Lizardfs: 3.12.0: download on build

[onlyjob]

LizardFS build system fails to detect libspdlog-dev on Debian and attempts to download it unconditionally:

~~~~
-- Downloading https://github.com/gabime/spdlog/archive/v0.14.0.zip...
CMake Error at cmake/DownloadExternal.cmake:9 (file):
file DOWNLOAD HASH mismatch

for file: [/build/lizardfs-3.12.0+dfsg/build/spdlog-0.14.0.zip] 
  expected hash: [f213d83c466aa7044a132e2488d71b11] 
    actual hash: [d41d8cd98f00b204e9800998ecf8427e] 
         status: [6;"Couldn't resolve host name"]

Call Stack (most recent call first):
cmake/Libraries.cmake:10 (download_external)
CMakeLists.txt:138 (include)

CMake Error at cmake/DownloadExternal.cmake:28 (message):
Download https://github.com/gabime/spdlog/archive/v0.14.0.zip error 6:
"Couldn't resolve host name"
Call Stack (most recent call first):
cmake/Libraries.cmake:10 (download_external)
CMakeLists.txt:138 (include)

-- Configuring incomplete, errors occurred!
~~~~

Downloading on build time is a terrible idea for many reasons like _security_, _privacy_, _reproducibility_, etc. Build system must be able to use system library.

[psarna]

It's like that because we wanted to depend on specific version (we need to patch it a little before it works properly with our code). Maybe we should just include the whole library in our source code to avoid build-time download.

[cypromis]

+1 for unclusion

[pbeza]

There are more build-time downloads (for googletest-release-1.7.0, spdlog-0.14.0, nfs-ganesha-2.5-stable, ntirpc-1.5):

$ grep -Rns download_external
cmake/DownloadExternal.cmake:1:function(download_external PCKG_NAME PCKG_DIR_NAME PCKG_URL)
cmake/Libraries.cmake:5:  download_external(GTEST "googletest-release-1.7.0"
cmake/Libraries.cmake:10:download_external(SPDLOG "spdlog-0.14.0"
cmake/Libraries.cmake:155:  download_external(NFS_GANESHA "nfs-ganesha-2.5-stable"
cmake/Libraries.cmake:157:  download_external(NTIRPC "ntirpc-1.5"

I think that this problem can be solved comprehensively only if LizardFS didn't need specific version of the dependencies. It would be nice to get rid of the patching specific version of dependencies, so that we can make use of e.g. already installed libspdlog-dev package.

IMHO replacing build-time download with including whole library _doesn't address the real problem_.

BTW: downloading dependencies during build – especially if we need specific version of dependencies – is quite common (not only in projects managed by CMake). For now I would rather prefer download_external one-liner than cluttering the project with external dependencies

[pbeza]

This problem was fixed in b7ff4d462b7b6a13c.