Bug#856932: Fwd: Bug#856932: hashcat dependency problem

[Phil]

---------- Forwarded message ----------
From: Phil <philsmd at hashcat.net>
Date: Tue, Mar 7, 2017 at 2:33 PM
Subject: Re: Bug#856932: hashcat dependency problem
To: Raphael Hertzog <hertzog at debian.org>


Hello Raphael,

Thank you for your answer and the explanations.

Well, as said, the only correct way would be that the "hashcat" package
directly depends on NVidia drivers, AMD drivers or Intel drivers.

But as far as I understood this can't be enforced because otherwise the
hashcat package can't be installed by default (and debian has the policy
which doesn't allow non-free packages to be shipped by default).

Yeah, it would make sense to have a dependency tree like this:
hashcat depends on hashcat-nvidia | hashcat-amd | hashcat-intel
hashcat-nvidia depends on [proprietary Nvidia driver], hashcat-base
hashcat-amd depends on [proprietary AMD driver], hashcat-base
hashcat-intel depends on [proprietary Intel driver], hashcat-base

(where "|" means "or"  and the [] denotes the correct drivers from
nvidia.com, support.amd.com and software.intel.com correspondingly).

If we do it like this, we must make sure that it is kind of irrelevant
which hashcat-* package the user has installed, hashcat-base should always
be there and hashcat should *always* behave the same way (aka it should be
the same code)... only the driver should be different.


The problem is these changes wouldn't improve things significantly, because
we still have the problem that the default installation wouldn't work at
all and that the user doesn't know what he should do to get it running.

It would also be great if we could find a solution which allows us to keep
the pre-installed hashcat package. Therefore, I think that we need some
kind of first-run notice and install script. E.g. something like "You are
running hashcat for the first time and neither the Nvidia driver, AMD
driver, nor the Intel driver was found on your system. The following
hardware was detected: [list of CPU/GPUs of supported vendors IDs]. Please
select which of these drivers should be installed: [limited list depending
on hardware]".

Or do you think there are better solutions? Of course we shouldn't try to
develop an utterly complicated wrapper, but I think there isn' t much
alternative to a detect-hardware-and-install-script.

What do you think?

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/pkg-security-team/attachments/20170308/1c886dbd/attachment.html>