On 7/6/14, 16:57, Michael Tremer wrote:
> That's what we call bundled packages (very often libraries) and which
> are extremely discouraged. The problem that comes with that is that when
> a component gets updated to resolve a certain issue this problem is
> still in the twenty other copies of the same software. Imagine that for
> things like Heartbleed. It also consumes space, increases the build time
> and so on.
>
> You should use the provided versions of those tools and libraries or
> modify them if that is required. All other components that are missing
> should be created as individual packages.

Hey,

So I've got 4 new addons built and in the process noticed that apr and 
apr-util are both not included as separate packages. I think that httpd 
makes use of them but provides the sources bundled which seems to go 
against what you recommend above. Like for instance, in Debian apr and 
apr-util are both provided as modular separate packages. So this is what 
I did while playing around. I built two addons for both apr and apr-util 
because subversion also has those as dependencies. I then specified 
--with-apr and --with-apr-util to my newly added apr and apr-util 
packages when ./configure'ing subversion. It all builds nicely and I'm 
just waiting on my clean/build to test packages on my live IPFire box.

Long story, but I'm curious about why apache makes used of bundled third 
party sources here, is this a special case that requires to go against 
what's encouraged?

For the record, I don't believe that something like subversion belongs 
to a nice trimmed down firewall OS, but I needed it for quick checkout 
of sources on my box and thought it might be occasionally useful.

Regards,

-- 
GH