Hacker News Reader

Comment by nwmcsween | Hacker News Reader

Please don't use cmake, the dependency chain it pulls in on a bare machine is massive.

I hate and am deeply suspicious of dependencies but I just did 'brew deps cmake' on my machine and it printed nothing.

Some CMakefiles have many and gratuitous dependencies but that's the fault of those authors.

If dependencies are a problem, you could always use the pre-compiled version from cmake.org. It uses the bundled 3rd party libs.

I prefer software that uses mature 3rd party libs over NIH driven rewrites. Please also keep in mind that CMake is available for many platforms sone with fading user base like AIX, HPUX, or Solaris. Using a well tested event library like libuv helps to keep those supported.

What does it require over and above what you'd need for development anyway? The vagrant provision script for my Ubuntu VM installs this lot before grabbing the CMake source and building it:

    apt-get -y install subversion git make gcc g++ subversion emacs git-gui zip gksu synaptic gdb valgrind

I'm pretty sure that not all of these are actually required. You do need gcc and g++, I'm sure, but I expect Valgrind and GDB are strictly optional...

Gentoo lists:

    app-crypt/rhash
    >=app-arch/libarchive-3.0.0:=
    >=dev-libs/expat-2.0.1
    >=dev-libs/libuv-1.10.0:=
    >=net-misc/curl-7.21.5[ssl]
    sys-libs/zlib
    virtual/pkgconfig
    emacs? ( virtual/emacs )
    system-jsoncpp? ( >=dev-libs/jsoncpp-0.6.0_rc2:0= )

of which most have dependencies as well which is honestly ridiculous for a build system.

Those look like exactly the kinds of dependencies I'd go for if I needed to write a new C build system. Nothing ridiculous about them.

The emacs dependency is odd to say the least, but I'm pretty sure CMake doesn't actually depend on it. I don't know much about Gentoo but perhaps the question mark after it means it's just a suggested dependency.

Anything dep a ? is optional

It will be the cmake-mode for editing CMakeLists.txt files.

Perhaps they configured it that way? Maybe these are optional dependencies that provide additional functionality.

I was able to build it on a Ubuntu VM after installing no more than gcc, g++ and make.

apt list --installed suggests this VM does have a surprising amount of stuff installed (more than I'd expected at any rate), but of the dependencies you list it appears to have zlib, curl, and nothing else.

Gentoo gives 'use' flags for configurable options, I stripped those out and posted the hard dependencies.

FreeBSD only lists 6:

> libcurl.so : ftp/curl > libexpat.so : textproc/expat2 > libjsoncpp.so : devel/jsoncpp > libuv.so : devel/libuv > librhash.so : security/rhash > libarchive.so.13 : archivers/libarchive

https://www.freshports.org/devel/cmake/

I also build CMake from source on Ubuntu (because they used to ship ridicously ancient versions and I have keep doing it since) and there is the possibility to use bundled versions of those dependencies. Also, for a development tool I see nothing wrong with those dependencies, I do not have to redistribute all of this.

And for those compiling everything from source like Gentoo or FreeBSD ports users, I do not understand it because most of the time is spent on building gcc or clang anyway which is absolutely not optional.

What's wrong with dependencies?

Every dependency increases the fragility of your program. What if you update the dependency and it breaks your program? What if you have two programs dependent on the same library -- but different versions? This just scratches at the surface of the problem.

Sometimes the risk is worth it: you need some complex functionality not worth writing yourself. In that case it's a good thing. But understand that it's a tradeoff.

This is a very dangerous argument for anything but the most domain specific or simple logic. Every time I roll something non trivial rather than using the widely testing and "battle hardened" alternative that increases the fragility of my program.

There are times when it makes sense, but those are the special cases, and carry a cost which should be considered.

> you need some complex functionality not worth writing yourself.

well, CMake supports downloading stuff from the internet - git repositories, etc. If you want to be able to download from https:// addresses I sure hope that you won't reimplement it yourself.

cmake actually has an issue where a dependency it has depends on cmake, worlds of fun.

dunno on which system you are, here is what it pulls on my system :

curl libarchive shared-mime-info jsoncpp libuv rhash

and you can always download a prebuilt static binary from their website: https://cmake.org/files/v3.12/cmake-3.12.1-Linux-x86_64.tar....

What do you advise using instead?

There is the problem indeed.

In 2018, the age-old problem of the build system remains entirely unsolved.

CMake is terrible, but so are all the others.

I believe the CS community as a whole has gravely under-estimated how hard the build system problem actually is.

We're only starting to recognize this.

Ideally there would be something like premake but with a smaller and more focused DSL.

Reply on news.ycombinator.com