Unbundle libraries #403

mrueg posted onGitHub

Is it possible to get the libraries that are put in lib/ unbundled or to provide a cmake option that allows using a system-wide installed library?

hi @mrueg ,

I did not understand, would you please provide an example about the ideal behavior and use case ?

posted by edsiper over 7 years ago

@edsiper e.g., fluent-bit currently bundles mbedtls. As a user I want to be able to update mbedtls independently from fluent-bit, so I can take care of potential security vulnerabilities quicker without requiring a new fluent-bit release.

posted by mrueg over 7 years ago

Now I understand. Since library linking in the project is static (fixed in cmake build files) this will need some kind of extension. I think it would be easier to implement if it were optional just for "known" libraries (e.g: mbedtls, onigmo, monkey, etc). Also would be good to experiment with new ones without touch cmake. I am considering this part as an enhancement request.

As a second comment about security issues, if that happens I'd like to be the first one to know since I will do a release ASAP. we care a lot about it.

posted by edsiper over 7 years ago

Fwiw, i fully support this. I can understand that for embedded target it makes sense, but for regular distribution/packaging, it is awful to bundle source copies of libraries like this without providing a way to build against an external lib, be it for msgpack, mbedtls, onigmo or others.

posted by landryb over 7 years ago

@landryb

for now priority is bundled, but I agree that having the option to use an external library should be fine too for some users.

This can be considered an enhancement request, personally I'd wait for a contribution on this area (pull requests). Contributors are welcome.

posted by edsiper over 7 years ago