Add pcdepends rule

This rule checks if dependencies from pkg-config .pc files are satisfied. These are used by the pkg-config --cflags --libs <library name> command to set the appropriate CFLAGS and LDFAGS when building any dependent (direct and indirect) packages. If any of dependencies specified in Requires or Requires.private fields are missing, pkg-config trows an error. These dependencies are mostly covered by link-level dependencies, but there are some exceptions, this is why we need this rule.

Example output:

libxi E: Dependency libxfixes detected and not included (pkg-config files ['usr/lib/pkgconfig/xfixes.pc'] needed in files ['usr/lib/pkgconfig/xi.pc'])
libxi W: Dependency libx11 detected and implicitly satisfied (pkg-config files ['usr/lib/pkgconfig/x11.pc'] needed in files ['usr/lib/pkgconfig/xi.pc'], libraries ['usr/lib/libX11.so.6'] needed in files ['usr/lib/libXi.so.6.1.0'])
libxi W: Dependency xorgproto detected and implicitly satisfied (pkg-config files ['usr/share/pkgconfig/inputproto.pc'] needed in files ['usr/lib/pkgconfig/xi.pc'])
libxi I: Dependency libxext detected and satisfied (pkg-config files ['usr/lib/pkgconfig/xext.pc'] needed in files ['usr/lib/pkgconfig/xi.pc'], libraries ['usr/lib/libXext.so.6'] needed in files ['usr/lib/libXi.so.6.1.0'])

changed the description

approved this merge request

mentioned in commit f84f3c4a

merged

Per https://man.archlinux.org/man/pc.5.en, Requires.private is:

Required dependencies that must be met for the package to be usable for static linking.

I think static linking is not a common practice in Arch, so namcap should not check it by default.

For example, /usr/lib/pkgconfig/gtk+-3.0.pc has:

Requires.private: atk atk-bridge-2.0 wayland-client >= 1.14.91 xkbcommon >= 0.2.0 wayland-cursor >= 1.14.91 wayland-egl epoxy >= 1.4 fribidi >= 0.19.7 pangoft2 gio-unix-2.0 >= 2.57.2

Adding all of them to PKGBUILD dependencies seems an overkill.

@bgyorgy I think @yan12125 has a point there that I overlooked, this might start showing a bunch of false positives. Lets review this before we cut a release (which I have an eye to do soon to get all the recent batches of improvements).

This is intentional. The pkgconf tool (which we are using as pkg-config on Arch Linux) checks the existense of .pc files defined in Requires.private even if you don't do static build, and it throws an error if any of them missing.

The uptream developer said this:

In almost all cases, headers belonging to Requires.private are referenced indirectly. So we need to ensure the dependency is satisfied to compile. The only case where Requires and Requires.private should be differently handled is linking, which pkgconf correctly follows.

And this:

Requires.private is not strictly actually about --static, it is meant to be a list of dependent SDKs that are not directly required by the end user but still needed to build against. For CFLAGS, this means that Requires.private should be considered. If anything, the error message should likely be improved to clarify if it is a private dependency or not, and then more appropriate advice could be given. There is also freedesktop bug 4378 that documents some other quirkyness.

So if you try to run pkg-config --cflags <pkgname> without packages from Requires.private installed, then it fails, because the command wants to ensure that the header or data files of the library specified in Requires.private are available on the system.

At first, it was confused me too, but we definitely need dependencies from Requires.private. I checked various core packages, but I didn't see too much missing dependencies. I posted about that on arch-dev-public mailing list.

mentioned in issue #29