How should I manage dependencies in C or C++ open source projects?

Question

I've got a few open source applications. These depend on a few third party components, notably Crypto++ and Boost. There are a couple of options to take:

• Put third party code into version control, and include it with distributions of my code. On one hand, this is the easiest for people to use because they can compile directly out of my source control repository. On the other, they might be wasting bandwidth downloading source they already have, or end up having to fight with my library in order to remove the third party bits. Furthermore, source control tools often have trouble dealing with massive libraries like Boost.
• Don't include third party code at all. This forces people to go out of their way to be able to use my library. On the other hand it means my source control repository and distributions will be small.
• Something I have not yet anticipated.

What should I do?

Note: I'm not working in an environment where reliance on a dependency mapper like aptitude, apt-get, or yum are acceptable.

Answer 1

Option 3: Don't include it in your code distribution but instead include a (link to a) download, which should match the most recent version you support.
Also, explicitly list your dependencies and the most recent versions you support.

This allows users to do however they want. Want your code with dependencies? Load both from one source. Want only part of the dependencies because you have the others? Load part of them. Want only your code? Load it seperately.

Option 4: Offer 2 versions, one including the dependencies and the other without but combined with option 3 above.

Answer 2

I suggest Autoconf which was designed to abstract these worries away from you.

I doubt you can be expected to maintain build scripts for all of your dependencies across all platforms. Another problem with keeping 3rd party code in your svn is that now you also need to track down their dependencies and so on.

Answer 3

I think its a good idea to have dependencies in the SVN. That way developers can simply check-out and compile. Also you avoid the problem with different incompatible versions of your dependencies.

If you put the dependencies in a separate folder then developers can choose not to check-out your dependencies if they alrdy have them...