Bug#888705: abseil-cpp packaging
On Tue, Feb 18, 2020 at 2:31 AM Benjamin Barenblat <bbaren@debian.org> wrote:
> On Sunday, February 16, 2020, at 10:48 PM +0100, László Böszörményi (GCS) wrote:
> > In my reading abseil is _not_ guaranteed to have ABI compatibility at
> > all times. That's why it meant to be a static library collection only.
> > Forcing it to build shared libraries and have other packages than
> > libabseil-cpp-dev is no sense I think.
>
> Abseil does reserve the right to break ABI at any time, and I can’t
> speak to their future plans. But I think ABI breakages are unlikely to
> occur in practice within an LTS release. If we wait and then package an
> LTS release, I it’ll be completely reasonable to ship .so’s and .a’s.
There's a compatibility page[1] what Abseil is and isn't. It states
the following things.
"We do not promise any ABI compatibility — we intend for Abseil to be
built from source, hopefully from head. The internal layout of our
types may change at any point, without notice."
As I read waiting for LTS releases might be late (its head commit
version advised to be used). I guess other Google applications other
libraries commonly wants newer Abseil releases than LTS ones.
"Not all Abseil libraries are suitable for dynamic loading. Some
libraries have startup/initialization requirements and may not be
suitable for dynamic loading. We will try to be clear about which
libraries are OK for dynamic loading. However we don’t generally
deploy code in this fashion, mistakes are possible, [...]".
That is, even shared libraries can be built, those are not guaranteed to work.
"We will not break API compatibility. If we must, we will ship a tool
to automate the upgrade to a preferred API."
Seems to suggest using the head (latest commit) freely and link with
the static libraries of the applications.
> Relatedly, I think we should only package LTS Abseil for Debian. If
> someone finds a CVE in Abseil, the Abseil team are going to want to
> backport the fix to LTS releases; they’re not going to want to backport
> it everywhere else.
I think there should be a compatibility matrix or test if the latest
LTS release is enough for most Google applications or those need newer
versions (no new API added for recent application development). Even
if I agree that LTS releases are better for long time use cases and
from security point of view.
> > @Benjamin: may you ask its developers to use the system gtest libraries
> > if only ABSL_RUN_TESTS set to ON?
>
> Absolutely. I’ll bring it up with them at work tomorrow (today was a US
> holiday).
Thanks. Please keep us posted how it goes.
Regards,
Laszlo/GCS
[1] https://abseil.io/about/compatibility
Reply to: