Subversion 1.6.4 with new dependency on db42 instead of db41

[Miroslav Lachman]

Hi,
I have upgraded Subversion from 1.6.2 (vulnerable version) to 1.6.4. 
This new version has dependency on db42, instead of db41, so the new 
db42 was installed. Now I have both db4 versions installed in the system.

root at retezat ~/# pkg_info -E 'db4*'
db41-4.1.25_4
db42-4.2.52_5

Subversion was built with following options:
_OPTIONS_READ=subversion-1.6.1
WITH_MOD_DAV_SVN=true
WITH_APACHE2_APR=true
WITHOUT_MOD_DONTDOTHAT=true
WITH_NEON=true
WITHOUT_SERF=true
WITHOUT_SASL=true
WITH_BDB=true
WITHOUT_ASVN=true
WITHOUT_MAINTAINER_DEBUG=true
WITHOUT_SVNSERVE_WRAPPER=true
WITHOUT_STATIC=true
WITHOUT_BOOK=true

I tried to track down the reason of this new dependency, but with no 
luck. It seems needless to have db42 in my case. (see further)

My first thought was - it is dependency of apr:

root at retezat subversion/# make pretty-print-run-depends-list
This port requires package(s) "apr-ipv6-gdbm-db42-1.3.8.1.3.9 
db42-4.2.52_5 expat-2.0.1 gdbm-1.8.3_3 gettext-0.17_1 libiconv-1.13.1 
neon28-0.28.4 pkg-config-0.23_1 sqlite3-3.6.14.2" to run.

root at retezat subversion/# cd /usr/ports/devel/apr
root at retezat apr/# make pretty-print-run-depends-list
This port requires package(s) "db42-4.2.52_5 expat-2.0.1 gdbm-1.8.3_3 
libiconv-1.13.1" to run.

But I have no apr installed (bundled from Apache is used)

Recorded dependencies shown db42 as direct dependency of Subversion:

root at retezat ~/# pkg_info -rR subversion-1.6.4
Information for subversion-1.6.4:

Depends on:
Dependency: expat-2.0.1
Dependency: perl-5.8.9_3
Dependency: pkg-config-0.23_1
Dependency: pcre-7.9
Dependency: sqlite3-3.6.14.2
Dependency: db42-4.2.52_5
Dependency: db41-4.1.25_4
Dependency: libiconv-1.13.1
Dependency: gettext-0.17_1
Dependency: neon28-0.28.4
Dependency: apache-2.2.11_7

root at retezat ~/# pkg_tree -v subversion-1.6.4
subversion-1.6.4
|\__ expat-2.0.1
|\__ perl-5.8.9_3
|\__ pkg-config-0.23_1
|\__ pcre-7.9
|\__ sqlite3-3.6.14.2
|      \__ pkg-config-0.23_1
|\__ db42-4.2.52_5
|\__ db41-4.1.25_4
|\__ libiconv-1.13.1
|\__ gettext-0.17_1
|      \__ libiconv-1.13.1
|\__ neon28-0.28.4
|     |\__ expat-2.0.1
|     |\__ libiconv-1.13.1
|      \__ gettext-0.17_1
|            \__ libiconv-1.13.1
  \__ apache-2.2.11_7
       |\__ expat-2.0.1
       |\__ perl-5.8.9_3
       |\__ pcre-7.9
       |\__ db41-4.1.25_4
        \__ libiconv-1.13.1

It seems as result of this piece of code in Makefile.common (USE_BDB=42+)

# Default us "on"
.if !defined(WITHOUT_BDB)
USE_BDB=                42+
PLIST_SUB+=             BDB=""
.else
CONFIGURE_ARGS+=        --without-berkeley-db
PLIST_SUB+=             BDB="@comment "
.endif



In my case, all binaries and libraries of subversion are linked to good 
old db41:

root at retezat ~/# ldd /usr/local/lib/libsvn_*.so | grep db4
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x386f7000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x38376000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x38376000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x383d7000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x383ad000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x383a4000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x38376000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x3866b000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x38400000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x38392000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x38392000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x383fc000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x38300000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x383d7000)

root at retezat ~/# ldd /usr/local/bin/svn* | grep db4
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x382d3000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x381f4000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x381ef000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x381ff000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x38209000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x381aa000)
         libdb41.so.1 => /usr/local/lib/libdb41.so.1 (0x381bd000)

That's why I think the dependency on db42 is useless.

And the questions are:

1] Am I doing something wrong, or is something wrong in Subversion port?

2] If new Subversion will be linked to db42, will it cause some troubles 
with SVN repositories? (on this machine, SVN is used as client - just 
for updates / checkouts, but I have more machines, where Subversion is 
used as server and I am nervous to do this problematic upgrade in fear 
of repository damage.

Miroslav Lachman