A map of Fedora packages and dependencies

[Tarjei Knapstad]

[Disclaimer: This is probably going to end up as a blurb about
dependencies - bear with me :)]

Firstly, I was just perusing through the FC4 package description list
and was reminded of something I've thought of many times:

Would it be possible to map out the package dependencies in Fedora by
doing rpm queries and forming a directed graph of the results? (by using
graphviz or something like that)

I think such a package dependency map would be quite useful to get an
overview of the distribution, both for developers and users. "End nodes"
in the graph could help identify candidates that could be moved to
extras for instance (you might even tag vertices with the package size).
>From the users perspective it would get a lot easier to get an overview
of the impact of removing a package, or if you want to rebuild a
homebrew package for some reason ("I'd really like to just rebuild this
package myself to the bleeding edge, but what else would it impact and
maybe even break, if anything?").

Secondly I was thinking of a "DependencyLint" kind of tool - a small
Python script maybe that would go through every installed RPM on a
system and check if the requirements in the .spec files are correct
and/or sufficient. Here I'm not quite sure about what the rules are for
Fedora however - should absolutely everything that's needed to build a
package be in BuildRequires:? Should every package that has C code
require glibc? Or is it a goal to be as lax as possible to prevent
(hopefully) unnecessary build problems?

In any case I was thinking of maybe using a combination of RPM querying
and ldd (and possibly other tools). An example (from a FC1 box):

1. Get a list of all the RPM's on the system.

2. For each package, list the files and grep the bin/ and lib/ stuff.
For instance 'rpm -ql mutt|grep bin' lists /usr/bin/mutt as one of it's
files.

3. Check which dynamic libraries these binaries and libraries depend on
using 'ldd'. 'ldd /usr/bin/mutt' lists /usr/lib/libz.so.1 among others.

4. For each of these, check which package provides them. 
'rpm -q --whatprovides /usr/lib/libz.so.1' returns 'zlib-1.2.0.7-2'

5. Finally check that the original package depends on zlib. (This step
I'm not sure what's the best way to query.) 'rpm -q --requires mutt'
does not list zlib and 'rpm -e --test zlib' does not list mutt so we've
actually found a missing dependency here.

These are just my first thoughts to maybe encourage some discussion. I'm
sure this could be done in a better way and could probably also be
expanded to do other stuff (I'm not very RPM-savvy). If you run a live
testinstall of rawhide for instance such a tool could be run
automatically after each update to detect any packaging problems wrt.
dependencies.

Thoughts?

Regards,
--
Tarjei