static libraries' policy

[Quentin Spencer]

Dmitry Butskoy wrote:

> Linus Walleij wrote:
>
>>> It seems that the recommendation to avoid the including of static 
>>> libraries into devel package does not work properly.
>>
>>
>>
>> It does. Very many if not all of the packages including static libs 
>> were probably made before the rule was in place.
>
>
> Unfortunately it is not so. I know some packages with static 
> libraries, which have been added recently.
>
> IMHO, "the rule was in place" 26.07.2005 (according to 
> http://fedoraproject.org/wiki/PackagingGuidelines?action=info, change 
> #31). There are 72 packages in the Extras which have been modified 
> since then, and still have static libs. BTW, also 109 such packages 
> are in the Core.
>
> Certainly not all these packages have been added recently -- 
> maintainers of some of them just could not notice the change of the 
> policy. But upcoming time of FC5test1 release should force them to 
> change for new policy.
>
>
> Total:
>
> Extras:
>   devel: 235
>   with-static: 149 (63%), since policy change: 72 (31%)
> Core:
>   devel: 364
>   with-static: 211 (58%), since policy change: 109 (30%)


I understand and agree with all of the reasons not to have static libs, 
but it should be noted the the guideline is "Packages including 
libraries should exclude static libs as far as possible". It is not 
always easy to get rid of them, but they should only be used when there 
is good reason to do so. I maintain one package (glpk) that does not 
build shared libraries, does not use autotools, and the upstream author 
is very unresponsive to patches to do so (others have sent them to him 
before). Since I don't have time to maintain a separate source tree, the 
libraries do not have potential security issues that I'm aware of (it's 
a math library), and are currently only used by only one other package, 
I have left the static library in the package.

Reviewers of packages should check for unnecessary static libraries, and 
packagers should be required to justify any inclusion of static 
libraries before a package is approved, but no matter how much we 
dislike them, getting rid of them completely right now is just not 
realistic. If a package has a static library that can be removed without 
causing problems, I would suggest filing a bug.

Related to this, I have another question: I was under the impression 
that we should avoid static linking but that static libraries were a 
standard part of -devel packages (or at least they have been in the 
past). Should we be excluding static libraries even from them as well? I 
always thought the guidelines referred to static linking and to putting 
static libs in the main non-devel packages.

-Quentin