Add note about vendoring dependencies

This commit is contained in:
Sean Molenaar 2020-09-01 20:47:41 +02:00 committed by GitHub
parent 5e5dabcadd
commit 8ac3cd0e70
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -77,6 +77,11 @@ Clang is the default C/C++ compiler on macOS (and has been for a long time). Sof
### Stuff that requires heavy manual pre/post-install intervention
We're a package manager so we want to do things like resolve dependencies and set up applications for our users. If things require too much manual intervention then they aren't useful in a package manager.
## Stuff that requires vendored versions of homebrew formulae
Homebrew formula should avoid having multiple, separate, upstream projects bundled together in a single package to avoid having shipping outdated/insecure versions of software that is already a formula.
For more info see [Debian](https://www.debian.org/doc/debian-policy/ch-source.html#s-embeddedfiles) and [Fedora's](https://docs.fedoraproject.org/en-US/packaging-guidelines/#bundling) stance on this.
### Sometimes there are exceptions
Even if all criteria are met we may not accept the formula.
Documentation tends to lag behind current decision-making. Although some