Re: [PATCH] ld: add --package-metadata

[Luca Boccassi <bluca@debian.org>]

On Tue, 24 May 2022 at 12:13, Jose E. Marchesi <jose.marchesi@oracle.com> wrote:
>
>
> Hi Luca.
>
> >> I've added an optional usage of libjansson to provide additional validation,
> >> so that it doesn't have to be reimplemented everywhere a thousand
> >> times over.
> >> For bootstrapping purposes the dep is optional and can be skipped, for example
> >> in Debian/Ubuntu it would be annotated with <!stage1> so that everything
> >> works out of the box.
>
> As far as I can see at https://systemd.io/COREDUMP_PACKAGE_METADATA/ the
> payload encoded in JSON comprises a single object which must be a
> dictionary, whose entries all contain strings.  Basically:
>
>   {"..." : "..."[, "..." : "..."]*}
>
> Isn't it a bit overkill to add a dependency to an external library just
> to verify the format of the above?  A regular expression would suffice,
> even if a fastidious one due to the string format:
>
>   S -> JSON string
>   B -> [\n\t ]*
>
>   PAYLOAD -> B{BSB:BSB(,SB:BSB)*}B

Hi,

The specification actually is very explicit in supporting a full json
payload, with the only limitations (certain unicode characters, int
ranges) being explicitly called out. The example given is simple
because it's just an example. I do expect the usage to expand at some
point in the future.

As mentioned in the patch the validation is entirely optional, and
nothing will happen if the build dependency isn't provided, which will
be the default in all distros. And it can also be explicitly disabled
if desired. I could flip the default to force-disable if desired, but
in practice I don't think it would make much difference, given how
packages are built in minimal environments already.

As a distribution builder I would very very much like to find out
about build-time issues at build time, rather than at runtime. It's
much cheaper and immediate. When you have 50000+ packages it is very
much unrealistic to expect to runtime QA them all for every little
thing like this. An automated, implicit build time check is so much
cheaper, reliable and effective, and reduces the need to reimplement
it every single time.

Kind regards,
Luca Boccassi