Why does namcap say I don't need stuff I definitely do need?

Question

I have developed some bash scripts using ffmpeg, imagemagick's convert, yad, and lots of other tools that I had to explicitly install, but namcap claims I don't need to list any of those dependencies. It's called silentcast and makes it easy to create a variety of animated gif recordings of the screen. I haven't put it in the AUR yet because I'm still working on the README.md, but the package is basically ready for use and available on github: https://github.com/colinkeenan/silentcast/#silentcast. I created the animated gifs in that README.md with silentcast itself.
Anyway, I was listing all the dependencies in a table in the README.md and realized I had missed a lot of stuff so added more. Then, still worried I had missed something, I read the wiki to find out how to test for missing dependencies and discovered namcap. First, I tried running namcap on PKGBUILD, but that didn't do anything. Next, I did a makepkg -s and ran namcap on the package just created. Here's what namcap has to say:
namcap -i silentcast-1.0-1-any.pkg.tar.xz
silentcast I: Script link detected (bash) in file ['usr/bin/genffcom', 'usr/bin/silentcast', 'usr/bin/temptoanim']
silentcast I: Script link detected (python) in file ['usr/share/silentcast/transparent_window.py']
silentcast W: Dependency included and not needed ('ffmpeg')
silentcast W: Dependency included and not needed ('imagemagick')
silentcast W: Dependency included and not needed ('yad')
silentcast W: Dependency included and not needed ('xorg-xrandr')
silentcast W: Dependency included and not needed ('wmctrl')
silentcast W: Dependency included and not needed ('xdotool')
silentcast W: Dependency included and not needed ('xorg-xwininfo')
silentcast W: Dependency included and not needed ('python-gobject')
silentcast W: Dependency included and not needed ('python-cairo')
silentcast W: Dependency included and not needed ('xdg-utils')
silentcast I: Dependency covered by dependencies from link dependence (bzip2)
silentcast I: Dependency covered by dependencies from link dependence (readline)
silentcast I: Dependency covered by dependencies from link dependence (linux-api-headers)
silentcast I: Dependency covered by dependencies from link dependence (gdbm)
silentcast I: Dependency covered by dependencies from link dependence (perl)
silentcast I: Dependency covered by dependencies from link dependence (glibc)
silentcast I: Dependency covered by dependencies from link dependence (iana-etc)
silentcast I: Dependency covered by dependencies from link dependence (openssl)
silentcast I: Dependency covered by dependencies from link dependence (ncurses)
silentcast I: Dependency covered by dependencies from link dependence (gcc-libs)
silentcast I: Dependency covered by dependencies from link dependence (db)
silentcast I: Dependency covered by dependencies from link dependence (expat)
silentcast I: Dependency covered by dependencies from link dependence (tzdata)
silentcast I: Dependency covered by dependencies from link dependence (filesystem)
silentcast I: Dependency covered by dependencies from link dependence (libffi)
silentcast I: Dependency covered by dependencies from link dependence (sh)
silentcast I: Dependency covered by dependencies from link dependence (zlib)
silentcast I: Depends as namcap sees them: depends=(bash python)
So, namcap thinks I only need bash and python! This is crazy. All the stuff I listed as dependencies are explicitly called in the bash scripts or imported in the python script because they were needed in that script. Many of these I had to install myself and were certainly not included with bash and python! Why is namcap saying I don't need this stuff?
It occurs to me that maybe I haven't properly created the PKGBUILD so that namcap thinks the dependencies are covered by installing the various included scripts. Do I have to somehow make it clear all those scripts ARE the package? Here is my PKGBUILD.
# Maintainer: Colin Keenan <colinnkeenan at gmail dot com>
pkgname=silentcast
pkgver=1.0
pkgrel=1
pkgdesc="Silent Screencast: video record your screen and make it into an animated gif"
arch=('any')
url="https://github.com/colinkeenan/silentcast"
license=('GPL')
depends=('ffmpeg' 'imagemagick' 'yad' 'xorg-xrandr' 'wmctrl' 'xdotool' 'xorg-xwininfo' 'python-gobject' 'python-cairo' 'xdg-utils')
install=${pkgname}.install
source=('silentcast' 'genffcom' 'temptoanim' 'transparent_window.py' 'silentcast.desktop' 'README.md')
md5sums=('de05e0140e4640bf0b52077f4ade5a26'
'3b7311751662d8bd3034e4720239b070'
'6ce4638b3358ca388838cf650083a528'
'6bf9e695750a3f65e4421544c53bdb96'
'f1641d3959f479a97b6bcd26f103f900'
'539141058e7f8bcb99218e632a817e1e')
package() {
install -D -m755 silentcast "$pkgdir/usr/bin/silentcast"
install -D -m755 genffcom "$pkgdir/usr/bin/genffcom"
install -D -m755 temptoanim "$pkgdir/usr/bin/temptoanim"
install -D -m755 transparent_window.py "$pkgdir/usr/share/silentcast/transparent_window.py"
install -D -m755 silentcast.desktop "$pkgdir/usr/share/applications/silentcast.desktop"
install -D -m755 README.md "$pkgdir/usr/share/doc/silentcast/README.md"
Last edited by colinkeenan (2014-09-22 05:56:37)

Answer 1

colinkeenan wrote:The specific answer I was looking for and hoping namcap would give me had to do with xdg-open from the xdg-utils package. I use it to open the desktop's file-browser. On the Packages page for xdg-utils, optional dependencies are listed according to what desktop it's being run on. So, for example, I use Xfce and it lists 'exo' and 'xorg-xprop' as optional dependencies. I have no idea if those optional dependencies are actually required in order for my script to open the file-browser in Xfce.
How can you not know?  Do you use exo or xprop in the script or not?  If you only use xdg-open, then only specify that as a dependency.  Users can then figure out which specific tools they wish to use to satisfy that dependency.  I use my own replacement for xdg-open, and if I wanted I could package it listing "xdg-open" in the provides array so your tool would then call my xdg-open replacement tool.  It's not up to you to worry about how other users chose to implement xdg-open unless your scripts depend on a specific implementation.
Much the same could be bash.  If your script uses a bash hashbang, then bash is a dependency.  If you use a "sh" hashbang than any shell will do - but then you must use only posix shell commands and conditionals - there are a lot of "bashisms" that will not work in other shells (e.g. the [[ bash builtin for conditionals).  But even if bash is a dependency it does not need to  be listed: you should not list dependencies that are in base or base-devel.
On a related question that you touched on in this thread, you do not need to list recursive dependencies.  If you list python modules that have python as a hard dependency, then you do not need to list python.  But just like the 'bashisms' example above, if you use a specific version of python (2.7 or 3) these are generally not compatible.  The modules might not care which python is installed to meet it's needs, but your script may require a specific implementation of python.  In such a case, you'd have to specify which python you used in addition to the python module(s).
EDIT:
Bear in mind I just whipped this up on the spot, and I have no idea how reliable it is - but in principle the following line should find dependencies for any script or anything else for that matter - provided that simply running the script/command will use everything that is required:
pacman -Qqo $(strace ./script 2>&1 | awk '/^(open|stat|access)/ {sub(/[a-z]*\("/,"",$1); sub(/",/,"",$1); print $1}') 2>/dev/null | sort -u
This is assuming the script is in the current working directory and named "script".  I'll put together a more flexible and useful version momentarily.