qt/qtnetwork[bindist] dev-libs/openssl[-bindist] is disallowed and dev-qt/qtnetwork[-bindist] dev-libs/openssl[bindist] is disallowed. You have bindist enabled on one package and disabled on the other, which is a disallowed state, so you get an error. Since bind wants USE=-bindist, you need dev-libs/openssl[-bindist] for that. Therefore, the only solution to use both bind and qtnetwork is to set USE=-bindist on both openssl and qtnetwork.


OK. I think I understand.

In /etc/portage/package.use/qtnetwork.use I now have: dev-qt/qtnetwork -bindist
In /etc/portage/package.use/openssl.use I now have: dev-libs/openssl -bindist

While in make.conf I have USE="bindist"

All has worked out now. Thanks for making the emerge output more clear.
Back to top
View user's profile Send private message
ct85711
Veteran
Veteran


Joined: 27 Sep 2005
Posts: 1699

PostPosted: Tue Nov 01, 2016 1:01 am    Post subject: Reply with quote

I just wanted to mention, that bindist means you want to distribute binary copies of the packages and to disable proprietary code in that package , NOT use a binary copy. If you want a binary copy, it will have the "-bin" in the package name; assuming the devs bothered to have a binary version of the package.
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Tue Nov 01, 2016 2:10 am    Post subject: Reply with quote

ct85711 wrote:
I just wanted to mention, that bindist means you want to distribute binary copies of the packages and to disable proprietary code in that package , NOT use a binary copy. If you want a binary copy, it will have the "-bin" in the package name; assuming the devs bothered to have a binary version of the package.


Well, I have a way I've figured out that seems to work OK.

I have one machine act as the master copy of all packages, sources, ebuilds, etc, it's the only one that needs to perform emerge --sync. This master shares out it's /usr/portage via NFS which other systems mount.

In the make.conf in the features, I have set the buildpkg option, so all the binary packages are build and saved in this central /usr/portage

All the systems have exactly the same make.conf and /etc/portage/* files, so all packages should compile the same.

All the systems in the network all have distccd running, and are using ccache. So I'm throwing 14 X64 cores at all these ebuilds. Most are fairly well parallelized, but there are a few that aren't and take some time.

Yeah, I'm probably causing myself all kinds of problems doing it this way, just haven't realized it yet.
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 13975

PostPosted: Wed Nov 02, 2016 1:53 am    Post subject: Reply with quote

That is a fairly common configuration among people who have the hardware and the environment to support it. You might hit some packages that behave poorly with distcc, but I cannot recall anyone who claims to have broken their system by doing it that way. Your biggest risk is that you someday want one of the machines to have different USE flags than its peers, and then it has to be configured specially to support that.
Back to top
View user's profile Send private message
dmpogo
Advocate
Advocate


Joined: 02 Sep 2004
Posts: 2522
Location: Canada

PostPosted: Wed Nov 02, 2016 2:21 am    Post subject: Reply with quote

Ant P. wrote:
If you want dev-qt/qtnetwork with SSL support, you need USE="-bindist" on openssl.
If you want net-misc/openssh, you need the same ±bindist on both packages.

This error is happening because you have USE="bindist" set somewhere. Why you'd want to reduce functionality by setting it is only something you can answer.


It is, for example, set automatically (and put into your make.conf) if you do a fresh install (as I happend to have done few days ago)
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Wed Nov 02, 2016 2:21 am    Post subject: Reply with quote

Hu wrote:
That is a fairly common configuration among people who have the hardware and the environment to support it. You might hit some packages that behave poorly with distcc, but I cannot recall anyone who claims to have broken their system by doing it that way. Your biggest risk is that you someday want one of the machines to have different USE flags than its peers, and then it has to be configured specially to support that.


Good to hear, and true, if I needed / wanted to change USE flags, I'd have to break that sharing first.
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Sat Dec 23, 2017 2:48 am    Post subject: Reply with quote

Aarrgg.

Rebuilding due to profile 13 being dropped from support. Now building profile 17 system from scratch.

So, back to the issue of to bindist or not to bindist.

bind won't accept bindist, and mirrorselect insists on bindist.
So the two mutually exclusive, right? Either you can have bind, or you can have mirroselect, but not both.
'Cause you can only have either +bindist, or -bindist, but not both?

