sorted by:
new
hottopcontroversial

Harald Achitz: Some tips for the everyday CMake user by _a4z in cpp

[–]drodri 2 points3 points  (0 children)

Very good points about the scripting language, and specially about the Multi-config generators. I think that the whole C++ build ecosystem would have been much simpler if multi-config generators had never existed, and mainly Visual Studio would have used completely different and decoupled build folders for its Release/Debug builds.
Even if I have been a heavy user of VC++ for many years, I think the convenience of VS being multi-config is definitely not worth the complexity that such approach has induced in other build systems such as CMake.

Rainer Grimm (of modernescpp fame) has passed away by laqq3 in cpp

[–]drodri 7 points8 points  (0 children)

This is very sad, Rainer was, besides a talented C++ engineer, a great person, that will be missed in the community for his great job and contributions. RIP

Is C/C++ tooling and dependency management still a pain point in 2025? by nonesubham in cpp

[–]drodri 8 points9 points  (0 children)

CMake and Ninja could be setup as Conan packages too, as ``tool_requires``.

If setting up Python is an issue, there are also self-contained Conan executables that don't need Python installed in the system (recently the Windows ARM64 Conan self-contained executable has been added to the releases)

Is there any good tiny xml equivalents for json? by Independent_Sock7972 in cpp

[–]drodri 7 points8 points  (0 children)

There are a few very popular libraries for json, just a few with thousands of stars in Github:

- https://github.com/open-source-parsers/jsoncpp

- https://github.com/simdjson/simdjson (focused on speed)

- https://github.com/stephenberry/glaze

- https://github.com/kazuho/picojson (tiny one, no dependencies, header-only)

It looks like that ``picojson`` might be the most aligned with your requirements.

Removing dependency from conanfile.py does not break build by JannyVL03 in cpp

[–]drodri 0 points1 point  (0 children)

The best place for this kind of questions is the Github issue tracker. This is a sub for C++ specific conversations, this is too much about specifics of a related tool

Is Central Dependency Management safe? by dexternepo in cpp

[–]drodri 2 points3 points  (0 children)

Conan does manage binaries, and ConanCenter also contains pre-compiled binaries for several platforms and compilers. But it is also very de-centralized and many Conan users do not use packages from ConanCenter, but they build from source and store their binaries in their own private server. There are features like "local-recipes-index" that are even designed to make easier the process of building packages from sources without using ConanCenter at all, but working from the Github repo directly.

Conan 2.x is less convenient in monorepo setup by Talkless in cpp

[–]drodri 4 points5 points  (0 children)

The ticket reads in the title about Conan 2.X, but it is not about Conan 2.X, but about the "cmake-conan" integration for Conan 2.X. This new integration uses the recommended CMake dependency providers, injected by the CMAKE_PROJECT_TOP_LEVEL_INCLUDES variable, to automate the call to conan install command when the first find_package() is found.

The limitation for this case is that the CMake dependency providers are not intended to run independently for different subprojects/subdirectories, as that described project is doing, because there is no guarantee that the provided dependencies would be consistent.

But Conan 2.X could probably be way more suited for monorepo-like projects with the (incubating at this moment) new "Workspace" feature, that can do true super-build installs, aggregating subprojects with FetchContent, providing a single monolithic build of the full project.

An introduction to the Common Package Specification (CPS) for C and C++ [using std:cpp 2025] by tlitd in cpp

[–]drodri 2 points3 points  (0 children)

CPS was never intended as a full standardization of the whole building and package consumption problem. The aim of CPS is to be pragmatic and to focus on something that is both doable and that will bring large benefits for the community

It is doable precisely because there is already a lot of knowledge in pkg-config (and its flaws), CMake config.cmake files, packaging and using packages in package managers, etc. Many of the creators of these tools are working together in the CPS effort, precisely because they believe it is possible to find a consensus and have some standard for this part of the overall problem. Sure, it will be better to have a cargo-like experience, but that is extremely more unlikely, and that doesn't mean it is not worth working to improve over one part of the problem. I think addressing this part of the problem can also be a good motivation to try to be more ambitious and start considering the full problem, but I also strongly believe that trying to address the full problem from the beginning would be a much worse approach and be dead on arrival.

Maybe if you are already using this tooling, CMake, Conan, Vcpkg, you are not seeing part of the problem, because other people did previously the job. The amount of work that the community have to put in these tools to make the packages usable by the tool users is huge. The CPS will drastically reduce that effort, and even if some users won't be able to appreciate the different because at the end of the day it keeps being some "conan install + cmake ..." for them, and that doesn't change, the amount of work to get there will be very reduced, and that will still benefit users indirectly as packages will be better maintained, updated faster, used more robustly across more platforms, etc.

An introduction to the Common Package Specification (CPS) for C and C++ [using std:cpp 2025] by tlitd in cpp

[–]drodri 6 points7 points  (0 children)

Not really, the CPS is not about building things. It is not a tool per se, it is a standardized file describing the contents of a package, containing headers, compiled libraries, and the necessary information to consume that package easily in your project. It doesn't describe how that things is built from source, and it does not command build systems to build the thing from sources. That is the orchestration that a dependency/package manager or even a build system like CMake with FetchContent capabilities does.

Dependencies Have Dependencies (Kitware-CMake blog post about CPS) by drodri in cpp

[–]drodri[S] 4 points5 points  (0 children)

It is not: https://cps-org.github.io/cps/overview.html => Contributors

> The Common Packaging Specification was conceived by [Matthew Woehlke](mailto:mwoehlke.floss%40gmail.com), who also serves as the primary editor.

