From: Tom Lane <tgl@sss.pgh.pa.us>
To: Andres Freund <andres@anarazel.de>
cc: Thomas Munro <thomas.munro@gmail.com>,
        Peter Eisentraut <peter.eisentraut@enterprisedb.com>,
        samay sharma <smilingsamay@gmail.com>,
        Nazir Bilal Yavuz <byavuz81@gmail.com>, pgsql-hackers@postgresql.org
Subject: Re: [RFC] building postgres with meson - v13
In-reply-to: <20220915022626.5xx3ccgkzpkqw5mq@awork3.anarazel.de>
References: <20211012083721.hvixq4pnh2pixr3j@alap3.anarazel.de>
 <20220915022626.5xx3ccgkzpkqw5mq@awork3.anarazel.de>
Comments: In-reply-to Andres Freund <andres@anarazel.de>
	message dated "Wed, 14 Sep 2022 19:26:26 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3129308.1663218616.1@sss.pgh.pa.us>
Date: Thu, 15 Sep 2022 01:10:16 -0400
Message-ID: <3129309.1663218616@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3129309.1663218616%40sss.pgh.pa.us>
Precedence: bulk

Andres Freund <andres@anarazel.de> writes:
> I'm inclined to build the static lib on windows as long as we do it on other
> platforms.

Maybe I spent too much time working for Red Hat, but I'm kind of
unhappy that we build static libraries at all.  They are maintenance
hazards and therefore security hazards by definition, because if
you find a problem in $package_x you will have to find and rebuild
every other package that has statically-embedded code from $package_x.
So Red Hat has, or least had, a policy against packages exporting
such libraries.

I realize that there are people for whom other considerations outweigh
that, but I don't think that we should install static libraries by
default.  Long ago it was pretty common for configure scripts to
offer --enable-shared and --enable-static options ... should we
resurrect that?

			regards, tom lane