search

rizsotto / Bear

Bear is a tool that generates a compilation database for clang tooling.
GNU General Public License v3.0
4.66k stars 308 forks source link

Make gRPC optional #478

Closed Timmmm closed 1 year ago

Timmmm commented 1 year ago

gRPC is a pretty huge dependency. It also pulls in a dependency on OpenSSL which is a right pain (I am currently debugging OpenSSL link errors). It also makes me a bit worried that this software randomly opens up an insecure RPC server (this?).

I assume gRPC is only needed for distributed builds. It would be nice if there was a CMake option to disable it.

rizsotto commented 1 year ago

Hey @Timmmm , the gRPC is used as a IPC between the processes. (Nothing to do with distributed builds.) I went for it because it works on the targeted OS. (I didn't have to write a portable IPC library which works on FreeBSD or Windows.)

There is no easy way to opt out with CMake option. It needs a rewrite of the IPC part.

For security perspective, it opens a random port on your localhost. (That is usually not accessible from outside, because localhost is 127.0.0.1 IP address. And the random port is also hard to find without scanning the whole port range.)

Timmmm commented 1 year ago

Damn. Such a shame the gRPC has become so popular. It has much worse design than Thrift which actually lets you swap out transports, so you don't end up using HTTP2 to communicate between processes on the same machine. Thrift supports loads of transport layers including Unix sockets and named pipes.

Dunno how well maintained it is these days though. Boost interprocess might be an easier option.