[geos-devel] RFC6 - Discourage use of C++ API by requiring a configure switch to install the c++ headers and SDK

[Bas Couwenberg]

On 2017-10-05 11:49, Robert Coup wrote:
> On 5 October 2017 at 07:02, Sebastiaan Couwenberg <sebastic at xs4all.nl>
> wrote:
> 
>> On 10/05/2017 12:34 AM, Robert Coup wrote:
>> > Alternative is to work with on C++ APIs/ABIs and compatibility with the
>> > distros and make it clear that having 7 versions of GEOS installed is
>> > completely normal. And woe betide if there's a security problem with the
>> > WKB parser that affects them all. But that's a huge amount of effort to
>> go
>> > to for something the project has recommended against since forever...
>> 
>> That may be fine for fink, but having more than one version of a 
>> library
>> is not acceptable for Debian and neither is it for EPEL AFAIK. So the
>> above is not going to happen in the most popular Linux distributions.
>> 
> 
> Trying to understand this a bit deeper - it's possible to have 2x GDALs
> installed. eg. libgdal1h and libgdal20 will live side by side (though
> python-gdal/gdal-bin clash), but you're saying a particular release
> (xenial/jessie) will only ever have 1x GDAL package in it?

Yes, Debian distributions will only ever have a single gdal package, 
Ubuntu by extension will too (because they just copy the packages from 
Debian) although newer versions are available in the UbuntuGIS PPA 
(which is a separate repository from the Ubunu ones). The same goes for 
other packages like geos, spatialite, rasterlite, spatialindex, postgis, 
etc, only one version will be included in the distribution that all 
reverse dependencies will use.

Multiple versions make security updates more complex because more than 
one package needs to be patched, and also makes integration of reverse 
dependencies more complex because they'll need to be adapted for one of 
the versions.

If you need newer GDAL on Debian stable releases, you either need to 
backport the Debian package and update all reverse dependencies, or you 
need to not use the package and compile gdal and its reverse 
dependencies yourself (all in /usr/local).

Kind Regards,

Bas