3 ms·
> Almost every C++ codebase out there vendor all dependencies. Looks like they are not using the system package manager. Yeah, e.g. Chromium. But that was also
by frankzinger 11y ago
> Almost every C++ codebase out there vendor all dependencies. Looks like they are not using the system package manager.
Yeah, e.g. Chromium. But that was also the reason why Fedora refused to provide packages for Chromium. Distros don't like projects that include their own versions of libraries because it goes against how things are supposed to work (maintenance and, by implication, a security nightmare). I know that there are many C++ projects in the various distro package repos, and no way do 'most of them' include their own copies of dependencies.
- p0nce 11y agoIn the closed source world I'd say most codebases are like Chromium (difficult to say of course). It's a bit like distributing an application with binary libraries and a no-go for security indeed.
- frankzinger 11y agoYeah I am sure it's very common in closed source or internal systems. One place I worked at recently did that. All of my comments are about open source systems such as Linux and BSD.