ports/165826: [PATCH] net/p5-Net-Nessus-XMLRPC: add missing DEPENDS

[Schmehl, Paul L]

________________________________________
From: Steve Wills [swills at FreeBSD.org]
Sent: Saturday, March 17, 2012 5:53 PM
To: Schmehl, Paul L
Cc: perl at FreeBSD.org
Subject: Re: ports/165826: [PATCH] net/p5-Net-Nessus-XMLRPC: add missing DEPENDS

On 03/07/12 12:40, Paul Schmehl wrote:
>
>  According to the CPAN page
>  (<http://search.cpan.org/~kost/Net-Nessus-XMLRPC-0.30/lib/Net/Nessus/XMLRPC.pm>),
>  only IO::Socket::SSL is required (and in FreeBSD, Net::SSL is a RUN_DEPENDS
>  for IO::Socket::SSL. anyway.)
>
>  "'This CPAN module uses LWP for communicating with Nessus over XMLRPC via
>  https. Therefore, make sure that you have Net::SSL (provided by
>  Crypt::SSLeay): http://search.cpan.org/perldoc?Crypt::SSLeay or
>  IO::Socket::SSL: http://search.cpan.org/perldoc?IO::Socket::SSL"
>
>  If you want to argue that LWP is a RUN_DEPENDS, I can see that, but why
>  HTML::Message and XML::Simple?  Why does the author think these other
>  modules are required?
>
>  I need more information before making this change.

Unfortunately, the documentation doesn't match the code. I found these
by running "make test" with just the package installed (in a chroot).
Looking at the code:

./work/Net-Nessus-XMLRPC-0.30/lib/Net/Nessus/XMLRPC.pm:use
HTTP::Request::Common;

hence the dep on HTML::Message. Similarly:

./work/Net-Nessus-XMLRPC-0.30/lib/Net/Nessus/XMLRPC.pm:use XML::Simple;

hence the dep on XML::Simple.

>  Even if these other modules were required, they wouldn't be BUILD_DEPENDS,
>  they would be RUN_DEPENDS, so the patch would need to be corrected for that.

The "build" will complain that these modules are missing at build time:

===>  Configuring for p5-Net-Nessus-XMLRPC-0.30
Warning: prerequisite HTTP::Request::Common 0 not found.
Warning: prerequisite LWP::UserAgent 0 not found.
Warning: prerequisite XML::Simple 0 not found.

I like to avoid those warnings so that if, for example, an update to the
module requires a new module I can see it easily instead of comparing
that list to the RUN_DEPENDS to see if any are missing.

>From a package standpoint it makes no difference if they're also
BUILD_DEPENDS because they're going to be RUN_DEPENDS anyway and from a
ports (building from source) perspective, it's cleaner, easier to see
new depends, let's you run "make test" if you want and less worrisome
for the uninformed.

Steve

Makes perfect sense.  I approve the changes.