Re: custom copies of libraries (was Re: [Caml-list] OCaml Labs)

[Adrien <camaradetux@gmail.com>]

Mozilla, a corporation with a budget around 100 million USD, does this
for firefox and other software. Obviously, it seems to be working.

It seems.

Earlier this year, it was discovered they hadn't updated their version
of cairo for that had a known security hole for 6 months.

There's also APNG support. Except it requires a specially-patched
libpng which mozilla also ships along with the sources of firefox.

In the firefox 16 sources, you will find at least the media/,
security/, nsprpub/, gfx/, modules/ directories which are full of
libraries, almost all 3rd party. These five directories total 145MB, a
fourth of the total size of the firefox sources. The bz2 archive of
firefox is 86MB while the bz2 archive of thunderbird is 107MB and most
of the data probably overlaps.

Mozilla, with more than a hundred million USD has issues with it. I
think it's quite telling.

In the OCaml world, there used to be the Caml Development Kit (CDK): a
bundle of libraries you could include in your tarballs in order to not
depend on the libraries from the system. While things are different
for OCaml (static linking mainly), it still costs in size, compilation
time, maintainability, upgradability.

By including and preferring local copies of libraries, you make
integration, upgrades, maintenance harder. And when _you_ stop doing
it, it gets awful for others.

There are many downsides while the right way to do it is  much
simpler! It can be documentation (README or INSTALL files) and/or
compile-time checks (checking for version X.Y.Z). If it doesn't match
your expectations but the API is still compatible, you can issue a
warning but avoid aborting the build. Nowadays, OCaml libraries are
widely-available, properly packaged, and usually rely on ocamlfind.
There is really no need to do make local copies.

-- 
Adrien Nader