ldd vs rpm -q --requires

Question

could someone please explain why the ldd and rpm -q --requires outputs differ from each other ?

I'm checking against curl

[root@localhost ~]# rpm -qa curl
curl-7.29.0-59.el7_9.1.x86_64
[root@localhost ~]# ldd /usr/bin/curl
        linux-vdso.so.1 =>  (0x00007ffe07f09000)
        libcurl.so.4 => /lib64/libcurl.so.4 (0x00007fa3d7e2e000)
        libssl3.so => /lib64/libssl3.so (0x00007fa3d7bd1000)
        libsmime3.so => /lib64/libsmime3.so (0x00007fa3d79a9000)
        libnss3.so => /lib64/libnss3.so (0x00007fa3d7675000)
        libnssutil3.so => /lib64/libnssutil3.so (0x00007fa3d7445000)
        libplds4.so => /lib64/libplds4.so (0x00007fa3d7241000)
        libplc4.so => /lib64/libplc4.so (0x00007fa3d703c000)
        libnspr4.so => /lib64/libnspr4.so (0x00007fa3d6dfe000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fa3d6be2000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007fa3d69de000)
        libz.so.1 => /lib64/libz.so.1 (0x00007fa3d67c8000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fa3d63fa000)
        libidn.so.11 => /lib64/libidn.so.11 (0x00007fa3d61c7000)
        libssh2.so.1 => /lib64/libssh2.so.1 (0x00007fa3d5f9a000)
        libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007fa3d5d4d000)
        libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007fa3d5a64000)
        libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007fa3d5831000)
        libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007fa3d562d000)
        liblber-2.4.so.2 => /lib64/liblber-2.4.so.2 (0x00007fa3d541e000)
        libldap-2.4.so.2 => /lib64/libldap-2.4.so.2 (0x00007fa3d51c9000)
        librt.so.1 => /lib64/librt.so.1 (0x00007fa3d4fc1000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fa3d8098000)
        libssl.so.10 => /lib64/libssl.so.10 (0x00007fa3d4d4f000)
        libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007fa3d48ec000)
        libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007fa3d46dc000)
        libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007fa3d44d8000)
        libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fa3d42be000)
        libsasl2.so.3 => /lib64/libsasl2.so.3 (0x00007fa3d40a1000)
        libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fa3d3e7a000)
        libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007fa3d3c43000)
        libpcre.so.1 => /lib64/libpcre.so.1 (0x00007fa3d39e1000)
        libfreebl3.so => /lib64/libfreebl3.so (0x00007fa3d37de000)

But when running rpm -q --requires curl-7.29.0-59.el7_9.1.x86_64 I'm not getting some of the shared libraries like /lib64/libk5crypto.so.3 returned. AFAIK rpm -q --requires should return all the capabilities required by curl-7.29.0-59.el7_9.1.x86_64 in order to run:

[root@localhost ~]# rpm -q --requires curl-7.29.0-59.el7_9.1.x86_64
libc.so.6()(64bit)
libc.so.6(GLIBC_2.14)(64bit)
libc.so.6(GLIBC_2.17)(64bit)
libc.so.6(GLIBC_2.2.5)(64bit)
libc.so.6(GLIBC_2.3)(64bit)
libc.so.6(GLIBC_2.4)(64bit)
libc.so.6(GLIBC_2.7)(64bit)
libcurl = 7.29.0-59.el7_9.1
libcurl.so.4()(64bit)
libdl.so.2()(64bit)
libnspr4.so()(64bit)
libnss3.so()(64bit)
libnssutil3.so()(64bit)
libplc4.so()(64bit)
libplds4.so()(64bit)
libpthread.so.0()(64bit)
libpthread.so.0(GLIBC_2.2.5)(64bit)
libsmime3.so()(64bit)
libssl3.so()(64bit)
libz.so.1()(64bit)
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rtld(GNU_HASH)
rpmlib(PayloadIsXz) <= 5.2-1

But when I run strace on curl I can see that the mentioned shared library is being 'called':

[root@localhost ~]# strace curl 2>&1 |  grep open
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libcurl.so.4", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libssl3.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libsmime3.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libnss3.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libnssutil3.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libplds4.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libplc4.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libnspr4.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libz.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libidn.so.11", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libssh2.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libgssapi_krb5.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libkrb5.so.3", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libk5crypto.so.3", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/liblber-2.4.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libldap-2.4.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/librt.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libssl.so.10", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libcrypto.so.10", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libkrb5support.so.0", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libkeyutils.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libsasl2.so.3", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libcrypt.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libpcre.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libfreebl3.so", O_RDONLY|O_CLOEXEC) = 3
open("/etc/pki/tls/legacy-settings", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
open("/root/.curlrc", O_RDONLY)         = -1 ENOENT (No such file or directory)

What am I missing ?

Stephen Kitt · Answer 1 · 2021-01-12T18:23:34.890

ldd lists all the libraries that are required, including those that are required transitively. The RPM metadata only lists direct dependencies:

$ readelf -d /usr/bin/curl | grep NEEDED
 0x0000000000000001 (NEEDED)             Shared library: [libcurl.so.4]
 0x0000000000000001 (NEEDED)             Shared library: [libssl3.so]
 0x0000000000000001 (NEEDED)             Shared library: [libsmime3.so]
 0x0000000000000001 (NEEDED)             Shared library: [libnss3.so]
 0x0000000000000001 (NEEDED)             Shared library: [libnssutil3.so]
 0x0000000000000001 (NEEDED)             Shared library: [libplds4.so]
 0x0000000000000001 (NEEDED)             Shared library: [libplc4.so]
 0x0000000000000001 (NEEDED)             Shared library: [libnspr4.so]
 0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.0]
 0x0000000000000001 (NEEDED)             Shared library: [libdl.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libz.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]

The command above lists the libraries declared as dependencies by the binary itself. This matches the list of dependencies (along with version symbols, see readelf -V). All the other libraries shown by ldd are transitive dependencies.

The transitive library dependencies are reflected in the transitive RPM dependencies; for example the Kerberos libraries are pulled in by libcurl.so.4, and appear in libcurl’s metadata.

Okay. But may I ask you what is the difference between rpm -q --requires and readelf -d. If I'm not mistaken both list only direct dependencies, yes ? Thank you in advance ! — cyzczy, Jan 12 '21 at 17:36
That’s right, they list direct dependencies: rpm lists those declared by the package, readelf those declared by the curl binary itself (the former is constructed from the latter). — Stephen Kitt, Jan 12 '21 at 18:24

ldd vs rpm -q --requires

1 Answers1

Linked