Many of the https://developer.download.nvidia.com/compute/cuda/redist/ packages come with empty DT_NEEDED, or otherwise dlopen undeclared dependencies. For example patchelf --print-rpath lib/libnvrtc.so is empty, but libnvrtc.so (depending on usage) tries to load libnvrtc-builtins.so at runtime.
This issue is particularly pronounced in pure-functional deployment systems such as Nixpkgs and Guix, where programs usually cannot accidentally load undeclared dependencies from a global shared location. The problem is not limited to Pure Functional package managers, because "FHS"-style distributions, likewise, need to guess the dependencies, but are prone to not notice the missing metadata until much later such as when building a minimal image to meet security requirements1.
In Nixpkgs we use DT_NEEDED entries and .note.dlopen sections to infer dynamic dependencies of pre-built binaries and autoPatchelf them with appropriate Runpaths. When libraries dlopen() undeclared dependencies we currently only discover this from users' error reports and have to handle these dependencies manually, e.g.
We're still looking for better way to do things, but it would be of much help if CUDA DSOs eager-loaded their dependencies via DT_NEEDED, (and) or adopted systemd's .note.dlopen standard2
EDIT HISTORY:
- 2025-04-20: Add
.note.dlopen references
Many of the https://developer.download.nvidia.com/compute/cuda/redist/ packages come with empty
DT_NEEDED, or otherwisedlopenundeclared dependencies. For examplepatchelf --print-rpath lib/libnvrtc.sois empty, butlibnvrtc.so(depending on usage) tries to loadlibnvrtc-builtins.soat runtime.This issue is particularly pronounced in pure-functional deployment systems such as Nixpkgs and Guix, where programs usually cannot accidentally load undeclared dependencies from a global shared location. The problem is not limited to Pure Functional package managers, because "FHS"-style distributions, likewise, need to guess the dependencies, but are prone to not notice the missing metadata until much later such as when building a minimal image to meet security requirements1.
In Nixpkgs we use
DT_NEEDEDentries and.note.dlopensections to infer dynamic dependencies of pre-built binaries andautoPatchelfthem with appropriate Runpaths. When librariesdlopen()undeclared dependencies we currently only discover this from users' error reports and have to handle these dependencies manually, e.g.We're still looking for better way to do things, but it would be of much help if CUDA DSOs eager-loaded their dependencies via
DT_NEEDED, (and) or adopted systemd's.note.dlopenstandard2EDIT HISTORY:
.note.dlopenreferencesFootnotes
https://lwn.net/Articles/969908/ ↩
https://systemd.io/ELF_DLOPEN_METADATA/ ↩