Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[vcpkg doc] Document patching cooldown period guidelines as discussed 2022-10-20 #27386

Closed
wants to merge 2 commits into from
Closed

[vcpkg doc] Document patching cooldown period guidelines as discussed 2022-10-20 #27386

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2a35c27
Document patching cooldown period guidelines as discussed 2022-10-20
BillyONeal Oct 22, 2022
ce9443d
Added patching out tests and examples to the presumed-safe list.
BillyONeal Oct 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions docs/maintainers/maintainer-guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,6 +320,26 @@ See our [versioning specification](../specifications/versioning.md) and [registr

## Patching

vcpkg is a packaging solution, not the ultimate owners of the components that we deploy. We do need to apply patches in some cases to improve compatibility of components with platforms, or compatibility of components with each other.

* We want to avoid patches that:
* upstream would disagree with
* cause vulnerabilities or crashes
* we are incapable of maintaining across upstream version updates
* are large enough to cause license entanglement with the vcpkg repository itself

### Notify upstream owners for upstream relevant patches

If a patch could possibly be useful by upstream, upstream must be notified of the patch's content. (Patches that apply vcpkg-specific behavior unrelated to upstream, such as devendoring a dependency, don't require notification.)

To avoid situations where upstream disagrees with the patch, we will wait at least 30 days to apply such patches.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ras0219-msft suggests moving this line below the list of cases where it doesn't apply.


We will skip this waiting period if we have high confidence that the change is correct. Examples of high confidence patches include, but are not limited to:

* Upstream's acceptance as a patch (for example, backporting a specific change from a pull request upstream has merged).
* Adding missing `#include`s.
* Small and obvious product code fixes (for example, initializing an uninitialized variable).

### Prefer options over patching

It is preferable to set options in a call to `vcpkg_configure_xyz()` over patching the settings directly.
Expand Down