3 ms·
Vendored copies of libraries is a special case that's unrelated to this discussion. This discussion is about a distro whose packages dynamically link to the dis
by Arnavion 2y ago
Vendored copies of libraries is a special case that's unrelated to this discussion. This discussion is about a distro whose packages dynamically link to the distro's zlib package vs a distro whose packages statically link to the distro's zlib package.
- consteval 2y agoI don't think vendored copies are a special case or unrelated. For example, Debian does not allow vendored copies of libs. You have to use the version provided by the system, even if it's out of date or not the one you prefer. This explicit disallowing of different code versions also greatly improves security and threat response. This recently (ish) bit hyprland, because they used a pinned version of wlroots, and the version of wlroots on Debian wouldn't work. And they couldn't just dynamically link to this pinned wlroots because that's still not around. If the version of wlroots in Debian, hypothetically, contains a vulnerability, then only one change is needed instead of two. I would argue if you allow static linking you implicitly encourage vendoring. I can't imagine such a distro where static linking is allowed, but there are 0 packages which use different lib commits.