Ubuntu package has too many dependencies

[netAction]

Expected behaviour

When installing ownCloud from the SUSE repository it should install ownCloud.

Actual behaviour

A virus scanner, an office suite, a wiki, a mail server and some other stuff is installed.

Steps to reproduce

echo 'deb http://download.opensuse.org/repositories/isv:ownCloud:community/xUbuntu_13.10/ /' >> /etc/apt/sources.list.d/owncloud.list
apt-get update
apt-get install owncloud

Server configuration

Operating system: Ubuntu 13.10
ownCloud version: 6.0.0-0

Updated from an older ownCloud or fresh install: fresh

Solution

Use package suggestions instead recommendations.

By the way.

Please add "updatechecker=false" to default conf.php. At the moment ownCloud wants me to update and shows a yellow warning message.

[DeepDiver1975]

well - if we put all the dependencies on suggest - they will not be installed and the desired features will not work.

Kind of chicken/egg issue - right?

[danimo]

@DeepDiver1975 Depends on what you want. Usually "suggest" is for all the dependencies that make the product work fully at the expense of more packages installed, whereas recommends/requires should be for basic functionality. Am I missing sth there?

[netAction]

• A virus scanner is snakeoil.
• mediawiki is good for what?
• exim4 does not provide any functionality without extensive configuration. I use SMTP.
• Libreoffice OK, but ownCloud works great without it on every other server.

[danimo]

@netAction YMMV on virus scanners, but I concur, No idea why there is a dep on mediawiki, no idea on if an MTA (not a specific one) should be required. Libreoffice is required for collaborative document editing (ODF conversion).

[DeepDiver1975]

Libreoffice is required for collaborative document editing (ODF conversion).

No - preview generation - collaborative editing work without it

[danimo]

Then I concur, preview generation is slow enough as it is. No need to invoke LO in the path.

[danimo]

@netAction "Please add "updatechecker=false" to default conf.php. At the moment ownCloud wants me to update and shows a yellow warning message."

Please file a separate issue about this. Somethings off with the version checking then. Works for me btw (debian packages)

[benurb]

Libreoffice adds on a typical server system about 550 MB of x libs and other probably unwanted packages. Especially libreoffice should not be a recommended dependency imo. Also OwnCloud should not install exim4 on a system, that already runs another MTA like postfix or sendmail or uses an external mailserver.
I installed Owncloud 6 with --no-install-recommends apt-get parameter and it installed like I wanted it to install (with about 20 MB new packages and not over 600 MB).

I also don't know why the package @netAction checked had mediawiki as dependency. At least the currently online one doesn't have it as any kind of dependency.

[DeathByDenim]

I had the same problem. I just tried my regular updates on my Ubuntu 12.04 server and was very confused it tried to install libreoffice. I certainly don't need libreoffice on a server install. Especially considering it's a server.
I didn't know about the --no-install-recommends parameter, so I'll just use that. But I agree, libreoffice shouldn't be a recommended package.

[ghost]

+1 I have no reason to install libreoffice, java, clamav, gods the list is huge. Give me what is needed to get OC working and then document what can be installed to enable optional shiny. This is a pretty common pattern in software dev...

[netAction]

Sorry, mediawiki is only in the dependencies of ownCloud 5 in the official Ubunu repository. http://packages.ubuntu.com/saucy/owncloud

[karlitschek]

ownCloud 6 can generate thumbnails or different filetypes. Libreoffice can be used to generate thumbnails for odt files. It's a soft dependency so you don't have to install it. I haven't checked the ubuntu packages but this should be recommendation and not a hard dependency

[netAction]

In the way of installing a package a recommendation is not a recommendation. You have to tweak with special usually unknown parameters to not install it. So what you talk about is a suggesion in Debian's language.

[jborme]

Answering karlitschek with other words.

Debian has several levels of soft-dependencies. According to the Debian packaging guidelines http://www.debian.org/doc/debian-policy/ch-relationships.html
Recommends is for soft-dependencies “that would be found together with this one in all but unusual installations,” while Suggests is for software “that installing […] without [the said dependencies] is perfectly reasonable.”

I would say that software packages needed to create general image thumbnails should go to Recommends (almost everybody that currently enjoys owncloud 5 stores images, therefore the image thumbnails toolchain should be found in almost every installation), while Libreoffice should go to Suggests (it's perfectly reasonable to have an owncloud 6 setup without odt thumbnails, because not everyone is going to use odt features, and also because even when using the new owncloud odt edition capabilities, not everyone is willing to install Libreoffice dependencies on servers).

