Re: CVE check for Octave dependencies

[c.]

On 19 Dec 2013, at 08:54, Reza Housseini <address@hidden> wrote:

> I think dependencies of dependencies shouldn't be on the list (will be 
> resolved when user is installing the dependencies).

They will be resolved automatically if using a package manager like macports, 
but I know at least one core developer who stronly opposes
using a package manager to build Octave binaries on OSX. In the latter case 
knowing all build- and run-time dependencies is useful info.

In any case here is a (much shorter) list including direct dependencies only:

$ sudo port installed and depof:octave-next  
+atlas+gcc47-x11+no_x11-aquaterm-metis-wxwidgets+qt and active | sed 
's/(active)//g' 
Password:
The following ports are currently installed:
  arpack @3.1.3_0+atlas+gcc47 
  atlas @3.10.1_5+gcc47 
  bison @2.7.1_0 
  curl @7.33.0_0+ssl 
  epstool @3.08_6 
  fftw-3 @3.3.3_5+gcc47 
  fftw-3-single @3.3.3_5+gcc47 
  flex @2.5.37_1 
  gawk @4.1.0_0 
  ghostscript @9.10_1+no_x11 
  glpk @4.48_0 
  gnuplot @4.6.4_1+luaterm+pangocairo+qt 
  gperf @3.0.4_2 
  GraphicsMagick @1.3.18_0+q8 
  grep @2.14_0 
  gsed @4.2.2_0 
  hdf5-18 @1.8.11_0+cxx+gcc47 
  less @458_0 
  libgcc @4.8.2_0 
  ncurses @5.9_2 
  pcre @8.33_0 
  perl5 @5.12.4_0+perl5_12 
  pstoedit @3.61_3 
  qhull @2012.1_2 
  qrupdate @1.1.2_2+atlas+gcc47 
  qscintilla @2.7.2_0 
  readline @6.2.000_0 
  SuiteSparse @4.2.1_0+atlas 
  zlib @1.2.8_0 

Notice that this list applies when building from a released tarball, building 
from mercurial will require more stuff (at least latex to build the docs).
c.