How to manage external dependencies which are constantly being modified

Question

Our development uses lots of open-source code and I'm trying to figure out what the best way to manage these external dependencies.

Our current configuration:

• we are developing for both linux and windows
• We use svn for our own code
• external dependencies (boost, log4cpp, etc) are not stored in svn. Instead I put them under ./extern (or c:\extern on windows). I don't want to put them in our repository because I will not be able to update them that way. Some of these are constantly being updated.

My questions

• What to do if I need to modify external code? Currently I have created a folder in my svn repository called extern_hacks and that is where I put the modified external code. I then link (or copy on windows) the files into the external directory structure. This solution is problematic since it is hard to keep track of copying the files, and very hard to update from svn when files are sitting in two repositories (mine for the modified files, and the original repository say sourceforge)

• How to manage versions of external dependencies?

I'm interested to hear how others deal with these issues. Thanks.

Answer 1

I keep them in svn, and manage them as vendor branches. Keeping them loose externally makes it very hard to go back to a previous build, or fix bugs in a previous build (especially if the bug is from a change to the external dependency)

Keeping them in svn has saved me lots of headache, and also allows you to get a new workstation able to work on your codebase quickly.

Answer 2

I do not understand why you say

I don't want to put them in our repository because I will not be able to update them that way. Some of these are constantly being updated.

You really need to

1. include external dependencies in your source control and periodically update them and then tese, test, test.

2. Coordinate your build process with the updates for the external dependencies.

If your code depends upon something, then you really need to have control over when it gets updated/modified. Coding in a space where these dependencies can get updated at any time is too painful as you're no doubt finding out. I personally prefer option 1.