QA: urbanterror bundles a copy of jpeg and zlib

[hasufell]

Reasons why bundling is not preferred:

• security: bundled libraries are somehow out of the scope of packagers. As an example: zlib had many severe vulnerabilities and if packages bundle copies of zlib, then every single one of it needs to be fixed manually. If packages link to it, we just fix up the system lib and are done. These things are difficult to track and will cause security issues on the long run, cause developers/packagers and users might not even be aware that they are affected.
• maintenance: for you and for us. You modify it, we have to track down security issues, QA issues, build time issues and plain bugs not just for the system lib, but also for every modified copy in every possible package. So that you not think I'm talking stuff... this already happens for us, e.g. with Irrlicht or premake or lua which are often bundled. I also have to report bugs in several places instead of one, because I cannot be sure if you merge fixes regularly from upstream.
• support: experience shows that people who bundle stuff don't accept bug reports for their bundled libraries although they might have modified them heavily (popular example is freeorion which "forked" gigi, but does not support it at all). Take it up with upstream they say. When I do it, upstream will tell me: erm, we don't support random forks. Maybe your version even introduces new bugs. No one will be responsible. This decreases support.
• size: increased size, both in memory and on the disk, obvious
• breakage: it happens from time to time that some packagers carelessly unbundle libraries without contacting upstream first and thus (partly) breaking the application for the end-user (this happened with supertuxkart on some distros afair). This is also partly upstreams fault, especially when there is no information on which exact version was bundled and what changes have been applied, thus indicating that it is just bundled for convenience.

[TTimo]

Thank you for your advice. We are bundling those libraries because we ran into a few cases where players did not have the library, or had an incompatible version of it.

We will not dilute our energy trying to support each distribution with their packaging systems and byzantine rules, so we decided to bundle. While some of your arguments are valid concerns, we have determined that it is better for the project to keep the current setup.

[hasufell]

That can lead to distros dropping your software in case it is causing security trouble.

Besides, the jpeg version is ancient. That has nothing to do with incompatibility. It's just bitrot.

[TTimo]

Sounds like a risk we're willing to take then. I shudder at the possibility.

[hasufell]

Cool, while users will have to take that risk too (wrt to security).