needread

Overview ¶

Command needread prints the DT_NEEDED entries of every ELF under a tree, and refuses to report unless a symbol it was told to expect is actually there.

It exists because "this package links no openssl" and "this program cannot read a DT_NEEDED" print identically, and the second gets read as the first.

⛔ THAT IS NOT HYPOTHETICAL. On 2026-10-28 a sweep of a 189-project pantry with go-pkgx/bk's `bk unlinked` produced 140 findings, of which ten were C++ libraries reported as linking no C++ runtime. The finding was not surprising but IMPOSSIBLE, and that is the only reason anybody looked: the check had attributed `libstdc++.so.6` to whichever of two projects shipping a file of that name it walked last. A second reader, sharing no code with the first, is what settled it — and it was only worth trusting because its control passed.

needread -must libgcc_s.so.1 store/gnu.org/libiconv store/gnu.org/gcc

prints each ELF with its NEEDED list and then, having found the control, says so. If nothing under the roots needs that soname it exits non-zero and says the measurement proved nothing, rather than printing an absence that looks like a finding.

⛔ CHOOSE THE CONTROL SO IT CAN FAIL FOR THE RIGHT REASON. The first run of this against libiconv used `-must libstdc++.so.6` and failed — correctly: nothing in a three-package closure consumes it, so the control said nothing about the reader. Re-run with `libgcc_s.so.1`, which libstdc++ itself needs, it passed and the absence below it became evidence. A control naming something the tree has no reason to contain only measures the fixture.