Hello, Depending on the scenario, someone who is building SVN can obtain its dependencies either 1) from the OS package manager or 2) from version control or from the source release packages of the dependencies themselves. The latter requires configuring, building and installing each dependency from source. As far as I understand, get-deps.sh only downloads the source code of the dependencies but that's it. The user still has to build and install them. So is the only benefit of get-deps.sh that it downloads the tarballs and extracts them? Or am I missing something? Or rewording the question, who is the indended user of the get-deps.sh script?
I see that the script downloads fixed versions of the dependencies and they aren't the latest (so I think that the versions aren't "best"), If I use the script without modifications, I'll get outdated versions of the components. This question came up while I was working on the INSTALL document (r1937573[1] and r1937576[2]). Since get-deps.sh by default downloads outdated versions of the dependencies and there is an easier alternative in the form of a package manager, I don't think that recommending get-deps.sh to everyone as the way to obtain the dependencies is a good advice. And if a package maintainer builds the SVN and its deps from source code, wouldn't they be using another path for downloading the source code of the dependencies anyway? BTW, I think that get-deps.sh has an issue that it doesn't verify the authenticity of what it downloads. Subversion historically provided a special tarball distribution of its dependencies, which was later removed. It seems to me that these deps tarballs were signed[3], so there was a simple way to verify their authenticity. The get-deps.sh script was added as a replacement then to help download the dependencies[4], but without any verification of the downloaded source code. [1]: https://svn.apache.org/viewvc/?revision=1937573&view=revision [2]: https://svn.apache.org/viewvc/?revision=1937576&view=revision [3]: https://web.archive.org/web/20120319033429/http://subversion.tigris.org/servlets/ProjectDocumentList?folderID=260&expandFolder=74 [4]: https://svn.apache.org/viewvc/?view=revision&revision=945330 -- With best regards, Pavel Lyalyakin
