On 24/03/2020 23:05, Simon McVittie wrote: > On Tue, 24 Mar 2020 at 15:14:02 -0700, Russ Allbery wrote: >> I think this calculus is not entirely obvious. > Thank you for applying some much-needed nuance to this issue. I suspect > the ideal policy is neither "never use vendored dependencies" nor > "always use vendored dependencies". > > Many of our packaging policies were designed for medium-sized C/C++ > libraries - not much smaller than, say, zlib, but not much bigger than > something like GTK either - with a sufficiently stable API and ABI that > versions are somewhat interchangeable, and I think the further away > from that we get, the less well those policies will fit. We have a lot > of trouble with micropackages (as exemplified by the nodejs ecosystem > in which many packages provide a single function), but at the other end > of the scale, monoliths like Libreoffice, TeXLive and Firefox don't fit > a lot of our usual policies and practices so well either. > We should probably look at formalizing a concept of "bundle" packages, shipping either a number of static libs-like files (go) in a -dev package
or a bundle of microlibs in a libjs-* package. Dependencies using them would use Built-Using: for package construction but also ship a description of the exact content versions. Note that we also have bunches of lib* packages shipping multiple small C/C++ shared libs, as upstream does it this way; we need to set policies in place for handling incompatible upgrades in these cases: what do we need to do to ship multiple incompatible copies of a Go static lib (do we ever do that? ) One example: openmpi ships multiple shared libs in a libopenmpi3 package. I'm arguing with upstream that the SOVERSIONS of the shared libs need to be kept in lockstep so that if for example package 'libopenmpi3' ships 'libopen-pal.so.40', then 'libopenmpi4' does not; the soversions gets bumped to '*.so.50*' for them all, even if no code changes in this particular library. > smcv > -- Alastair McKinstry, email: alast...@sceal.ie, matrix: @alastair:sceal.ie, phone: 087-6847928 Green Party Councillor, Galway County Council
