U++ forum: Welcome to the forum

Re: build2 [message #49401 is a reply to message #49330]

Sun, 04 February 2018 11:51

alkema_jm
Messages: 25
Registered: November 2015

Promising Member

Hello mr_ped ,

Thank you for your feedback Smile

"A software repository, colloquially known as a "repo" for short, is a storage location from which software packages may be retrieved and installed on a computer. See https://en.wikipedia.org/wiki/Software_repository

>So is this some kind of "repository"?

No, Vcpkg is a (C++) Packaging Tool (on Windows platform) 'like' "apt-get install
" on Linux platform . It is a tool on top of Cmake and GIT. It installs cmake and git on windows. It has more than 600 'portfiles' to make projects:

index.php?t=getfile&id=5500&private=0

Who's signing/checking/publishing the files?

Source code is in the projects githubs.
The ("cmake") port files for libssh2, mysql, other github-projects can be pushed to the Vcpkg github.

>Can authors of library publish directly?

See https://github.com/Microsoft/vcpkg/blob/master/docs/examples /packaging-zlib.md
For example:
PS D:\src\vcpkg> .\vcpkg create zlib2 http://zlib.net/zlib-1.2.11.tar.gz zlib-1.2.11.zip
-- Using pre-downloaded: C:\dev\persinfonet\vcpkg\downloads\zlib-1.2.11.zip
-- If this is not desired, delete the file and C:\dev\persinfonet\vcpkg\ports\zlib2
-- Generated portfile: C:\dev\persinfonet\vcpkg\ports\zlib2\portfile.cmake
-- Generated CONTROL: C:\dev\persinfonet\vcpkg\ports\zlib2\CONTROL
-- To launch an editor for these new files, run
-- .\vcpkg edit zlib2

The port files will be stored at your local system.

>How is the originality of files authenticated? etc..

The port files can be put in local GIT with GIT-authentication.

You can look to (https://www.youtube.com/watch?v=a9PJnJhk1GI
) for (general) information about "Hardening Open Source Development".

>Looks similar to what we have in normal OS, but I personally prefer to build from sources as much as possible, due to review/security/preservation reasons, so I'm not big fan of things like maven or even "-dev" libraries packages in linux repositories, although already 98% of SW in my PC is from the distribution repository, so if it gets compromised.
Well, since you asked, build2 bpkg does this for Windows, Linux, Mac OS, and FreeBSD, currently.

See https://www.reddit.com/r/cpp/comments/5ud9sr/if_youre_doing_ windows_dev_and_not_using_vcpkg/ :
"The main difference is that it builds everything from source using exact compiler/version/options that you use for your application."

Than build 2 https://build2.org/ is the tool for you!

>I will be probably hit much much sooner on regular SW than building compromised binary due to modified library.
Anyway, looks interesting, but I don't need to build anything for windows, so I will pass on this one.

FYI: Build2 is Multi platform if you want to Packaging your projects on Multi platforms.

Greetings Jan Marco

Attachment: vcpkg_PackagingTool.jpg
(Size: 492.48KB, Downloaded 603 times)

[Updated on: Sun, 04 February 2018 15:13]

Report message to a moderator