I must have some sort of brain damage, or missing piece of information or realization that's preventing me from sorting this out myself.

I'm finding myself going around in circles, and while portage keeps dutifully making suggestions, applying them only seems to make everything worse and cough up yet more use flags, mask flags, and unmassk flags that it demands be set.

What's the most generic USE variable value that would virtually allow everything to be complied all the time?
Larger executables is not an issue, disk space isn't an issue, and memory consumption isn't an issue, even longer build times isn't an issue, all these things are relatively cheap.
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 13975

PostPosted: Sat Dec 23, 2017 4:00 am    Post subject: Reply with quote

The simplest choice would be not to define USE at all. It sounds wrong to me that mirrorselect would require bindist. Please post the output of emerge --pretend --verbose app-portage/mirrorselect net-dns/bind dev-libs/openssl.
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Sat Dec 23, 2017 4:45 am    Post subject: Reply with quote

Hu wrote:
The simplest choice would be not to define USE at all. It sounds wrong to me that mirrorselect would require bindist. Please post the output of emerge --pretend --verbose app-portage/mirrorselect net-dns/bind dev-libs/openssl.


Hi, thanks for helping me out here. Sometimes it helps to talk through it all, with a fresh set of eyes.

Output as request:
Code:

emerge --pretend --verbose app-portage/mirrorselect net-dns/bind dev-libs/openssl
!!! PORTAGE_BINHOST unset, but use is requested.

These are the packages that would be merged, in order:

Calculating dependencies... done!


[ebuild  N     ] app-portage/mirrorselect-2.2.3::gentoo  PYTHON_TARGETS="python2_7 python3_5 -python3_4 -python3_6" 115 KiB
[ebuild  N     ]  dev-python/ssl-fetch-0.4::gentoo  PYTHON_TARGETS="python2_7 python3_5 (-pypy) -python3_4 -python3_6" 12 KiB
[ebuild  N     ]   dev-python/requests-2.18.2-r1::gentoo  USE="ssl -socks5 {-test}" PYTHON_TARGETS="python2_7 python3_5 (-pypy) (-pypy3) -python3_4 -python3_6" 123 KiB
[ebuild  N     ]    dev-python/urllib3-1.22::gentoo  USE="doc {-test}" PYTHON_TARGETS="python2_7 python3_5 (-pypy) (-pypy3) -python3_4 -python3_6" 221 KiB
[nomerge       ] dev-python/ssl-fetch-0.4::gentoo  PYTHON_TARGETS="python2_7 python3_5 (-pypy) -python3_4 -python3_6"
[nomerge       ]  dev-python/pyopenssl-17.2.0::gentoo  USE="doc -examples {-test}" PYTHON_TARGETS="python2_7 python3_5 (-pypy) (-pypy3) -python3_4 -python3_6"
[nomerge       ]   dev-python/sphinx-1.6.3-r2::gentoo  USE="doc latex -net {-test}" PYTHON_TARGETS="python2_7 python3_5 -python3_4 -python3_6"
[ebuild  N     ]    dev-python/sphinxcontrib-websupport-1.0.1::gentoo  USE="{-test}" PYTHON_TARGETS="python2_7 python3_5 -python3_4 -python3_6" 577 KiB
[ebuild  N     ]     dev-python/sphinx-1.6.3-r2::gentoo  USE="doc latex -net {-test}" PYTHON_TARGETS="python2_7 python3_5 -python3_4 -python3_6" 4565 KiB
[ebuild  N     ]  dev-python/ndg-httpsclient-0.4.0::gentoo  PYTHON_TARGETS="python2_7 python3_5 (-pypy) (-pypy3) -python3_4 -python3_6" 24 KiB
[ebuild  N     ]   dev-python/pyopenssl-17.2.0::gentoo  USE="doc -examples {-test}" PYTHON_TARGETS="python2_7 python3_5 (-pypy) (-pypy3) -python3_4 -python3_6" 167 KiB

Total: 8 packages (8 new), Size of downloads: 5802 KiB

 * Error: circular dependencies:

