<html><head><base href="x-msg://295/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jul 12, 2013, at 4:27 PM, David Cole wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div><div data-externalstyle="false" dir="ltr" style="font-family: Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'Khmer UI', 'Nirmala UI', Tunga, 'Lao UI', Ebrima, sans-serif; font-size: 12pt; "><div>It’s a bad bad really bad idea to make the build of OpenSSL “in-house” as you’ve been calling it... CMake SHOULD use the system openssl for distributions that have one already.</div></div></div></span></blockquote><div><br></div><div>I must have missed where ignoring a system version was implied. The question seems to be squarely on ones that do not have it, no? I've asked providers and even advocate using alternates, but at the end of the day one still needs to compile on a myriad of environments that don't have [insert dependency here].</div><br><blockquote type="cite"><span class="Apple-style-span" style="font-family: Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'Khmer UI', 'Nirmala UI', Tunga, 'Lao UI', Ebrima, sans-serif; font-size: 16px; ">If there are problems with that approach, then the problems should be addressed, but bringing a security component into “we have our own custom build of that which you must use”-land is NEVER a good idea.</span></blockquote><div><br></div><div>Saying "that which you must use" is fallacious. It can be set up to be optionally utilized only when there is not one available.</div><div><br></div><div>In much commercial industry, at least for most proprietary software I've ever worked with, it's a fundamental tenant of configuration control. For platforms that specify self-contained binaries or stand-alone installers, it's pretty much requisite.</div><br><blockquote type="cite"><span class="Apple-style-span" style="font-family: Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'Khmer UI', 'Nirmala UI', Tunga, 'Lao UI', Ebrima, sans-serif; font-size: 16px; ">Just my opinion. Feel free to flame me if I’m wrong.</span></blockquote><div><br></div><div>It's a common opinion to be had after using nice package management systems and even I've been guilty of it, but I think a substantial portion of industry is not able to rely on that. Look at nearly any piece of proprietary UNIX software you can buy in a box and you'll usually find it's exceptionally self-contained (if they're at all portable). If they're not a target audience, so be it.</div><br><blockquote type="cite"><span class="Apple-style-span" style="font-family: Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'Khmer UI', 'Nirmala UI', Tunga, 'Lao UI', Ebrima, sans-serif; font-size: 16px; ">I agree with your assessment that the build should produce a warning/error somewhere if CMake is built without openssl support, but I think you’ll find that a tough sell to some other important CMake devs. <span data-externalstyle="false" style="font-family: 'Segoe UI Symbol', 'Apple Color Emoji'; ">😊</span></span></blockquote><div><br></div><div>Bundled is the most convenient since it can be made to always -just work- if it's not detected. A error with a URL is the polite way to say action is required without bundling.</div><div><br></div>Cheers!</div><div>Sean</div><div><br></div></body></html>