RetroFed Forum
Your home away from modern life.
Void-packages injecting other packages
Post Reply
AuthorMessage
404 lemmy.zip 404@lemmy.zip
Joined: 2023-07-23
Quote

Example: The ZLS (Zig Language Server) package installs Tracy Profiler. Wth.

2   Original
gid lemmy.world mbgid@lemmy.world
Joined: 2023-06-11
#2 · Quote Reply

[deleted]
1
gid piefed.blahaj.zone gid@piefed.blahaj.zone
Joined: 2025-09-22
#3 · Quote Reply

It looks like zls has an optional dependency on tracy.

This isn't the best way to bundle that dependency, but I don't see anything malicious here.

3
404 lemmy.zip 404@lemmy.zip
Joined: 2023-07-23
#4 · Quote Reply

It looks like zls has an optional dependency on tracy. This isn't the best way to bundle that dependency, but I don't see anything malicious here.

Good find.

This should really be cleaned up though. Optional dependencies should not be installed undisclosed like this.

3
fozid lem.radiantfig.fyi fozid@lem.radiantfig.fyi
Joined: 2026-08-04
#5 · Quote Reply

Does xbps-install not prompt you to confirm you want all packages installed? So zls and Tracy?

1
gid piefed.blahaj.zone gid@piefed.blahaj.zone
Joined: 2025-09-22
#6 · Quote Reply

Does xbps-install not prompt you to confirm you want all packages installed? So zls and Tracy?

Not if a separate executable is bundled into the zls package, which is what this template does.

1
fozid lem.radiantfig.fyi fozid@lem.radiantfig.fyi
Joined: 2026-08-04
#7 · Quote Reply

Not if a separate executable is bundled into the zls package, which is what this template does.

Ah ok, didn't realise this was regards templates for source packages. 👍

1
Post Reply
Back to top