(dev-python/requests-2.18.2-r1:0/0::gentoo, ebuild scheduled for merge) depends on
 (dev-python/pyopenssl-17.2.0:0/0::gentoo, ebuild scheduled for merge) (buildtime)
  (dev-python/sphinx-1.6.3-r2:0/0::gentoo, ebuild scheduled for merge) (buildtime)
   (dev-python/requests-2.18.2-r1:0/0::gentoo, ebuild scheduled for merge) (buildtime)

It might be possible to break this cycle
by applying any of the following changes:
- dev-python/requests-2.18.2-r1 (Change USE: -ssl)
- dev-python/pyopenssl-17.2.0 (Change USE: -doc)

Note that this change can be reverted, once the package has been installed.

Note that the dependency graph contains a lot of cycles.
Several changes might be required to resolve all cycles.
Temporarily changing some use flag for all packages might be the better option.

!!! Multiple package instances within a single package slot have been pulled
!!! into the dependency graph, resulting in a slot conflict:

dev-libs/openssl:0

  (dev-libs/openssl-1.0.2n:0/0::gentoo, ebuild scheduled for merge) pulled in by
    >=dev-libs/openssl-1.0.2:0=[-bindist(-)] required by (dev-python/cryptography-2.0.2-r1:0/0::gentoo, ebuild scheduled for merge)

    dev-libs/openssl:0[-bindist] required by (net-dns/bind-9.11.1_p3:0/0::gentoo, ebuild scheduled for merge)
                       ^^^^^^^^
    >=dev-libs/openssl-1.0.0:0[-bindist] required by (net-dns/bind-9.11.1_p3:0/0::gentoo, ebuild scheduled for merge)
                               ^^^^^^^^
    dev-libs/openssl (Argument)

  (dev-libs/openssl-1.0.2n:0/0::gentoo, installed) pulled in by
    >=dev-libs/openssl-1.0.1:0/0=[bindist] required by (net-misc/openssh-7.5_p1-r3:0/0::gentoo, installed)
                                  ^^^^^^^
    dev-libs/openssl:0[bindist=] required by (dev-qt/qtnetwork-5.7.1:5/5.7::gentoo, installed)
                       ^^^^^^^^
    >=dev-libs/openssl-1.0.1:0=[bindist=] required by (net-misc/openssh-7.5_p1-r3:0/0::gentoo, installed)
                                ^^^^^^^^


It may be possible to solve this problem by using package.mask to
prevent one of those packages from being selected. However, it is also
possible that conflicting dependencies exist such that they are
impossible to satisfy simultaneously.  If such a conflict exists in
the dependencies of two different packages, then those packages can
not be installed simultaneously.

For more information, see MASKED PACKAGES section in the emerge man
page or refer to the Gentoo Handbook.


!!! The following installed packages are masked:
- sys-devel/gcc-6.4.0::gentoo (masked by: package.mask)
For more information, see the MASKED PACKAGES section in the emerge
man page or refer to the Gentoo Handbook.


 * IMPORTANT: 18 news items need reading for repository 'gentoo'.
 * Use eselect news read to view new items.


Aside from this, I've reviewed and revised all the USE flags in /etc/portage/make.conf, and have ended up with this:
Code:

USE="X acl alsa amd64 berkdb bzip2 cli cracklib crypt cups cxx doc dot dri egl ffmpeg fontconfig fortran gd gdbm gtk2 iconv ipv6 jadetex java latex modules multilib ncurses nls nptl opengl openmp ovftool pam pcre qt4 readline seccomp server session ssl tcpd truetype unicode vix vmware-tools wayland wxwidgets xattr zlib"
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Sat Dec 23, 2017 5:01 am    Post subject: Reply with quote

Yea, setting the USE="" in the make.conf, seems to really help matters.

Got everything silenced when running

emerge -p --newuse world

When I add mirrorselect (emerge -p --newuse world mirrorselect) it first demands:

=dev-libs/openssl-1.0.2n -bindist

OK, so add that. Run it again, then it demands:

=dev-libs/openssl-1.0.2n bindist

Maybe I'll just skip mirror select?
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Sat Dec 23, 2017 5:27 am    Post subject: Reply with quote

OK, so I've given up on mirrorselect, change the make.conf USE to:

USE="aqua wayland X egl server"

Then emerge -p --newuse world comes back without a complaint.

