Defect
Capsem_0.6.0_arm64.deb declares:
Depends: libwebkit2gtk-4.1-0, libgtk-3-0, libxdo3
There is no libc6 dependency, but the shipped binaries require glibc >= 2.39.
Reproduced by hand:
$ docker run --rm -v "$PWD:/src" debian:bookworm-slim bash -c \
"dpkg-deb --extract /src/dist/Capsem_0.6.0_arm64.deb /tmp/pre && /tmp/pre/usr/bin/capsem-admin --version"
/tmp/pre/usr/bin/capsem-admin: /lib/aarch64-linux-gnu/libc.so.6: version `GLIBC_2.39' not found
Impact
On Debian bookworm (glibc 2.36), Ubuntu 22.04 (2.35), and anything older, apt install succeeds — every declared dependency is satisfiable — and then every binary fails at runtime. The user gets a package that installed cleanly and does nothing, instead of a clear "unsatisfiable dependency" refusal at install time.
Why CI does not catch it
The install gate builds and installs on ubuntu:24.04 (docker/Dockerfile.host-builder), which ships glibc 2.39. Every supported-distro claim below that is untested. This fails on a user's machine, never in the gate.
Fix directions
- Derive Depends instead of hand-writing them.
dpkg-shlibdeps generates the correct libc6 (>= X) and library floors from the actual binaries. The current hand-written list captures the GUI libs and silently omits libc — exactly the class of omission automation prevents.
- Decide and state the supported floor. If Debian stable / Ubuntu LTS are supported targets, the release binaries must be built against an older glibc (or statically/musl-linked for the CLI cohort). If they are not supported, the packaging should refuse to install there rather than install and break.
- Test install on the oldest supported distro, not only on the build image. A matrix entry that installs the exact .deb on the declared floor would have caught this.
Pointers
scripts/repack-deb.sh — where Depends is setdocker/Dockerfile.host-builder — FROM ubuntu:24.04, the only distro the install proof ever seesjustfile _gate-install — the install proof
Defect
Capsem_0.6.0_arm64.debdeclares:There is no
libc6dependency, but the shipped binaries require glibc >= 2.39.Reproduced by hand:
Impact
On Debian bookworm (glibc 2.36), Ubuntu 22.04 (2.35), and anything older,
apt installsucceeds — every declared dependency is satisfiable — and then every binary fails at runtime. The user gets a package that installed cleanly and does nothing, instead of a clear "unsatisfiable dependency" refusal at install time.Why CI does not catch it
The install gate builds and installs on
ubuntu:24.04(docker/Dockerfile.host-builder), which ships glibc 2.39. Every supported-distro claim below that is untested. This fails on a user's machine, never in the gate.Fix directions
dpkg-shlibdepsgenerates the correctlibc6 (>= X)and library floors from the actual binaries. The current hand-written list captures the GUI libs and silently omits libc — exactly the class of omission automation prevents.Pointers
scripts/repack-deb.sh— where Depends is setdocker/Dockerfile.host-builder—FROM ubuntu:24.04, the only distro the install proof ever seesjustfile_gate-install— the install proof