handling [out-of-date] dependencies

[Reflexe]

Introduction

To make sure we deliver consistent results for a variety of platforms, we deliver dependencies packaged with lmms. That makes us responsible to keep them up to date and secure.

Current state

Windows

We use MinGW and toby's ppa, which is very out of date and lacks of many security updates.

Linux

We use AppImage on xenial, which delivers pretty old Qt. That causes many bugs.

Mac

We are pretty good here with homebrew.

Handling dependencies updates

Currently, we don't keep track of changes and bug fixes in dependencies in order to release a new lmms package.
For example, if SDL would release a critical bugfix now, we won't release a new bugfix version for lmms.

[Reflexe]

My solution

• For windows, use vcpkg on mingw (see https://github.com/reflexe/vcpkg) for everything but qt.
• For linux, add another ppa for a newer qt.

The second problem

I don't really know how to handle it. However, it is possible to get notifications for new releases and then open an issue (and it is automatable).

[DomClark]

Do you plan to open a pull request against upstream for vcpkg mingw support, or will we always be working off a fork? Is there a reason to continue to use mingw once everything is made fully compatible with MSVC?

[PhysSong]

@tobydox's MinGW PPA has some additional issues such as #5979 (comment), #5810 (comment). Any ideas for alternatives?

[Rossmaxx]

Update 2025: The state of things have improved, mostly because we now have MSVC builds for windows and also @tresf and @messmerd are working towards using the latest ubuntu releases (24.04 as of writing this) for the CI which should considerably reduce the version gap for dependencies.

[messmerd]

We're still using Toby's PPA for MinGW unfortunately, and we're still dependent on system packages for Linux, but we're no longer using custom Docker containers and MSVC builds exist now.

We still need to use older Ubuntu releases with their old system packages if we want the AppImages to maintain wide usability for distros. We're using the recent Ubuntu 24.04 for the new Linux ARM64 builds only because not many people use it.

Using vcpkg for Windows and Linux is the dream and would fix all of our problems.
Unfortunately vcpkg's MinGW triplet is a "community triplet", so they don't provide first-class support for it. There are still a few dependencies that don't compile yet. This could potentially be fixed if we submitted patches upstream.

Vcpkg for Linux is farther along and we could use it for some of our dependencies right now if we wanted to, but there are still some CMake-related issues to work out before we can use it for all the dependencies.