I am currently working on a project that makes use of the OpenSSL library for secure communications. Since this library is a requirement for building the project, I am considering including it in the project's repository. Here are the pros and cons as I see them:
- Self-contained build - with one exception, everything needed for building the project is contained in the repository. It would be nice if the user didn't need to go through the trouble of installing and configuring the development headers / libraries for OpenSSL.
- Security concerns - it goes without saying that the only version of OpenSSL that anyone should be using is always the latest. As soon as a new release is issued, I will need to update the version of OpenSSL in the project's repository.
So the question boils down to this:
Is it wise to include a security library with the project that we need to always ensure gets updated whenever a new release is issued?