Bundling exception
Applying for bundling exception: boost-logging in bombono-dvd
I have submitted bug 2140, a review request for bombono-dvd. It contains
one possibly bundled library boost-logging. It's a header only package
in boost sandbox. It has been rejected for inclusion in boost, and it's
not part of Fedora.
This application is based on the assumption that a header-only package
is a "bundled package" in the packaging context. If I'm wrong in this,
please let me know, and many problems are solved...
The situation has been discussed in the bug. All agree on that the
correct, long-term solution is to use the upcoming boost-log package
instead. This was accepted for inclusion in boost in early 2010, and
have since then been in development. A fair guess should be that it's
about to be included in core boost in a not so far future.
One alternative in this situation would be to package the existing
boost-logging library separately. Technically, this is easy being
headers only. However, this package is not maintained since 2008. Since
there is no use of it in Fedora today (I've tried to search for the main
header), and that it's really unlikely that any new code will use it,
such a package doesn't make any sense.
The other alternative is to package boost-log separately. This is, from
my horizon, technically more complicated - the boost lib have a build
universe of it's own. But the main problem is that such a package will
conflict with boost core as soon as boost-log is made part of it. Of
course, anything is possible using paths and ifdefs, but it seems like a
wasted effort when boost-log will became available in boost core anyway.
So: I apply for an exception to bundle boost-logging in bombono-dvd, a
temporary measure until boost-log is moved into boost core.
The standard questions:
- Yes, the library has been modified. The overall diff is >6000 lines,
baselined w latest svn version.
- Ilya, the Bombono developer, has been in contact w John Torjo, the
author of the package. As I understand the situation, John torjo has
lost interest in it when it was rejected from inclusion in boost core.
He has not made any attempts to fix things after 2008, including input
from Ilya.
- The package does not exist in Fedora, no maintainer to discuss with.
- The 'bombono version' is of no interest to others as explained above,
nor is the unpatched original sources.
- Upstream is dead.
- Upstream's attitude towards bundling is unknown.
- This is a logging package, basically stream io to files and console.
I see no immediate security concerns in this type of software(?)
- The plan is to unbundle the package when boost-log becomes part of
boost. This should be a minor fix.
Links:
Review request: https://bugzilla.rpmfusion.org/show_bug.cgi?id=2140
boost-logging: http://torjo.com/log2/doc/html/index.html
boost-log: http://boost-log.sourceforge.net/libs/log/doc/html/index.html
boost-logging svn: https://svn.boost.org/svn/boost/sandbox/logging