On 28 December 2014 at 19:03, Dennis E. Hamilton <[email protected]> wrote:
> -- replying below to -- > From: jan i [mailto:[email protected]] > Sent: Sunday, December 28, 2014 09:42 > To: [email protected]; Dennis Hamilton > Subject: Re: MiniZIp/tidy-html Dependency (was RE: External libraries on > windows) > > On 28 December 2014 at 18:02, Dennis E. Hamilton <[email protected]> > wrote: > > > Regarding externals, I don't understand what the licensing problems with > > MiniZip and tidy-html are assumed to be. > > > > There is no licensing problem with appropriate derivatives of those > > sources in our code base. The licenses are MIT/BSD-like and all we have > to > > do is honor and preserve them and the copyright notices. > > > > To me the license problems start with the modifications, which are > relatively undocumented and detecting which license they are made under is > a challenge. > > <orcmid> > Whose modifications are we talking about? Ones made in the Corinthia > code base after these externals were incorporated or ones from some > other source? > > I would think the Corinthia-introduced changes are easy to recreate. > They might be, but it requires a careful comparing of sources. > </orcmid> > > [ ... ] > > > I do recommend going to the later version of MiniZip that supports 64-bit > > sizes though. And then looking into the zlib dependency. > > > I looked at that, and to me it looks just as easy to choose another > package, because we have to identify and redo all the changes. > > We use only a fraction of what even minizip can, so there is also a small > question about why so much for so little. My aim would be to find a library > which we as an external library without source. > > <orcmid> > I think this is a choose your poison sort of thing. If we use an > external library without source, we are subject to whatever > vulnerabilities arise in that dependency and have to stay on top > of it (and pray that there is current, active maintenance). > > I would be surprised to find an external library that is actually > lighter-weight and smaller [;<). > > If we make customizations for simplification and having an API that > is suitable for Corinthia, starting with source is valuable. If > we find defects in the original, it is important to submit upstream > patches of course. > I am moving in the direction of not needing sources for external libraries. Upgrades are so much easier to handle if all we need to do is download a new lib. We have the same problem with maintenance in case of minizip that is based on zlib. So for minizip, we have our own implementation (DFZipfile.c) a modified version of minizip and an external library....that seems overkill. Both peter and I have discussed the use of external libraries, and we both want to isolate them in platform, so that we can replace them if needed, without having to change a world of sources. Peter thinks we should write our own HTML parser to replace w3c, I tend to agree with him, even though I think we need a discussion first how we internally represent documents. > > My first instinct is to think this is more in the spirit. What > consideration am I missing? > Biggest problem is upgrading changed sources, that is no fun, and actually not needed, we can have our interface (DFZipFile.c) and that uses internally whatever the external library have as API. rgds jan i. > </orcmid> > > > rgds > jan i. > > > > > > - Dennis > > > > -----Original Message----- > > From: jan i [mailto:[email protected]] > > Sent: Sunday, December 28, 2014 05:17 > > To: [email protected] > > Subject: Re: External libraries on windows > > > > On 28 December 2014 at 14:11, Peter Kelly <[email protected]> wrote: > > > > > For OS X and Linux, external libraries used by Corinthia are fairly > > easily > > > installed through package manages (e.g. apt-get on Ubuntu, homebrew on > OS > > > X). For windows however, someone who wants to build the project must > > first > > > go through a manual process of downloading various zip files, > extracting > > > them into the right locations etc. > > > > > > To make it easier, I suggest that we host a copy of the libraries > > > necessary to build on Windows on the Corinthia website. I can put > > together > > > the directory structure and provide these as a zip file that someone > can > > > just download and extract to the right location. I think this would > make > > > development on windows a lot easier to begin for newcomers. > > > > > > Any objections to this? > > > > > [ ... ] > > > > > >
