Request for help with port organisation: how to install several versions of data files

[Mojca Miklavec]

On Tue, Jul 2, 2013 at 12:13 AM, Ryan Schmidt wrote:
> On Jul 1, 2013, at 07:48, Mojca Miklavec wrote:
>
>> I'm looking for ideas about how to best organise the port(s) for
>> Geant4 data files (see also https://trac.macports.org/ticket/32716).
>>
>> Geant4 needs approximately 8 data files which currently looks like this:
>
>> I would like to provide multiple versions of Geant4 simultaneously
>> (for example two or three versions) and as part of the process, Frank
>> Schima suggested separating the data files from the source code into
>> (a) different port(s).
>
> I agree separating data files from code can be useful, but I would try to put all the data files relating to a specific version of geant4 into a single port (or subport), and not do one port (or subport) per file and version.
>
> The reason is that if today you make the user install geant-something-1.1 and tomorrow you update geant to depend on geant-something-1.2 then the upgrading user will still be left with geant-something-1.1 installed for no reason: old versions of these dependencies will just accumulate with no easy way for the user to see that they're no longer needed, since they'll still be listed as active. Even upgrading geant with "sudo port -u upgrade" wouldn't remove these old versions.

Thank you for pointing this out. However this means that there is
something that I don't understand.

Let's say that I indeed create, say, geant4.9.5-data and
geant4.9.6-data (let's say that these are two subports which install
all the data files into version-specific directory). User who decides
to install geant4.9.5 would get at least the following dependencies
automatically:
- expat
- clhep
- root
- geant4.9.5-data

What happens when user:
a) decides to uninstall geant4.9.5
b) decides to install geant4.9.6 and to uninstall geant4.9.5

Would geant4.9.5-data be removed then? What about root, clhep, expat
which would also be no longer needed after removing geant4? How can
user get rid of packages in that case?

I'm asking because I often have similar "problems". As soon as I
install wine[-devel] it becomes a problem to get rid of all the
universal packages that need to be upgraded and compiled from source
over and over again.

I remember I saw a command listing all ports that were "not requested"
and did not have any dependents. That one could be used to uninstall
such packages. It would also be an option to try to
deactivate/uninstall data packages when deactivating/uninstalling
geant4 provided that they wouldn't be used by any other port. (I'm not
necessarily saying that this is a good idea because I'm definitely not
aware of all the implications of such approach.)

> If it is possible that, say, geant4.9.5 and geant4.9.6 would use the same version of some dependency,

It is.

>> Each <name>-<version> would then fetch a single tar.gz file from the
>> server, check the md5 checksum (or some other sum - md5 is simply the
>> one provided upstream), and extract it to a place like this:
>>
>>     /opt/local/share/Geant/Data/G4EMLOW6.31/
>>     /opt/local/share/Geant/Data/G4EMLOW6.32/
>>     /opt/local/share/Geant/Data/G4EMLOW6.33/
>>     /opt/local/share/Geant/Data/RealSurface1.0/
>>     …
>
> md5 is an insecure algorithm and should no longer be used on its own as a means of verifying anything. If that's all upstream publishes,

It is. But I can generate other checksums manually (with help of "port
-v extract") of course.

> but please ask upstream to switch to a secure checksum method for their published values.

OK, I'll ask them.

Mojca