On 8/22/21 1:10 PM, Andrew Cagney wrote:
To me, the things things are driving this are:- rapidly evolving projects dependant on a just as rapidly evolving set of external dependencies - freezing at least contains some of the complexity - language tools encouraging this by making freezing/bundling the accepted normno amount of moralizing will solve this.
Most of the libraries I see bundled in scientific software have a stable API. The upstream developers would have less trouble if they just left them out of the build and made the occasional minor code changes necessary. Many of them bundle as a path of least resistance, because their end-users struggle to properly install dependencies and point a build to them.
It's not a moral issue, it's practical advice for avoiding security holes and facilitating packaging that would make things much easier for their end-users.