David> I'm glad it works for you.  When I tested it with Debian and
David> Ubuntu I had to install the development packages but otherwise it
David> went smoothly. I'm considering adding libffi to the poly source
David> since it's licensed under the BSD licence.

Ian> I understand the appeal of this solution, but at least on Debian it
Ian> is seriously frowned upon.  The maintainer of the Debian package
Ian> would probably have to undo it and use the pkg-config interface
Ian> anyway to get the package accepted.

David> What is the problem?  Is it the licensing or the inclusion of a
David> library that is already separately available as a package?  I was
David> really considering it specifically for use on Windows where
David> mingw/msys doesn't include pkg-config (though I did manage to
David> find a version on the gtk download site, so it's not really an
David> issue any more).

As I understand it, the objection to embedding external library sources
is twofold: both "philosophical" and practical.  

The philosophical part is that Debian tries to do The Right Thing (TM)
even if it is hard, and I think that we can all agree that The Right
Thing in this context is to link to an existing shared library as
opposed to embedding the source.

The practical part has mostly to do with security fixes.  If a
vulnerability is discovered in libffi, there is no way to scan the
sources of all the ~30k packages and hunt for those that might contain a
copy of libffi to fix them.

-- 
Ian Zimmerman
gpg public key: 1024D/C6FF61AD
fingerprint: 66DC D68F 5C1B 4D71 2EE5  BD03 8A00 786C C6FF 61AD
Rule 420: All persons more than eight miles high to leave the court.
_______________________________________________
polyml mailing list
polyml@inf.ed.ac.uk
http://lists.inf.ed.ac.uk/mailman/listinfo/polyml

Reply via email to