The problem with the current owncloud 6 packaging is that it is impossible to decide which dependencies are important, provided Libreoffice alone brings 150+ lines of dependencies (x libs, gtk, fonts, java, python) that bury in noise all the other Recommends lines. To state it clear: which are the soft-dependencies to generate image thumbnails? Which are the soft dependencies to generate video thumbnails? Are there other Recommends soft-dependencies besides the latter two, and Libreoffice?

It would be easier to decide which packages are relevant if Libreoffice went in Suggest and whatever is needed for images/video went to Recommends, because the display of Recommends and Suggest would be separated, and the command-line options --install-recommends and --install-suggests would allow to treat them accordingly.

[netAction]

There is no --install-recommends. apt-get only has --no-install-recommends. Recommended packages are nearly always installed together with ownCloud. In the case of exim4 they have an effect on the rest of the system. That is the reason why this issue is really important.

[jborme]

Thanks for the correction about the correct command-line parameters. Indeed the presence of exim in recommended packages is an important issue, but I cannot comment on this one as I do not experience it: apt-get is not suggesting exim to me (I have msmtp installed, I do not know if it's the reason why).

[netAction]

Yes, exim4 | mail-transport-agent means any other MTA is OK as well.

Details: https://build.opensuse.org/package/view_file/isv:ownCloud:community:6.0/owncloud/debian.control

[benurb]

The problem in my opinion is, that you don't need any MTA to use Owncloud, because it supports SMTP. As @jborme wrote above "Suggests is for software that installing […] without [the said dependencies] is perfectly reasonable."
I think it is perfectly reasonable, because having MTA and Owncloud on two different systems is fairly common. At least I saw a lot of configurations like this 😃

[DeepDiver1975]

What about this:

Source: owncloud
Section: devel
Priority: optional
Maintainer: xxxx
Build-Depends: debhelper (>= 4), apache2
Standards-Version: 3.9.3

Package: owncloud
Architecture: all
Depends: ${misc:Depends}, apache2 | httpd, php5, php5-mysqlnd | php5-mysql, php5-pgsql, php5-sqlite, php5-common, php5-gd, php-xml-parser, php5-intl, php5-mcrypt, php5-curl, ntp | time-daemon
Recommends: mysql-server | php5-sqlite, curl, php5-imagick, php-apc 
Suggests: clamav | clamav-daemon, smbclient, libav-tools | ffmpeg, libreoffice
Description: ownCloud Server - Private file sync and share server
 ownCloud Server provides you a private file sync and share
 cloud. Host this server to easily sync business or private documents
 across all your devices, and share those documents with other users of
 your ownCloud server on their devices.
 .
 ownCloud - Your Cloud, Your Data, Your Way!  www.owncloud.org

[netAction]

Didn't have ntp or time-daemon installed on my servers (and don't need it on XEN guests).
The rest looks good.

[jborme]

Thanks for the change. Actually I think it's possible that to restrict Libreoffice dependency to the package libreoffice-writer. Since currently OC only supports rich text edition, there is no need to install the other components (libreoffice-calc, -base, -draw, -impress). This saves a significant amount of dependencies (libreoffice on a basic Debian 7 setup requires 138 dependencies, libreoffice-writer requires “only” 101).

[DeepDiver1975]

@jborme we use libreoffice for preview generation of any ODF files - it's totally unrelated to the collaborative editing feature.

[DeepDiver1975]

Didn't have ntp or time-daemon installed on my servers (and don't need it on XEN guests).

@netAction hmm - interesting ...
... loong time ago we had a hard requirement to have client and server running ntp - today it's no longer that critical but in case you expect proper modification times being synchronized it's still helpful.

[dragotin]

I just committed what Thomas suggested to the packages in isv:ownCloud:community

[netAction]

@DeepDiver1975 If you are in a virtual machine NTP does not work.

[jmaspons]

Installing libreoffice in ubuntu server pulls in libreoffice-gnome libreoffice-gtk. Could you be more specific in the suggested packages? I don't know which is the minimal requirements to support online editing but I maybe installing libreoffice-core or libreoffice-writer it's enough.

[jmaspons]

I've intalled libreoffice-writer and documents works properly so that’s probably the minimum requisite. I suggest to suggest libreoffice-writer instead of libreoffice.

[DeepDiver1975]

I've intalled libreoffice-writer and documents works properly

Once again: documents and libreoffice are unrelated!
libreoffice is used for preview/thumbnail generation - I'd suggest to add at least the packages for presentation and spreadsheet as well.

[netAction]

There are still strange dependencies.

http://download.opensuse.org/repositories/isv:/ownCloud:/community/xUbuntu_13.10/Packages

Not neccessary: php5-mysqlnd | php5-mysql
Not neccessary: php5-sqlite
Not neccessary: php5-pgsql

Seems not to be used in OwnCloud: php5-intl
More info: http://de1.php.net/manual/en/intro.intl.php

Costs even more than disk space: ntp | time-daemon

[netAction]

Yes, one of these. But not all at once.

