Using submodules for third_party/

[Ira Cooper]

I'd encourage us to mirror our upstreams.  Just in case they do change, our
older builds don't become unreliable.  I'm not worried about master, I'm
worried about branches like 3.6 right now.  Two years is quite a long time.

My thoughts,

-Ira

On Saturday, December 6, 2014, Jelmer Vernooij <jelmer at samba.org> wrote:

> At the moment we're manually bundling a bunch of third party libraries
> in third_party/. Rather than keeping (usually partial) copy of these
> libraries in our Git repository, I would propose using git
> submodules where possible (in other words, where the upstream is using
> git). Submodules have come a long way since they were originally
> introduced in Git.
>
> Using submodules would have the following advantages. Mainly:
>
> * it is easy to avoid bundled third party libraries by simply not
>   running 'git submodule init'.
>
> * easy to review updates of upstream revisions we bundle; updating a
>   submodule shows up as a one-line diff. This means we can be sure
>   we're using an unmodified upstream revision; at the moment this is
>   hard to verify. You have to manually pull down a copy to verify that
>   the changes being made to the copy of a third party library are
>   the same as in the upstream repo.
>
> Some other nice benefits:
>
> * we're sure we always ship the pristine upstream source; what the
>   system version would provide too
>
> * easy to update, allows killing update-external.sh
>
> * reduces unnecessary growth of our own git repo :)
>
> There are two minor downsides I can think of:
>
> * after checkout, it is necessary to run 'git submodule init' to
>   do the initial checkout of submodules and then run 'git submodule
>   update' whenever there are changes to the submodules. This
>   can be avoided by setting the 'fetch.recurseSubmodules' setting in
>   Git to 'yes'.
>
> * if the upstream repository is down for some reason, you can't check
>   out the third party library. We could work around this by hosting
>   our own clone of third party libraries on git.samba.org.
>
>   That said, I don't think such a workaround is necessary. In the rare
>   cases that the upstream repository is down, users can always install the
>   system version of an external library (since we would only use
>   submodules for third party libraries).
>
>   This also only affects new checkouts and fetches of changes to the
>   submodules. If the submodule reference doesn't change, there is no
>   need for updates.
>
> Thoughts?
>
> Jelmer
> --
> Jelmer Vernooij <jelmer at samba.org <javascript:;>> - https://jelmer.uk/
>