[NTLUG:Discuss] apt-get, rpm and library versioning

[Kevin Brannen]

Burton Strauss wrote:

> 
>-----Original Message-----
>From: Leroy Tennison
>
>
>Burton Strauss wrote:
>
><snip />
>
>  
>
>>You know, I think it's time to stop trying to simplify our life.  If
>>    
>>
>SuperDuperFunction is going to be 
>  
>
>>so much different than SuperFunction then create >another library.  Yes,
>>    
>>
>this profilerates 'executables' 
>  
>
>>but allows older code to still work without creating a 'jet-powered
>>    
>>
>stagecoach' combination of the latest 
>  
>
>>and greatest whiz-bang features along with backwards compatibility.  DASD
>>    
>>
>is getting really cheap, may 
>  
>
>>as well use it.
>>    
>>
>
>
>Nope, that's no better.
>
>You end up with 100s of versions of popular libraries hard linked into
>programs (that's what STATIC linking does).
>
>Then when you find a problem in, say, OpenSSL, you have to replace EVERY
>single hard-linked package.  Miss ONE and you are exposed to the security
>problems.  Dynamic linking means you only have to replace the one .so file.
>  
>

There is need for both.  I would say dynamic linking should be the norm 
for the reason you cite, plus the fewer files reason is nice too.

But there are times when static linking is very desireable, such as when 
you (whoever but a commercial program is the most obvious) need to 
create a program that will "just work" as long as basic OS requirements 
are met (kernel, disk space, RAM, etc.).  Not worrying about what 
libraries are installed is a big relief.

Static linking is also good for those programs that are very hard to 
make work/compile.  An example of this is Gaim, at least it has been 
hard for me to compile from source (and I consider myself reasonably 
good at building software, so I have great sympathy for those who don't 
know much about compiling software because they have no hope of making a 
working Gaim).  But creating a statically linked Gaim is not possible 
because the Gnome people (GTK specifically) have not created nor do they 
support nor will they support creating static GTK libs.  So if you can't 
get the right combination of software on your machine to compile Gaim, 
you're screwed.  Copying just the binary from a friend is not an option 
because there is no statically linked version of the binary.

So the exceptions may be few, but when you need static linking, you 
probably need it badly.

Kevin