Make rpath optional

[ged]

Original report by Vít Ondruch (Bitbucket: vo_x, ).

---

As a resolution of #146, you added explicitly the -rpath option. While I understand this solves some issues, it causes issues for rubygem-pg Fedora package, since Fedora discourages usage or rpaths. I would be glad, if this change could be optional or reverted and the fix is applied where it belongs [2].

[1] https://fedoraproject.org/wiki/Packaging:Guidelines#Beware_of_Rpath
[2] https://fedoraproject.org/wiki/Packaging:Guidelines#Alternatives_to_Rpath

[ged]

Original comment by Vít Ondruch (Bitbucket: vo_x, ).

---

Just for the record, this is output of Fedora's tool for checking RPATH:

$ /usr/lib/rpm/check-rpaths-worker /var/lib/mock/fedora-f21-ruby-x86_64/root/builddir/build/BUILD/rubygem-pg-0.17.1/usr/lib64/gems/ruby/pg-0.17.1/pg_ext.so 
*******************************************************************************
*
* WARNING: 'check-rpaths' detected a broken RPATH and will cause 'rpmbuild'
*          to fail. To ignore these errors, you can set the '$QA_RPATHS'
*          environment variable which is a bitmask allowing the values
*          below. The current value of QA_RPATHS is 0x0000.
*
*    0x0001 ... standard RPATHs (e.g. /usr/lib); such RPATHs are a minor
*               issue but are introducing redundant searchpaths without
*               providing a benefit. They can also cause errors in multilib
*               environments.
*    0x0002 ... invalid RPATHs; these are RPATHs which are neither absolute
*               nor relative filenames and can therefore be a SECURITY risk
*    0x0004 ... insecure RPATHs; these are relative RPATHs which are a
*               SECURITY risk
*    0x0008 ... the special '$ORIGIN' RPATHs are appearing after other
*               RPATHs; this is just a minor issue but usually unwanted
*    0x0010 ... the RPATH is empty; there is no reason for such RPATHs
*               and they cause unneeded work while loading libraries
*    0x0020 ... an RPATH references '..' of an absolute path; this will break
*               the functionality when the path before '..' is a symlink
*          
*
* Examples:
* - to ignore standard and empty RPATHs, execute 'rpmbuild' like
*   $ QA_RPATHS=$[ 0x0001|0x0010 ] rpmbuild my-package.src.rpm
* - to check existing files, set $RPM_BUILD_ROOT and execute check-rpaths like
*   $ RPM_BUILD_ROOT=<top-dir> /usr/lib/rpm/check-rpaths
*  
*******************************************************************************
ERROR   0001: file '/var/lib/mock/fedora-f21-ruby-x86_64/root/builddir/build/BUILD/rubygem-pg-0.17.1/usr/lib64/gems/ruby/pg-0.17.1/pg_ext.so' contains a standard rpath '/usr/lib64' in [/usr/lib64]

[ged]

Original comment by Michael Granger (Bitbucket: ged, GitHub: ged).

---

What issues for the rubygem-pg Fedora package does it cause?

[ged]

Original comment by Vít Ondruch (Bitbucket: vo_x, ).

---

So far it is just against policy, but the policy prevents against real world issues as explained in the link I provided in my initial comment as well as by the output of the check-rpaths-worker command.

[ged]

Original comment by Michael Granger (Bitbucket: ged, GitHub: ged).

---

Your initial links certainly say "beware of rpath", but don't provide any insight into why it's (seemingly) always bad to use it. It just describes what it does, which in pg's case is exactly what it's meant to do: ensure that the extension links against a specific version of libpq, namely the one it's compiled against.

The policies of one distribution of one of the many OSes supported by Ruby and PostgreSQL do not in my mind trump the additional insurance provided by setting rpath, but if you're motivated to provide some mechanism to omit it at gem-install time then I'll happily accept a pull request/patch for it.

[junaruga]

@ged Why is this ticket closed?

I tested this old issue on the latest master branch 4419c2e with the ruby configured with ./configure --enable-mkmf-verbose on Fedora Linux 42.

The testing log is below.

My environment:

$ which ruby
~/.local/ruby-4.1.0dev-debug-dcfbbdc38c-openssl-4.0.0-dev-1cb0d36b39/bin/ruby

$ ruby -v
ruby 4.1.0dev (2026-01-08T09:48:38Z master dcfbbdc38c) +PRISM [x86_64-linux]

$ sudo dnf install libpq-devel

$ bundle config set path vendor/bundle

$ bundle install

I ran the following command. And I still can see the rpath -Wl,-rpath,/home/jaruga/.local/ruby-4.1.0dev-debug-dcfbbdc38c-openssl-4.0.0-dev-1cb0d36b39/lib, -Wl,-rpath,/usr/lib64, -Wl,-rpath,/home/jaruga/.local/ruby-4.1.0dev-debug-dcfbbdc38c-openssl-4.0.0-dev-1cb0d36b39/lib.

$ bundle exec rake compile
...
gcc -shared -o pg_ext.so gvl_wrappers.o pg.o pg_binary_decoder.o pg_binary_encoder.o pg_cancel_connection.o pg_coder.o pg_connection.o pg_copy_coder.o pg_errors.o pg_record_coder.o pg_result.o pg_text_decoder.o pg_text_encoder.o pg_tuple.o pg_type_map.o pg_type_map_all_strings.o pg_type_map_by_class.o pg_type_map_by_column.o pg_type_map_by_mri_type.o pg_type_map_by_oid.o pg_type_map_in_ruby.o pg_util.o -L. -L/home/jaruga/.local/ruby-4.1.0dev-debug-dcfbbdc38c-openssl-4.0.0-dev-1cb0d36b39/lib -Wl,-rpath,/home/jaruga/.local/ruby-4.1.0dev-debug-dcfbbdc38c-openssl-4.0.0-dev-1cb0d36b39/lib -L/usr/lib64 -Wl,-rpath,/usr/lib64 -L. -fstack-protector-strong -rdynamic -Wl,-export-dynamic -Wl,--no-as-needed -Wl,--compress-debug-sections=zlib    -Wl,-rpath,/home/jaruga/.local/ruby-4.1.0dev-debug-dcfbbdc38c-openssl-4.0.0-dev-1cb0d36b39/lib -L/home/jaruga/.local/ruby-4.1.0dev-debug-dcfbbdc38c-openssl-4.0.0-dev-1cb0d36b39/lib -lruby -lpq  -lm -lpthread  -lc
...

Maybe the following logic can be skipped in Linux case, since the logic's comment says the logic is for MacOS-X.

ruby-pg/ext/extconf.rb

Lines 221 to 226 in 4419c2e

	# Try to use runtime path linker option, even if RbConfig doesn't know about it.
	# The rpath option is usually set implicit by dir_config(), but so far not
	# on MacOS-X.
	if dlldir && RbConfig::CONFIG["RPATHFLAG"].to_s.empty?
	append_ldflags "-Wl,-rpath,#{dlldir.quote}"
	end

[junaruga]

Sorry I might make mistake. I needed to test this on Fedora pg gem RPM package (rubygem-pg).

[larskanis]

That code was introduced 13 years ago. I think it can be removed now, since this was an issue in an old ruby version. If the rpath is configured in ruby , then dir_config will use it, otherwise it shouldn't. I'll open a PR for that.

[junaruga]

@larskanis Okay. Thanks for your working to open the PR. That's great.