Re: Anti-bundling materials

["J. Lewis Muir" <jlmuir%imca-cat.org@localhost>]

On 08/20, Jason Bacon wrote:
> 
> Does pkgsrc have a document somewhere similar to the following?
> 
> https://fedoraproject.org/wiki/Bundled_Libraries?rd=Packaging:Bundled_Libraries
> https://www.debian.org/doc/debian-policy/ch-source.html#s-embeddedfiles
> https://wiki.gentoo.org/wiki/Why_not_bundle_dependencies
> https://docs.freebsd.org/en/books/porters-handbook/special/#bundled-libs
> 
> I've had some positive responses sharing these links with upstream
> developers.  Also some silence, but never a negative response.  ;-)
> Increasing the size of the chorus might make it more convincing, though.

I assume you include in this the non-C/C++ library case too, right?  (To
me, the language the dependency is written in makes no difference; the
issues are the same.)

The practice of bundling (a.k.a. vendoring) is rampant in the Java and
Ruby world.  And, not speaking from experience, it seems similar in the
Node.js, Go, and Rust world, to name a few more.  FYI, it was discussed
in January on pkgsrc-users at

  https://mail-index.netbsd.org/pkgsrc-users/2021/01/22/msg033148.html

Unfortunately, the conclusion seemed to be that separately packaging all
of the dependencies was unworkable. :-(

I think it might be possible if the process of creating packages for
the dependencies was 100% automated.  But even if successful with that,
there's a second problem: getting upstreams to adopt a configurable
approach to be able to use externally supplied dependencies rather than
the bundled/vendored dependencies that they've been written for.

Lewis