Uhm. I ran OC6 without php5-intl in German and do not see any difference after installing the package.

[DeepDiver1975]

Uhm. I ran OC6 without php5-intl in German and do not see any difference after installing the package.

Yes - because we provide a pure PHP implementation as fallback in case php-intl is not available

[DeepDiver1975]

Yes, one of these. But not all at once.

true - but in order to keep the packaging effort to a reasonable level we have one package and not 3 or 4

[IzzySoft]

I agree with netAction:

php5-mysqlnd | php5-mysql, php5-pgsql, php5-sqlite

should rather read

php5-mysqlnd | php5-mysql | php5-pgsql | php5-sqlite

One of them is required, others are optional. I e.g. have no use for the PostGRESQL part (php5-pgsql), as there's not even a PG database installed/running. That would also go well with your "packaging effort", as no additional/alternative packages are needed from your end: If one already uses one of the databases, the requirement should already be met and the others skipped automatically (as connected by "OR").

One more concern of mine is:

ntp | time-daemon

Is an NTP _server_ really a requirement? That dependency broke other things on my system (which is running an NTP client to sync against another server: the client could no longer run as the port was occupied). I've manually disabled the ntpd OC's requirements drew in – didn't see anything fail because of that. IMHO if at all, ntp should be a recommend/suggest.

On the other end, from the above quoted package description, I wonder about this:

Recommends: mysql-server | php5-sqlite

"Recommends" means it works without. Does ownCloud work without a database? Shouldn't that be in the "Requires" section, and have the postgresql package "OR'd" as well?

mysql-server | php5-sqlite | postgresql

[netAction]

ntp as a recommendation will not help that much as it is too hard to install a package without the recommended packages. And a lot of Linux systems don't have any hardware clock to sync.

[dragotin]

I don't think we still need the ntp dep.

[IzzySoft]

ntp as a recommendation will not help that much as it is too hard to install a package without the recommended packages.

I don't get what you mean by that: where's the problem? If I want that package, I simply run another apt-get install ntp. Neither can I see what should make the owncloud package installation harder. If I'm not taken completely wrong, only depends are installed automatically. Recommends are just hints what might be useful along the package, and suggests are packages to "really consider" as they add major "support".

And a lot of Linux systems don't have any hardware clock to sync.

I don't understand that one either. All my Linux machines have been doing fine without the ntp package so far. How should a time _server_ substitute for a hardware clock? ntpdate comes by default on Ubuntu (note they call Time Synchronisation with NTP [...] useful for servers, but is not necessary (or desirable) for desktop machines – i.e. not even required for servers), and can be called in intervals e.g. via Cron. Sufficient for 99% of the cases. So if you really want to make sure there's a "time-sync" available, that should rather read

ntpdate | ntp | time-daemon

But I rather agree with @dragotin that it's not needed as a Depends. A "Recommends:" doesn't hurt, though a too long list there might rather be confusing. Keeping the server time in-sync is not the task of OC, it's rather a general server thing ;)

[netAction]

Recommends are just hints what might be useful along the package

No. You are talking about suggestions. To not install a recommended package is difficult. Please read this issue from the beginning.

So if you really want to make sure there's a "time-sync" available, that should rather read "ntpdate | ntp | time-daemon"

Which clock should be synced this way when there is none?

A "Recommends:" doesn't hurt

For nearly any user there is no difference between dependency and recommendation. The pain is the same. :-)

[IzzySoft]

@netAction I knew I was again messing-up "recommends" with "suggests" (never remember which is which). But I was not aware that one of them (here: recommends) always gets installed automatically if not explicitly stated otherwise – thanks for the lesson! So please, consider my "Recommends" as "Suggestions" and vice-versa ;) I still hope for the day I can keep the two apart. Your --no-install-recommends might be the key to it :)

Which clock should be synced this way when there is none?

Guess we're going a little beyond the scope of this ticket; but which clock is used to deal with time when there is none? That one. When syncing time with ntpdate (a while ago since I last touched that script), I had to explicitly add another line to sync the system time with the hwclock. So ntpdate syncs the system time – hwclock or not. But don't let's dig deeper into that here: required or not, it's not a question for OC but rather a general server thing. And dragotin already stated he neither thinks the dep required for OC.

[netAction]

Your --no-install-recommends might be the key to it

How many admins know this? How many did not even upgrade to OC7 yet?

which clock is used to deal with time

The kernel's clock. You should not touch this as you don't know if root is allowed to change it at all. You might want to change the data source the kernel uses. But you don't know what that is on a unknown user's system. Here it is a XEN daemon and ntpdate crashes on every startup very nice.