Guess I'll go with that for now.

I wonder if there's something like USE="*" for a 'everything including the kitchen sink'?
Back to top
View user's profile Send private message
asturm
Developer
Developer


Joined: 05 Apr 2007
Posts: 7077
Location: Austria

PostPosted: Sat Dec 23, 2017 9:54 am    Post subject: Reply with quote

Why 'aqua'?

Furthermore, yes it seems you have dropped 'bindist' from make.conf, but you haven't rebuilt affected packages (-N world) such as openssh. Your system is not fixed until that is done.
_________________
backend.cpp:92:2: warning: #warning TODO - this error message is about as useful as a cooling unit in the arctic
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Sat Dec 23, 2017 2:25 pm    Post subject: Reply with quote

asturm wrote:
Why 'aqua'?


QT called for it at one point in time. Then I checked. It's for Mac, so I removed it. Don't need Mac.

asturm wrote:
Furthermore, yes it seems you have dropped 'bindist' from make.conf, but you haven't rebuilt affected packages (-N world) such as openssh. Your system is not fixed until that is done.


Which is better?

globally +bindist, and then only on bind -bindist? (I have to admit that I'm drawn to this option)
OR
globally -bindist, and then on a bunch of packages +binndist?

More and more I'm working on this, it seems that I need to review and re-evaluate every singe USE flag that's accumulated over the years. That'd be a first for me.
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 13975

PostPosted: Sat Dec 23, 2017 5:36 pm    Post subject: Reply with quote

Always manage bindist globally. Never make exceptions for specific packages. Generally, packages that have IUSE=bindist will require that any supporting packages that IUSE=bindist have a matching value. You can find specific cases where you can flip it from your global default, but your life will be simpler if you manage bindist globally and make no exceptions. Most USE flags are not like that.

As for whether to enable it, I suggest you read what it does, evaluate whether the restrictions it imposes are relevant to your use case, then set your USE accordingly. For most people, USE=-bindist is fine. For those who need it, it's present.
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Sat Dec 23, 2017 5:45 pm    Post subject: Reply with quote

Answering my own question.

Better to not have bindist in the global USE flags in make.conf, and only enable it for specific packages in their individual .use files.

When making a change like this, you have to be sure to unmerge the installed packages that have it already enabled before trying to install anything that doesn't have it enabled, as this is where a conflict is going to come from.
Back to top
View user's profile Send private message
Ant P.
Watchman
Watchman


Joined: 18 Apr 2009
Posts: 5854

PostPosted: Sat Dec 23, 2017 6:10 pm    Post subject: Reply with quote

Why would you want to enable it at all? As it says, bindist is only for people who redistribute binary packages to others.
Back to top
View user's profile Send private message
eohrnberger
Apprentice
Apprentice


Joined: 09 Dec 2004
Posts: 193

PostPosted: Sat Dec 23, 2017 6:36 pm    Post subject: Reply with quote

Ant P. wrote:
Why would you want to enable it at all? As it says, bindist is only for people who redistribute binary packages to others.


It controls the branding / icons / art work of some packages which I like and choose to include.
Back to top
View user's profile Send private message
asturm
Developer
Developer


Joined: 05 Apr 2007
Posts: 7077
Location: Austria

PostPosted: Sun Dec 24, 2017 11:50 am    Post subject: Reply with quote

Yes... if you want the branding you usually need to keep it disabled...
_________________
backend.cpp:92:2: warning: #warning TODO - this error message is about as useful as a cooling unit in the arctic
Back to top
View user's profile Send private message
yanlinlin82
n00b
n00b


Joined: 27 Aug 2013
Posts: 2
Location: Beijing, China

PostPosted: Tue Nov 20, 2018 2:11 pm    Post subject: Reply with quote

I have been struggling with such conflict recently. Since there are so many ebuild configure dependencies as "openssl [-bindist]" rather than "openssl [=bindist]", I guess it is better setting USE="bindist" for individuals package instead of setting it globally.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Portage & Programming All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum