Re: [RFC] building postgres with meson - v13

Hi,

On 2022-09-15 01:10:16 -0400, Tom Lane wrote:
> Andres Freund <andres(at)anarazel(dot)de> writes:
> > I'm inclined to build the static lib on windows as long as we do it on other
> > platforms.
>
> Maybe I spent too much time working for Red Hat, but I'm kind of
> unhappy that we build static libraries at all.

Yea, I have been wondering about that too.

Oddly enough, given our current behaviour, the strongest case for static
libraries IMO is on windows, due to the lack of a) rpath b) a general library
search path.

Peter IIRC added the static libraries to the meson port just to keep the set
of installed files the same, which makes sense.

> They are maintenance hazards and therefore security hazards by definition,
> because if you find a problem in $package_x you will have to find and
> rebuild every other package that has statically-embedded code from
> $package_x. So Red Hat has, or least had, a policy against packages
> exporting such libraries.

It obviously is a bad idea for widely used system packages. I think there are
a few situations, e.g. a downloadable self-contained and relocatable
application, where shared libraries provide less of a benefit.

> I realize that there are people for whom other considerations outweigh
> that, but I don't think that we should install static libraries by
> default. Long ago it was pretty common for configure scripts to
> offer --enable-shared and --enable-static options ... should we
> resurrect that?

It'd be easy enough. I don't really have an opinion on whether it's worth
having the options. I think most packaging systems have ways of not including
files even if $software installs them.

Greetings,

Andres Freund