[SERVER-9770] Allow windows builds to use the dynamic C and C++ runtime libraries Created: 23/May/13  Updated: 11/Jul/16  Resolved: 06/Sep/13

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: None
Fix Version/s: 2.5.3

Type: Improvement Priority: Major - P3
Reporter: Andrew Morrow (Inactive) Assignee: Eric Milkie
Resolution: Done Votes: 0
Labels: build-system-cleanup
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Windows


Issue Links:
Related
is related to CXX-96 Enforce /MD with Windows C++ DLL driver Closed
Backwards Compatibility: Fully Compatible
Participants:

 Description   

On windows, we currently link against the static C and C++ runtime libraries, unlike all other platforms where we link against them dynamically.

We will add a build-time switch to use /MD instead of /MT, to allow the enterprise build to work.



 Comments   
Comment by auto [ 06/Sep/13 ]

Author:

{u'username': u'milkie', u'name': u'Eric Milkie', u'email': u'milkie@10gen.com'}

Message: SERVER-9770 introduce new scons flag to optionally build with /MD
Branch: master
https://github.com/mongodb/mongo/commit/b91195fe8f9fecc7d4318d430a3c1c064b32d811

Comment by Eric Milkie [ 06/Sep/13 ]

Modified the work for this to allow just the enterprise build to use the dynamic libraries, when a build flag is supplied to scons.

Comment by Dwight Merriman [ 25/Jun/13 ]

i agree the C++ driver needs to work however one is building one's client application, and thus should work with /MD. does it not currently? i would suggest a separate ticket on that and linking them to each other.

Comment by Dwight Merriman [ 25/Jun/13 ]

i am not convinced it should be dynamic. that is the standard on linux but the argument in the description is just that it's the way people do it on linux not the root reasons why that is good.

it effectively creates more combinations of builds, one could imagine a bug with a specific combination of our code and the RTL, in theory you might then want to test all the combinations.

the security thing is an example of a reason to do it.

dynamic link errors can be nightmarish.

another way to think about this: has this ever manifested as an issue in the real world? perhaps it has and i just am unaware. i am positive dynamic will occasionally manifest as an issue as dll's tend to be missing at times.

i also find a certain lack of elegance if our tarball suddenly includes DLLs. yuck. right now, you can run mongod.exe or mongo.exe and there are no dependencies. with foo.dll required, even if in the tarball, you could imagine it not being on the PATH or something. sounds yucky to me.

Comment by Eric Milkie [ 17/Jun/13 ]

We're planning on distributing some DLLs with the MongoDB executables to support some security features. These will be distributed using the installer.
Eventually we will need /MD for the C++ driver as well.

Comment by Tad Marshall [ 23/May/13 ]

I agree about the security issue, but there is a change in the security model in doing this. The old way, we could release a build that corrected a flaw in the MSVC libraries. In the new way, we can't (and theoretically don't have to), but customers have to use Windows Update or another mechanism to address security flaws.

In the general case, we can't assume that a customer has, for example, msvcp100.dll. A new install of Windows Server 2008 certainly won't have it; MSVC 2010 didn't exist when Windows Server 2008 was released. These libraries can be downloaded or we can provide them in a "redistributable package" (the correct way to do it). The MSI from Microsoft (for the MSVC libraries) can be incorporated into our MSI so it is not an extra step for the user ... it is just something to be aware of.

The standalone nature of the Windows MongoDB executables is sort of a feature, though perhaps not an important one.

Comment by Andrew Morrow (Inactive) [ 23/May/13 ]

The security issues cut both ways: if we link statically, then security updates to the dynamic runtime libraries will not be picked up by our server.

Can you elaborate on the deployment issues? Does a stock windows install not come with the msvcrXX.dll libraries pre-installed?

Generated at Thu Feb 08 03:21:24 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.