From 8d537260afc6a499a2b45ff1049f9ba9024a23ad Mon Sep 17 00:00:00 2001 From: Sean Molenaar Date: Tue, 15 Aug 2023 17:18:33 +0200 Subject: [PATCH] chore: document the policy on static libraries --- docs/Acceptable-Formulae.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/Acceptable-Formulae.md b/docs/Acceptable-Formulae.md index 68c40e966e..335e0d5aef 100644 --- a/docs/Acceptable-Formulae.md +++ b/docs/Acceptable-Formulae.md @@ -73,6 +73,12 @@ Clang is the default C/C++ compiler on macOS (and has been for a long time). Sof We're a package manager so we want to do things like resolve dependencies and set up applications for our users. If things require too much manual intervention then they aren't useful in a package manager. +### Static libraries + +In general, packages should not ship static libraries since these can not be updated without a rebuild of the dependant software. +If a package gets a lot of request to provide static libraries they may be provided by the package. +Applications in homebrew/core linking against libraries should link against shared libraries not static versions. + ### Stuff that requires vendored versions of Homebrew formulae Homebrew formulae should avoid having multiple, separate, upstream projects bundled together in a single package to avoid shipping outdated/insecure versions of software that is already a formula. Veracode's [State of Software Security report](https://www.veracode.com/blog/research/announcing-state-software-security-v11-open-source-edition) concludes: