[asterisk-dev] New SIP channel driver project page

[Joshua Colp]

Faidon Liambotis wrote:
> On 11/07/12 20:12, Joshua Colp wrote:
>>> Please, please, please, DO NOT ship a third party SIP stack in the
>>> Asterisk tarball.  Find a SIP stack with an active upstream that will
>>> work with Digium to integrate any changes required to integrate it with
>>> Asterisk and produce new upstream releases.
>> While my SIP stack research page is incomplete and not yet ready for
>> discussion I will say though that there is no perfect SIP stack that
>> will make everyone happy in all areas and this will be one of those
>> areas that will warrant collective discussion, both from a packaging and
>> from a "how we work with them" view.
>>
>> Side note - Asterisk 11 and up *does* have pjproject in its tarball for
>> pjnath/pjlib.
>
> Ewwwww! Please, *please* avoid doing that.

Unavoidable with pjproject. Without replacing or modifying the build 
system it only produces static libraries, and is also not packaged by 
any distribution that I've found.

> This is very bad idea, always resulting in a technical and licensing
> entangled mess. Can you e.g. imagine what will happen if everyone does
> that and at point a security flaw is discovered in the stack? This has
> happened in the past with e.g. zlib and it was a huge mess to fix for
> distributions and users -- let alone communicated (i.e. how do you know
> if you're vulnerable).
>
> Would *you* ever embed *two* copies of pjproject, one for pjnath and one
> for pjsip? Why do you expect distributions to feel any different?

I completely agree that it is not an ideal situation. As it is if pjsip 
was chosen a second copy would not be integrated, the one copy would 
remain. If things changed so that pjproject became distributed 
separately as packages then we would change our build system to take 
advantage of that.

-- 
Joshua Colp
Digium, Inc. | Senior Software Developer
445 Jan Davis Drive NW - Huntsville, AL 35806 - USA
Check us out at:  www.digium.com  & www.asterisk.org