RFC: convenience copy of cddlib

[bremner@unb.ca]

Hi All;

I'm currently (well, currently for a few years :( ) packaging
polymake, a perl and C++ based workbench for discrete geometry and
topology (think math grad students).  polymake contains private copies
of 3 libraries that are now in Debian: cddlib, lrslib, and nauty (the
latter two packaged by me, the first by Tim, I think as part of
sagemath?).

I can use the system copy of lrslib and nauty, but I have discovered
what is probably an insurmountable issue with using the debian cddlib.
I thought I would throw this out there, and see if I missed some
solution that isn't worse than the problem.

cddlib produces two libraries: libcdd uses floating point arithmetic,
and libcddgmp use gmp.  Unfortunately there is a large overlap of
symbols between the two of them, as cdd upstream never envisioned
wanting to use both at the same time.  Polymake does need to link to
both versions, according to the polymake authors.  The polymake
solution is to rename the conflicting symbols in libcddgmp at compile
time.

I see two solutions so far:

1) patch the debian cddlib package to produce a third library,
   libcdd_gmp (or whatever) that can be linked together with
   libcdd. This basically migrates the polymake abi changes to the
   debian package, and maybe eventually upstream.

2) just use the convenience copy. I wouldn't be so foolish as to
   promise that there will never be a security problem in cddlib, but
   it seems relatively low risk.  No network access, for example.

Feedback gratefully received,

David