[RULE] gd, xpm, and X libraries: need a second opinion

[Peter E. Popovich]

i've been tinkering with rh / fc since vanderbilt (rh 4.1), and i 
typically do custom minimal installs, especially on servers.  my 
motivation differs slightly from the RULE manifesto, though.  for me, the 
rationale is: installing less software reduces TCO by reducing the number 
of relevant security and errata issues the admin has to keep track of.

one thing i do use is nagios, which needs gd.  at least in fc1 and fc2, rh 
builds gd with xpm support enabled, which means it depends on libX11 and 
libXpm...

for most folks, that's no big deal, but currently, gd is the only thing i 
run on servers that requires X, and while X is pretty mature, it's a big 
hunk of complex code to install for a feature (xpm) that i never use.

i could roll my own RPM of gd with xpm disabled, but that's a poor 
long-term solution.  maintaining custom RPMs increases TCO, there's no 
community to help with QA, and it's YA package to track for potential 
errata and security issues.

i've got a couple of ideas, but i need some extra eyes to look them over. 
i'm hoping someone here has an opinion:

1) propose a specfile for gd that builds gd two ways: gd-noX and gd.  gd 
would stay as-is, gd-noX would be gd built with xpm disabled.  i'm not 
sure how existing packages would distinguish which gd functionality they 
need.  all in all, i think rh is unlikely to adopt this change into future 
releases.

2) propose a change to gd that extracts the xpm features (and everything 
that depends on X libraries) out of libgd.so and puts them into a separate 
library file, e.g. libgd-xpm.so.  rh could package libgd.so in an RPM 
without the X dependency, and put libgd-xpm.so in its own RPM.  RPMs that 
use the standard autoreq / find-requires would automatically update to 
require libgd-xpm if they need it.  RPMs with autoreq: 0 might require 
updating, though.

i think (2) is more elegant than (1), and has a higher chance of success, 
but it depends on unknowns: can xpm be extracted into a separate library, 
would doing that create unintended consequences, and would the author of 
gd (Thomas Boutell) incorporate such a change?

i wrote Thomas Boutell, but didn't get anywhere.  maybe i didn't pitch the 
idea well, or maybe he subscribes to the "build from source" mindset. 
i'm really not sure how best to enlist his help, or the help of someone 
with the skills to propose a change.

i'm handy with RPM, but i'm not fluent enough in gd's inner workings to 
have a clue as to how to approach this.

...it occurs to me at this point that the entire premise of posting here 
assumes that folks here agree it's worth worrying about eliminating a 
dependance on X libraries.  dunno if that's the case.

thoughts?

_______________________________________________
Original home page of the RULE project: www.rule-project.org
Rule-list at rule-project.org
http://rita.choice-secure.com/mailman/listinfo/rule-list_rule-project.org