On Jun 13, 2008, at 1:07 PM, Dan Nicholson wrote:

> On Fri, Jun 13, 2008 at 9:47 AM, Pixel <pixel@mandriva.com> wrote:
>>
> Sadly, this affects rpm more than just during the build. If you have
> an application linking against a librpmio using an unpatched
> libpcreposix, you're open to all the same linker issues. I.e., you're
> app better also link directly to libpcreposix or you don't know whose
> regcomp() you're getting. This isn't just an --as-needed issue.
>

Attempting static linking certainly forces symbol uniqueness (
and a warning from ld that multiple symbols were encountered,
the proposal from Pixel). and leaves all applications that link
-lrpmio blissfully unaware of what RE implementation was
chosen for rpm when built.

Static linkage is another opt-in, not opt-out, configure option, with
some modest pain to insure that all paths are well known when rpm is  
linked.
FWIW, static linkage was recently verified on a Mandriva derived custom
system with using rpm-5.1.2. There's a missing libselinux -> libsepol
dependency that needs to be addressed, easily found, easily corrected,
when static linkage forces all symbols to be resolved at link, not load
as with DSO's, time.

And yes, there are issues with -all-static and security flaws that do  
not need rehashing.

Sure would be nice if Everything Just Worked!

Meanwhile, choose your build options wisely, according to
your needs, is the only viable path.

73 de Jeff