Why does harfbuzz-devel pull in so many dependencies?

I am compiling a package which depends on harfbuzz, and noticed there were a lot of seemingly random dependencies getting pulled in when installing the harfbuzz-devel package. See below:

sudo zypper --installroot $(realpath _test) in harfbuzz-devel
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following 196 NEW packages are going to be installed:
  aaa_base aaa_base-extras adjtimex adobe-sourcecodepro-fonts bash busybox busybox-grep busybox-sed busybox-xz ca-certificates ca-certificates-mozilla
  cantarell-fonts chkstat coreutils cpio cpio-mt dbus-1 dconf diffutils dump-rmt filesystem fillup findutils freetype2-devel gawk gio-branding-openSUSE
  girepository-1_0 glib2-devel glib2-tools glibc glibc-devel glibc-extra glib-networking graphite2-devel gsettings-backend-dconf gsettings-desktop-schemas
  harfbuzz-devel iproute2 iputils krb5 libacl1 libattr1 libaudit1 libblkid1 libblkid-devel libbrotlicommon1 libbrotlidec1 libbrotli-devel libbrotlienc1
  libbz2-1 libbz2-devel libcap2 libcap-ng0 libcom_err2 libcrypt1 libcrypto46 libdb-4_8 libdbus-1-3 libdconf1 libeconf0 libelf1 libexpat1 libfdisk1 libffi8
  libffi-devel libfreetype6 libgcc_s1 libgcrypt20 libgdbm6 libgdbm_compat4 libgio-2_0-0 libgirepository-1_0-1 libglib-2_0-0 libgmodule-2_0-0 libgmp10
  libgnutls30 libgobject-2_0-0 libgpg-error0 libgraphite2-3 libgthread-2_0-0 libharfbuzz0 libharfbuzz-gobject0 libharfbuzz-icu0 libharfbuzz-subset0
  libhogweed6 libicu68 libicu68-ledata libicu-devel libidn2-0 libkeyutils1 liblua5_4-5 liblz4-1 liblzma5 libmnl0 libmount1 libmount-devel libncurses6
  libnettle8 libnsl2 libnss_usrfiles2 libopenssl1_1 libp11-kit0 libpcre1 libpcre16-0 libpcre2-16-0 libpcre2-32-0 libpcre2-8-0 libpcre2-posix2 libpcrecpp0
  libpcreposix0 libpkgconf3 libpng16-16 libpopt0 libproxy1 libpython3_8-1_0 libreadline8 libressl libselinux1 libselinux-devel libsemanage2 libsemanage-conf
  libsepol2 libsepol-devel libsmartcols1 libsqlite3-0 libssl48 libstdc++6 libstdc++6-devel-gcc10 libstdc++-devel libsystemd0 libtasn1 libtasn1-6 libtirpc3
  libtirpc-netconfig libtls20 libunistring2 libutempter0 libuuid1 libverto1 libxcrypt-devel libxml2-2 libxtables12 libz1 libzstd1 linux-glibc-devel
  login_defs logrotate ncurses-utils netcfg openSUSE-release openSUSE-release-appliance-custom p11-kit p11-kit-tools pam pam_unix pcre2-devel pcre-devel perl
  perl-base permissions permissions-config pkgconf pkgconf-m4 pkgconf-pkg-config policycoreutils python38 python38-appdirs python38-base python38-curses
  python38-dbm python38-gobject python38-ordered-set python38-packaging python38-pip python38-pyparsing python38-setuptools python38-six rpm rpm-config-SUSE
  selinux-autorelabel selinux-tools shared-mime-info shared-python-startup sound-theme-freedesktop system-group-hardware system-user-root sysuser-shadow
  terminfo-base terminfo-screen time timezone typelib-1_0-HarfBuzz-0_0 update-alternatives util-linux which zlib-devel

The following NEW product is going to be installed:
  "openSUSE Tumbleweed"

The following 14 recommended packages were automatically selected:
  adjtimex ca-certificates-mozilla glibc-extra login_defs ncurses-utils python38 python38-curses python38-dbm python38-pip selinux-autorelabel
  sound-theme-freedesktop terminfo-screen time which

196 new packages to install.
Overall download size: 90.9 MiB. Already cached: 0 B. After the operation, additional 327.9 MiB will be used.
Continue? [y/n/v/...? shows all options] (y): 

300 MB of dependencies seems like a lot. There’s a lot in that list that doesn’t seem relevant for a text rendering library. Comparing to freetype-devel (30MB) and libharfbuzz0 (40MB), it seems out of place.

sudo zypper --installroot $(realpath _test) info --requires harfbuzz-devel
Loading repository data...
Reading installed packages...

Information for package harfbuzz-devel:
Repository     : Main Repository (OSS)
Name           : harfbuzz-devel
Version        : 2.8.0-1.1
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 1.2 MiB
Installed      : No
Status         : not installed
Source package : harfbuzz-2.8.0-1.1.src
Summary        : Development files for the HarfBuzz OpenType text shaping engine
Description    : 
    HarfBuzz is an OpenType text shaping engine.
    This package contains the development files.
Requires       : [12]
    pkgconfig(freetype2) >= 12.0.6
    libharfbuzz-gobject0 = 2.8.0
    libharfbuzz-icu0 = 2.8.0
    libharfbuzz-subset0 = 2.8.0
    libharfbuzz0 = 2.8.0
    typelib-1_0-HarfBuzz-0_0 = 2.8.0

Those all seem like reasonable dependencies. I tried installing each of them to see which was pulling in an unusually large number of dependencies, but none seemed like the culprit. Does anyone know what’s going on here? How come harfbuzz-devel wants to install things like libressl?

EDIT: pkgconfig(glib-2.0) means glib2-devel package, which seems to be pulling in all the extra dependencies. I guess it makes sense why glib-devel requires all of these.

The following NEW product is going to be installed:
“openSUSE Tumbleweed”

That does not look good.

Are you on Tumbleweed or Leap?
Can you show which repositories with the URL’s are enabled (“sudo zypper lr -u”) and post output between CODE tags (use the hash character button)

The prefix of his thread title say TUMBLEWEED :wink: