Re: custom copies of libraries (was Re: [Caml-list] OCaml Labs)

[Ralf Treinen <treinen@free.fr>]

On Sun, Oct 21, 2012 at 08:45:53PM +0900, Yoriyuki Yamagata wrote:
> 2012/10/21 Ralf Treinen <treinen@free.fr>:
> > avoiding custom copies of libraries that are published independently,
> 
> Completely off-topic, but is making custom copies so bad thing?  I
> incline to include third-party's libraries into my libraries unless
> the library is too big, so that the my libraries are compiled with
> libraries whose behaviors are tested and guaranteed.

Adrien's message has explained very well the problem : it makes it
impossible to upgrade all installed copies of a library when it
becomes necessary. This is particularly bad when there is a security
problem with a certain version of a library. In other words, using
custom copies of libraries may be easier at the moment, but it
is not sustainable in the long run.

> If we have a good package management system, things would be a bit
> different, but still a package management system guarantees only, say,
> that the version numbers of libraries are higher than XXXX, which does
> not preclude many problems.

That depends on the kind of version constraints that your packaging system
allows for, and how you use them when you build a package for your 
application. Debian gives you the choice of version constraints
(<<, <=, >>, >=, ==, !=), and I imagine other packaging system do the
same. It is up to the packager to use the constraints that fit the best
for his case (or use the right tools that generate these).

Cheers -Ralf.