Re: Standardizing NO_NETWORK and USE_SYSTEM_DEPS environment variables

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------qsVp8nkzLsCD5s0ZTFEZBK2i
Content-Type: multipart/mixed; boundary="------------scpNYAF80P2k2BXytpy1r4XD";
 protected-headers="v1"
From: Eli Schwartz <[email protected]>
To: Bruno Haible <[email protected]>, [email protected],
 =?UTF-8?B?TWljaGHFgiBHw7Nybnk=?= <[email protected]>
Message-ID: <[email protected]>
Subject: Re: Standardizing NO_NETWORK and USE_SYSTEM_DEPS environment
 variables
References: <[email protected]>
 <9658083.GK2ZErXSoo@nimes>
In-Reply-To: <9658083.GK2ZErXSoo@nimes>

--------------scpNYAF80P2k2BXytpy1r4XD
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 1/23/25 8:50 AM, Bruno Haible wrote:
> Micha=C5=82 G=C3=B3rny wrote:
>> 2) USE_SYSTEM_DEPS -- if it's set to a non-empty value, it requests th=
at
>> the build system does not use any vendored dependency for which it
>> supports using a system version instead, and that it links to shared
>> libraries whenever possible.
>=20
> This contradicts the GNU Coding Standards [1]. For GNU packages,
> configuration of such things should be done through --with-* and --with=
out-*
> options. NOT through environment variables.
>=20
> Proposing something that contradicts the GNU Coding Standards is a non-=
starter.
>=20
> Bruno
>=20
> [1] https://www.gnu.org/prep/standards/html_node/Configuration.html


Meson will not implement this environment variable either, for the same
reason.

We won't implement either one, in fact (for us, network is relevant
since meson has an automatic feature to download vendored dependencies
on demand). We have a configuration option accepted on argv to control bo=
th.

=2E..

In general I think we are all quite aware of the reasons for avoiding
the network and in general build systems shouldn't attempt to
communicate via TCP/IP whether an environment variable is set or not...
unless the success of the build system directly hinges on network, and
failing to network directly means failing to build. That is the case for
meson with vendored deps, so configuring to use system deps already
means that no network connections will be made (but if you do use
vendored deps, all network downloads are securely verified via secure
hashes). So it suffices to simply design your build system to default to
system deps (meson already does this).

It's quite unclear to me why this should hinge on an environment
variable of all things. If you need an environment variable to control
this, you already failed somewhere else.


--=20
Eli Schwartz

--------------scpNYAF80P2k2BXytpy1r4XD--

--------------qsVp8nkzLsCD5s0ZTFEZBK2i
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wnsEABYIACMWIQTnFNnmK0TPZHnXm3qEp9ErcA0vVwUCZ5JNggUDAAAAAAAKCRCEp9ErcA0vV9c2
APsGRUSZEZ/neIaGTHH5zZmlSpNKrOzqJJ5eBGH2lFZ04AD/csB05ZZcNTTbvtcAeVkL8HSnF31h
XsP38jeUwSNErAs=
=yoin
-----END PGP SIGNATURE-----

--------------qsVp8nkzLsCD5s0ZTFEZBK2i--