home

2025-09-24 - The virtue of building from source

Building from source is both a joy, sometimes necessary, and also a great pain.

The latter part, I don't think I need to elaborate on too much. Anyone who has read through a README and found instructions like:

To build and install name-of-package just add our apt-repo, install 10+ libxx-dev packages and run sudo make install.

Oh btw .. we also only support the newest Ubuntu build (which won't be LTS) and the newest/unstable build of clang/gcc/rustc.

(Bonus points if the project uses some esoteric package manager, which hasn't been in use since Python version 1.6)

I guess this is what Nix is trying to fix, or at least so I've heard. But im to lazy-ignorant to actually check it out, maybe someday...

The first part, though, I feel, is undervalued.

Maybe I'm just a simpleton, but actually being able to wget some tar-balled source code, and through the power of build-scripts and compilers, to have something new and (hopefully) useful in the end, still feels like a touch of magic. In my experience, it also has a much higher success rate, compared to praying that your Ubuntu/Debian version has the correct version of whatever package the maintainer pulled into their project.

Also, in a world where more and more OSS is hosted on Github and built via Github-Actions in a Docker container, actually making sure that 'we' are still able to build this stuff ourselves has great value in my eyes. "But, it worked in my CI..." is a real problem I faced a couple of times already in Uni and open-source work.

The worst offenders I've seen of this are projects whose primary distribution scheme is via Docker containers. And I'm not even talking about web-stuff only, I've seen an emulator, a formal verifier, and source-code analyzer tool both use this as their preffered poison.

I think it's good to be confronted with the cost that adding another dependency can be; otherwise, doesn't that just incentivize always adding another dependency, instead of working out whatever problem you're facing atm? Seems like this only leads to a kind of prisoners-dilemma, always ending in dependency-hell. And what exactly is the dependency-tree branching factor of an average crate.io package?

I don't actually want to know, but I think this problem is being noticed by quite alot of people/communities now (not only due to the whole npm disaster(s), JS-people are beyond saving anyways). This does give some hope, and in the end, it's my choice what goes onto my private machine and what doesn't. It's just sometimes quite sad to see a project have that rats-tail of dependencies.

So in a world of "ship my CLI as a Docker container" be more self-sufficient, build from source.