There is definitely a "horse and cart" situation here, and you are correct in that the AIX lpp system is driving the rpm system. You cannot install rpm's without sufficient lpp support. That is exactly my point.
What I'm saying, is that from the position of a user that wishes to consume these rpm's, he would install AIX and update to the latest SP before embarking on installing dnf to get to the rpms. And he would get unresolved dependencies right out of the box. This is not a good user experience.
Is there a defining document that lists what lpp's need to be in AIX in order to resolve these dependencies? I'm not aware of one. What I'm seeing is people coming here to the forums with unresolved dependencies and being told that they're missing an lpp that was released since the last SP to AIX.
This is a gap and I'm hoping to see it closed through a rethink of how the repos are laid out and some acknowledgement that there is an issue for the user.
As a heavy user of AIX and open source I would like to see several changes to the layout of the repos.
- Cleanup. There are rpms in here dating back 20 years. I've seen this happen on other repos as well and it makes them difficult to mirror. The ISO that IBM releases of the aixtoolbox is nice and clean. Why can't the web version be the same? I would like to see all these old rpms moved into archive repos away from the main repos. If people really need a version of bash from 2002, they can find it there.
- Host your repos via rsync protocol and post an "official" way of mirroring it. You'll see this in every major Linux distribution's repo site.
- The rpms should be signed. This speaks to supply chain security. You have users that have deep concerns about this topic.
- Close the dependencies gap. I'm not sure how this would look in a mixed lpp/rpm environment, but either through clear project documents (perhaps a wiki?) or via some reorg of the repos. There should be repos that are built against *at most* the latest AIX/SP, and an additional repo added for what's coming next. That additional repo should have clear instructions (README.txt) that points to the deltas the developers relied upon with valid links to the lpps they need. To use a pool analogy, this would be "calling your shot". Once these lpps are in the next TL/SP, then they would move from "next" into the main repo.
One thing I do want to say is how much the aixtoolbox has changed AIX over the years. Though the rpm's work to support AIX and are *by definition* forced to be downstream from it, they have had the effect of making AIX follow the UNIX standards far better. I remember a time when porting any software to AIX was an awful experience and in the port chain, AIX was always last after Solaris and HPUX. That has thankfully changed, and it's the rpm that is to thank for it because of the influence of open source.
------------------------------
Mario Stargard
------------------------------
Original Message:
Sent: Fri November 11, 2022 06:40 AM
From: Ayappan P
Subject: Unresolved Dependencies and Toolbox Goals
AIX Toolbox rpms are always built against an OS or a lpp package that is already available for users.
The above confusion stems from the fact that since AIX native packaging format (lpp), all things cannot be resolved through rpms.
For example., openssl libraries , sctp library are provided in AIX through lpp fileset. So we have this "AIX-rpm" virtual rpm which acts as a bridge from lpp to rpm.
When an lpp fileset installed , one has to run "updtvpkg" so that AIX-rpm gets updated with any new libraries from the new fileset.
------------------------------
Ayappan P
Original Message:
Sent: Tue November 08, 2022 10:26 AM
From: Mario Stargard
Subject: Unresolved Dependencies and Toolbox Goals
I've seen and experienced unresolved dependencies using the Linux Toolbox repos from the web. It appears to be a common occurrence and after reading Jan Harris' Blog post it got me thinking that there's a fundamental issue with these repos. Her post is here:
https://community.ibm.com/community/user/power/blogs/jan-harris1/2022/04/18/aix-open-source-support-tips-resolving-aix-file-de
My comment on her post is as follows and I'd like to initiate a discussion around it.
What version of AIX are these rpm repo's built against?
This is a key question because unresolved dependencies like the one for openssl 1.1.1 demonstrate that the rpm's in the repos are built against an OS that doesn't exist yet. No version of AIX with complete fixpacks provides this yet. Presumably that will happen in late December or early January according to the release schedule for AIX fixes.
These OSS repos have the same problem that the Fedora EPEL faces with CentOS 8 Stream being upstream from Red Hat 8. In that case, the developers have created a "next" repo that contains what you need to resolve the dependencies for CentOS 8 Stream vs. a downstream distro.
I've seen mention of pulling individual packages into the LPP sources to satisfy these dependency shortcomings in the OSS repos, but how would we know which ones we need? Trial and error are precisely the reason we adopted dnf/yum in the first place. Is there a better way to do this?
------------------------------
Mario Stargard
------------------------------