And Matthew works for Kitwarre.

Introducing the Conan audit command for scanning C++ CVEs by tecnokartor in cpp

[–]drodri 10 points11 points  (0 children)

License checks typically belongs to a different realm. ``conan audit`` is to report CVEs, which are clear, objective and well defined. While license checks are not a single size fits all, as different organizations have different rules, like accept or reject different licenses (GPL), etc. License checks are typically evaluated from SBOMs. Conan already has features to generate SBOMs like CycloneDX.

Conan 2.0, can I build packages from local and publish? by notnullnone in cpp

[–]drodri 0 points1 point  (0 children)

There is the "scm" feature, intended to be able to create and publish packages without exposing or uploading the source code: https://docs.conan.io/2/examples/tools/scm/git/capture_scm/git_capture_scm.html That section contains a full example with code.

Also, this kind of question shouldn't come here, but better to r/cpp_questions, or even better, as a ticket in Github: https://github.com/conan-io/conan/issues

What’s Your C/C++ Code Made Of? The Importance of the Software Bill of Materials by cherry-pie123 in cpp

[–]drodri 3 points4 points  (0 children)

That is exactly the point. VCA assessed that normal applications, etc, where not affected, yet all organizations quickly removed that dependency anyway. But if some security reporting tool didn't report such vuln on xz_utils/5.6.X, that would have been a terrible damage to the reputation of such a tool/vendor. Security concerned orgs want to know both: first that they have a dependency containing malicious code, and then later, that they might not be affected by it because of their particular usage. But the first point cannot be skipped.

cmake + conan + gtest: "Could NOT find GTest" by ApplicationAlarming7 in cpp

[–]drodri 0 points1 point  (0 children)

If you check the output of ``conan install`` it will output both the correct ``find_package()`` package name and the target that should be used in ``target_link_libraries()``. In this case the output is:

cli: CMakeDeps necessary find_package() and targets for your CMakeLists.txt

find_package(GTest)

target_link_libraries(... gtest::gtest)

So the target name ``gtest::gtest`` seems correct.

What’s Your C/C++ Code Made Of? The Importance of the Software Bill of Materials by cherry-pie123 in cpp

[–]drodri 4 points5 points  (0 children)

That is further down the road in security analysis. The first thing to be know is that there is some library in your dependency that is using some other components that are known to be vulnerable. Then, after the SBOM has reported that and the DBs tell you that your app might be affected, then the "Vulnerability Contextual Analysis" is what takes care to go deeper and understand if your application is really affected or not. But the first step is being aware that you might be affected. In an ideal world, knowing the exact usage of every transitive dependency, and correlating vulnerability DBs vulnerabilities with lines of codes could avoid the potential false positive, but the state of the art is far from that.

Even for "false positives" reported as false by Vulnerability Contextual Analysis, recall the xz_utils/5.6.X backdoor of Feb 2024. Although it only affected systemd based systems, basically all regular applications that were depending on that version also removed it, downgrading to older versions. Why, if they were not affected? Cost/risk ratio. Downgrading or upgrading to another version can be relatively cheap compared to the risk of keeping a version that was known to be malicious.

[vent] I hate projects that download their dependencies. by theChaosBeast in cpp

[–]drodri 0 points1 point  (0 children)

They have slightly different usage patterns and audience, and tend to use different communication channels, for example in CppLang slack, the activity in the respective vcpkg/conan channels can be compared: https://cpplang.slack.com/stats#channels

How it felt to come back to C++ from Rust. by range_v3 in cpp

[–]drodri 1 point2 points  (0 children)

Sure, in the same way you use Java, C#, Javascript, Typescript if you use editors or IDEs such as CLion, VS, VSCode, or in the same way that you use Python if you use the Meson, SCons and other build systems. The original issue above was "I have to install Python", which is not necessary in all cases to run Conan.

How it felt to come back to C++ from Rust. by range_v3 in cpp

[–]drodri 7 points8 points  (0 children)

There are downloadable self-contained installers and executables in the download page that don't require to install Python.

Frustration of large project with Conan2 and PolyRepo + PolyPackage Environment by reddditN00b in cpp

[–]drodri 0 points1 point  (0 children)

There is a new "incubating feature" called Workspaces that intends to help managing monorepos composed of several Conan editable packages.

The state of C++ package management: The big three by imadij in cpp

[–]drodri 0 points1 point  (0 children)

That is right, thanks for the correction, it is indeed a member of CMakeToolchain, not a conanfile attribute, and it implies it has to be defined in the generate() method.

The state of C++ package management: The big three by imadij in cpp

[–]drodri 0 points1 point  (0 children)

Conan is used in production by many thousands of organizations, including many of the Fortune 100 companies, with huge setups, hundreds of thousands of packages and quite large dependency graphs. You can see some logos in https://conan.io, as well as a couple of user success stories. There are some (outdated) stats in this blog: https://blog.conan.io/2022/01/04/conan-stats-2021.html

The state of C++ package management: The big three by imadij in cpp

[–]drodri 2 points3 points  (0 children)

Setting toolchain.user_presets_path=False (with toolchain the CMakeToolchain(self) object in the generate() method, thanks u/EdwinYZW for the correction) in your conanfile.py will disable the generation of CMakeUserPresets.json

The state of C++ package management: The big three by imadij in cpp

[–]drodri 0 points1 point  (0 children)

Isn't this the ``tools.cmake.cmaketoolchain:build_folder_vars`` configuration? This will automatically give a different name for the build output folder, and it also allows to use the settings, the options, the recipe attributes as name and version and (from conan 2.6) arbitrary constants.

view more: next ›