7 ms·

i'd like to welcome you to the hell that is c/c++ dependency management. Make? cmake? qmake? conf? autoconf? configure? autotools? submodules??? AAAAAAAAAAAAAAA

i'd like to welcome you to the hell that is c/c++ dependency management. Make? cmake? qmake? conf? autoconf? configure? autotools? submodules??? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

bayindirh 27d ago
I'd just select a tool, vendor the libraries I need to the codebase and call it a day. Did these for Eigen, liboption++, Catch2, Easylogging++ (now archived and not maintained anymore, sadly). Build a simple makefile, and you're off to the races. At least, for my cases, that is.
SSLy 27d ago
xmake, build2, whatever msvc and xcode insist upon…
justinhj 27d ago
vcpkg is pretty good. cmake is complex but very flexible. just need an llm to help and it's pretty much solved (if your dep is in autopkg)
skydhash 27d ago
None of those (other than submodules which is just vendoring) does dependency management. They are more configuration management than anything. C, Python, Perl (and maybe ruby?) relies on flag switches and environment variables to find all the necessary files and modules for compiling/running a script. Cmake and autoconf just configure those. With NPM and Rust's focus on project's level dependencies, there's no longer emphasis on API stability. Instead we have breakage every months, forcing everyone on the upgrade treadmill. It's easier to audit C library because they focus mostly on security updates instead of redesigning the API for the nth time.
nelup20 27d ago
Conan, Meson, Ninja, Bazel, meta-build tool / dependency manager #231 etc. etc. And then you have to deal with all the modern C++ and STL footguns. It never ends .·°՞(っ-ᯅ-ς)՞°·.
account42 27d ago
I'll take all that over downloading and immediately executing random unreviewed code any day.
- jeroenhd 27d ago
  All of those can (and some do) wget source code from the internet and run it if you kick off their build pipeline. People just tend to use these tools differently. Nothing is preventing anyone from distributing Rust crates as standard system packages, like some distros do with Python. I think Debian is actually shipping rust libs in their repositories: https://wiki.debian.org/Rust https://wiki.debian.org/Rust Now Rust developers can also enjoy having to deal with popular packages that are years out of date/missing from popular repositories/getting deleted.
  - account42 27d ago
    Of course they can be made to do anything but that's not what they are designed for and as a result they also build a culture that frowns upon doing that. Debian and other Linux distributions would have never had the policy do handle dependency resolution themselves if contemporary build systems automatically fetched everything automatically rather than being designed to use dependencies provided by the user.

i'd like to welcome you to the hell that is c/c++ dependency management. Make? cmake? qmake? conf? autoconf? configure? autotools? submodules??? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

bayindirh 27d ago

I'd just select a tool, vendor the libraries I need to the codebase and call it a day. Did these for Eigen, liboption++, Catch2, Easylogging++ (now archived and not maintained anymore, sadly). Build a simple makefile, and you're off to the races. At least, for my cases, that is.

SSLy 27d ago

xmake, build2, whatever msvc and xcode insist upon…

justinhj 27d ago

vcpkg is pretty good. cmake is complex but very flexible. just need an llm to help and it's pretty much solved (if your dep is in autopkg)

skydhash 27d ago

None of those (other than submodules which is just vendoring) does dependency management. They are more configuration management than anything. C, Python, Perl (and maybe ruby?) relies on flag switches and environment variables to find all the necessary files and modules for compiling/running a script. Cmake and autoconf just configure those. With NPM and Rust's focus on project's level dependencies, there's no longer emphasis on API stability. Instead we have breakage every months, forcing everyone on the upgrade treadmill. It's easier to audit C library because they focus mostly on security updates instead of redesigning the API for the nth time.

nelup20 27d ago

Conan, Meson, Ninja, Bazel, meta-build tool / dependency manager #231 etc. etc. And then you have to deal with all the modern C++ and STL footguns. It never ends .·°՞(っ-ᯅ-ς)՞°·.

account42 27d ago

I'll take all that over downloading and immediately executing random unreviewed code any day.

jeroenhd 27d ago
All of those can (and some do) wget source code from the internet and run it if you kick off their build pipeline. People just tend to use these tools differently. Nothing is preventing anyone from distributing Rust crates as standard system packages, like some distros do with Python. I think Debian is actually shipping rust libs in their repositories: https://wiki.debian.org/Rust https://wiki.debian.org/Rust Now Rust developers can also enjoy having to deal with popular packages that are years out of date/missing from popular repositories/getting deleted.
- account42 27d ago
  Of course they can be made to do anything but that's not what they are designed for and as a result they also build a culture that frowns upon doing that. Debian and other Linux distributions would have never had the policy do handle dependency resolution themselves if contemporary build systems automatically fetched everything automatically rather than being designed to use dependencies provided by the user.