[IzzySoft]

Your --no-install-recommends might be the key to it

How many admins know this? How many did not even upgrade to OC7 yet?

Full ack. But all I meant was that being the key to me finally being able to keep "Suggests" and "Recommends" apart in the correct way, telling which is which – not being the key for others dealing with the installation ;)

Here it is a XEN daemon and ntpdate crashes on every startup very nice.

OK, that's a reason against using ntpdate on that system. On another system might be reasons against ntp. So _if_ requiring any of the two, "OR" it with the other. So on my machine, ntp wouldn't have been installed as the requirement ntp | ntpdate was already satisfied by the installed ntpdate – and on yours it's just the other way around. Both of us happy :)

[netAction]

I need a NTP daemon on a system that can't change any hardware time, any kernel time and that does not provide a NTP server?

[IzzySoft]

I don't think so. That's why I'd put the "if" bold-italic. Keeping that stuff completely out of the deps IMHO would be the best.

[BackSlasher]

@dragotin, could you please explain why the new package in Debian Backports still has the old "Recommends"?
It also happens with the OC6 package in Ubuntu, but I guess they simply port the Debian ones.

Package: owncloud
Version: 7.0.0+dfsg-2~bpo70+2
Installed-Size: 26141
Maintainer: ownCloud for Debian maintainers <pkg-owncloud-maintainers@lists.alioth.debian.org>
Architecture: all
Replaces: owncloud-mysql, owncloud-pgsql, owncloud-sqlite
Provides: owncloud-mysql, owncloud-pgsql, owncloud-sqlite
Depends: apache2 | httpd, fonts-font-awesome, fonts-liberation, fonts-linuxlibertine, fonts-lohit-deva, fonts-sil-gentium-basic, fonts-wqy-microhei, libjs-chosen, libjs-dojo-dojox, libjs-jcrop, libjs-jquery-minicolors (<< 2~), libjs-jquery-mousewheel, libjs-jquery-timepicker, libjs-pdf (>= 1.0.473-1~), libphp-phpmailer, owncloud-doc, php-assetic, php-doctrine-dbal, php-getid3 (>= 1.9.5~), php-opencloud (>= 1.9), php-patchwork-utf8, php-pear, php-pimple (<< 2), php-sabre-dav (<< 1.9), php-sabre-dav (>= 1.8), php-seclib, php-symfony-classloader, php-symfony-console, php-symfony-routing, php5 (>= 5.3.8), php5-gd, php5-json, php5-mysql | php5-pgsql | php5-sqlite, zendframework
Recommends: exim4 | mail-transport-agent, libav-tools, libreoffice, php-aws-sdk, php-crypt-blowfish (>= 1.1.0~RC2-2~), php-dropbox, php-google-api-php-client (<< 1), php5-apcu | php5-xcache, php5-cli, php5-curl, php5-imagick, php5-intl, php5-ldap, php5-mcrypt, smbclient
Suggests: libapache2-mod-xsendfile, mysql-server | virtual-mysql-server | postgresql

Thanks

[dragotin]

@BackSlasher sorry, I don't know anything about that. You would need to ask downstream at the debian community. Usually they know what they do.

[BackSlasher]

@dragotin Emailed the package maintainers. Thanks anyway

[flyingflo]

If you don't want to install ntp to satisfy owncloud's package dependencies (it really doesn't make sense on a virtual server!!), I recommend creating a dummy package with 'equivs' that provides 'time-daemon'.
I created a no-ntp package, and installed it on my virtual server.

[LukasReschke]

@jnweiger Still relevant for our own packages? - If not please close.

[jnweiger]

Dependencies should have a reason.
We have many dependencies in the linux packages that are unexplained. While I cannot find exim4 or mediawiki any more, we still require ntp.

Furthermore, the dependencies vary greatly between distributions. E.g. we have Recommends: libreoffice-writer for suse, but don't mention it for rhel/centos.

Dependencies should have a reason and be consistent.
I am removing ntp today, to fix the obvious.

[DeepDiver1975]

ntp was required long time ago because our sync algo was relying on in-sync system times on client and server. This dependency can savly be removed.

[netAction]

our sync algo was relying on in-sync system times

... where ntp did not fix anything on many systems as explained 200 times in this issue.

[AdamWill]

"Furthermore, the dependencies vary greatly between distributions. E.g. we have Recommends: libreoffice-writer for suse, but don't mention it for rhel/centos."

Fedora / RHEL do not have soft dependencies, it's hard or nothing. That explains several of the differences.

[DeepDiver1975]

... where ntp did not fix anything on many systems as explained 200 times in this issue.

@netAction what are you trying t tell me?

[LukasReschke]

I guess I can close this then.