using third party library

[Ed Tanous]

On Wed, Jul 29, 2020 at 12:52 PM Vijay Khemka <vijaykhemka at fb.com> wrote:
>
> Hi,
>
> I want to use following library from open source which is under MIT license, please let me know if there is any restriction to use this in our openbmc package.
>
> https://github.com/ArashPartow/exprtk/
>

Upfront, there are some important questions you should ask to save
yourself time on the backend:
1. What binary size on disk does the package add?  Is this in line
with the value it's adding?
2. Is the library of sufficient quality and modernization to be able
to be used under the openbmc c++ coding guidelines?
3. Does the library have regular releases that we can target?
4. Does the library accept patches?
5. Does the library compile under our current compiler settings?
(ideally without warnings)
6. Is the library secure against security testing tools like fuzzers?
7. What license does the library have?  (I suspect MIT will be fine,
as we pull in other MIT components)

In the specific case of this library, looking at the grammar
definition, and given how many features are allowed in the language, I
worry that we're opening ourselves up to lots of expressions that
really shouldn't be done in a virtual sensor parser.  String
modification, slicing, and comparisons for example, probably don't
make sense in the context of sensors.  If/else blocks, and loops also
worry me in the context of a runtime-read config file.  Looking at the
language spec, it's basically another programming language.  If
there's a mechanism to limit the grammar, I think I'd be a lot more ok
with it, although my previous concerns on your design review still
stand.

>
>
> Also I need to write simple recipe to include this so please let me know what is the best location to put this recipe as well. As I am thinking of using this for virtual sensors then I can put under Sensors or if there is better place to put this then please advise.

I'm guessing openembedded would be the best place for this, as the
component is not specific to openbmc.  I don't think sensors is the
right place to put this (as it's not a sensor).